Imagine you sign a rent agreement with a pen. The ink proves very little on its own — what really protects you is the paper. Paper is awkward to change. Rub out a number and it shows.
A PDF is not paper. Anyone with the right software can change a number in a PDF perfectly, and no one can tell by looking. So a scanned picture of your pen signature, pasted onto a PDF, protects nobody.
The two kinds of signature
An ink signature is a picture. You can copy it, resize it, and paste it onto a different page. The page will not complain, because a picture knows nothing about the page it sits on.
A digital signature is a calculation. It is made from the file — every letter, every comma, every full stop — so it is tied to that exact file and no other.
What the computer actually does
Three steps, and none of them are as hard as they sound:
- Squeeze. The whole file is run through a fixed recipe that always produces a number of the same length. The same file always gives the same number.
- Lock. That number is encrypted with the signer's private key — a key nobody else has, kept on a token, a card or a secure chip.
- Attach. The locked number rides inside the PDF, along with a certificate saying who owns that key.
Why one comma matters
This is the part that surprises people. The check is not "does this look right?" It is arithmetic: two numbers either match or they do not. There is no in-between, no opinion, and no way to argue with it.
It is also why VeriPatra can tell you "changed after signing" with real confidence — and why it will never tell you that a document's contents are true. Nothing in the maths knows whether a salary figure is honest. It only knows whether that figure is the one that was signed.
Who vouches for the signer
A key on its own proves someone signed — not who. That is what a Certifying Authority is for. In India, licensed CAs sit under the Controller of Certifying Authorities, and VeriPatra checks whether a signing certificate chains back to those official trust roots.
If it does not, the document is not necessarily fake. It just means nobody official is vouching for who signed it — which is why that case comes back amber, not red.
What VeriPatra shows you
One sentence first: digitally signed and unaltered, needs caution, or could not be verified. Then, if you want it, the eight checks behind that sentence and the certificate chain in full.
If our service cannot be reached you will see an amber "could not check" — never a made-up verdict. A missed check and a failed check are different things, and we keep them different.
Common questions
Is a scanned signature legal in India?
Sometimes, depending on the document — but "legal" and "provable" are not the same thing. A scanned signature can be disputed. A valid digital signature is a great deal harder to argue with.
Can I add my ink signature to a signed PDF?
You can, but it breaks the existing digital signature — the file changes, so the number stops matching. VeriPatra warns you before you do it and leaves your original untouched.
Drop a PDF in and see the eight checks for yourself. No account, nothing kept.