Redacting a PDF That’s Already Been Signed Invalidates the Signature
A digital signature is a cryptographic seal over the file’s bytes. Burn-in redaction changes those bytes. The appearance of a signature image may still sit on the page; the cryptographic signature will no longer verify. That is expected, not a bug.
Signed PDFs fail redaction in a way that looks like a software bug and is actually cryptography working. Platforms such as DocuSign and Adobe Sign, and many “certificate signatures” in Acrobat, attach a signature dictionary that includes a hash of a byte range of the file. Any later edit — including a legitimate privacy redaction — means the hash no longer matches. Readers show a warning. Relying parties should treat the file as altered after signing. The ink-looking appearance of a name in a box can still be visible. The seal is not.
Notarization timing is adjacent but not identical; redact a PDF before notarizing is the notary-packet page. Ordinary contract masking before a deal is redact a contract PDF. This page is the already-executed file: what breaking the signature means, and what to do instead of “quietly boxing the SSN on the signed PDF.”
What a digital signature is actually locking
In the PDF spec, a signature typically covers a ByteRange: two intervals of the file that exclude the signature value itself. The signer’s software hashes those bytes and stores the signature. Verification recomputes the hash. Redaction that rewrites page content, xref tables, or incremental updates outside an approved workflow changes the hash. Some workflows allow incremental updates that add later signatures or annotations without invalidating a prior approval — that is a carefully specified pattern, not “draw a black box in a random editor.” HidePDF’s burn-in rewrites pages. Treat it as a new document.
DocuSign and Adobe Sign completion certificates are vendor implementations of this idea (plus their own audit trails). Downloading the “completed PDF” and opening it in a random rasterizer still leaves you with a signed PDF. Editing that download in Preview or in HidePDF produces a descendant file. The vendor’s website may still show the original completed envelope. Your edited download is not that envelope. Mixing them — emailing the edited file as if it were the executed original — is how disputes start.
A scanned wet-ink signature is not this mechanism. It is an image. Redacting other fields on a scan does not “invalidate a cryptographically bound hash” because there isn’t one. It can still be a bad idea legally (you altered an executed paper scan). Different problem: policy and evidence, not PDF signature validation.
What “invalid” means in practice
Acrobat and other readers show a banner: the document has been modified since it was signed, or the signature is invalid. Courts and counterparties who care about e-sign statutes care about that banner. A landlord, a bank, or a licensing board may reject the file. Your intent (privacy) does not recertify the hash. The practical options are: (1) re-execute a version that never contained the extra secret, or that contains an agreed redaction set, through the same signing platform; (2) produce a clearly labeled unofficial copy for a limited audience (a helper, a journalist) that is not pretending to be the executed original; (3) ask counsel whether a certified excerpt or a platform-native redaction workflow exists for that envelope.
Do not “fix” the banner by flattening and hoping nobody checks. The check is the point of the signature. Do not extract the signature appearance as an image and paste it onto a redacted layout as if that restored legal effect. That is a drawing of a signature, not a signature.
Better order: redact, then sign — or re-sign after a new original
If it is not signed yet
Burn in extras in the tool above, verify paste fails, then send that PDF to the signing platform. Signatures then bind the masked file.
If it is already executed and you need a privacy copy
Work on a duplicate. Label the output “unofficial excerpt — signature will not verify.” Do not submit it to a portal that demanded the executed original.
If the executed file must change for everyone
Prepare a new source PDF (redacted or never containing the field), send it through DocuSign/Adobe Sign/your CA workflow again, and retire the old envelope according to counsel.
Keep the true executed file intact
Hash and store the completed PDF from the vendor. Do not overwrite it with a HidePDF export.
Leases, NDAs, and “we already signed”
A lease PDF with a tenant SSN in an addendum is a common request: landlord wants the executed form, tenant wants to share a copy with a roommate without the SSN. The roommate copy should be a new burned-in file labeled as a convenience copy. The landlord’s executed file stays in the envelope. An NDA already signed by both parties is the same split: you cannot silently mask a clause after the fact and still call it the signed NDA. You can share a redacted convenience copy if the other party agreed, or you re-sign a narrower document.
For contract language you are still negotiating, redact a contract PDF is the right family. For notary packets, do not alter after the stamp; use redact a PDF before notarizing. For this page’s files — already cryptographically signed — plan on invalidation if you burn in, and plan your audience around that fact.
Mistakes that treat a banner as optional
Editing the completed DocuSign PDF and forwarding it as “the signed lease.” It is a modified file. Say so, or re-execute.
Covering a field in Preview and being confused when Adobe says the signature is invalid. That message is correct.
Pasting a signature image onto a redacted layout. Pixels of a name are not a certificate.
Redacting the only copy of the completed envelope. Keep the vendor original. Work on a duplicate.
Assuming HidePDF can “redact in a signature-preserving way.” Burn-in changes bytes. That is the product.
Related guides
Explore more ways to redact PDFs privately, or use the redaction tool above:
Frequently asked questions
Can I black out a Social Security number on a DocuSign-completed PDF and keep it “signed”?
You can make a new PDF that looks signed. The cryptographic signature will not validate against the modified bytes. Recipients and relying parties who check the signature will see it as invalid or as an incremental change after signing. For an executed lease or NDA, that usually means you need a new signed original — or a clearly unofficial excerpt — not a quietly edited “same” file.
Is a drawn signature the same as a digital signature?
No. A PNG of a wet-ink signature on the page is pixels. A digital signature (PAdES / PKCS#7-style, Adobe Sign, many DocuSign completions) is a hash and certificate bound to a byte range. Covering pixels of a wet-ink scan is ordinary redaction. Changing a digitally signed file breaks the seal.
Should I redact before I send a document out for signature?
When the signed packet must not contain extras (a draft appendix, an unrelated ID scan), yes: burn in first, then send that file to DocuSign or Adobe Sign. Notarization has a similar “don’t alter after the notary” logic — see the before-notarizing guide. Do not sign first and hope to mask later.
Does HidePDF re-sign or keep signatures valid?
No. HidePDF burns boxes into a new PDF in your browser. It is not a certificate authority and it does not preserve an existing signature over unchanged bytes. Processing is local; the output is a new file.