How do I sign a PDF without uploading it?
Use a signer that runs in your browser: you open the PDF, place your signature, and the file is rebuilt in the tab before it downloads. Nothing is sent anywhere. SignSwift works this way — no account, no upload, and the signed copy lands in your downloads folder.
Why most "free PDF signers" upload the file
Most online PDF editors were built before browsers could do this. They send the file to a server, render the page there, and send back an image you click on. The upload happens before you see the page, so there is nothing to notice.
That is not automatically wrong. It does mean a copy of your contract exists on someone else's disk for as long as their retention policy says — and you have usually agreed to that by the time you press the first button.
Three ways to tell, in under a minute
- Load the file, then turn off your wifi. If the page still exports, the file was never going anywhere.
- Open the browser's developer tools, go to the Network tab, and look for a request whose body is about the size of your file. A multi-megabyte POST is an upload.
- Search the privacy policy for the word "upload". A site that processes locally usually says so in the first paragraph, because it is the reason to choose it.
These tests need nothing but the site and your browser.
The order that avoids a bad signature
- Open the PDF. Check the page count is what you expect.
- Create the signature — draw it, type it in a handwriting face, or photograph it on white paper.
- Place it, then resize. A signature that covers the clause above it looks careless on both sides.
- Add the date if the document asks for one. Do not guess the format; copy what the page uses.
- Add a Certificate of Execution if the recipient needs to check what was signed. Skip it if they only need a signature.
- Download, then open the downloaded file once before you send it. Confirm the signature is on the page you meant.
The mistakes are almost always sequencing, not drawing ability.
What a browser signature does and does not prove
It proves intent: a person with access to the file placed a mark on it. It does not prove identity, and it is not a qualified electronic signature under eIDAS.
There is also no trusted timestamp. The time recorded is the signing device's clock, which is the only clock available without a server. If the other side needs a timestamp authority — some notarial and court filings do — this is not the tool for that document, and pretending otherwise would waste your afternoon.
A Certificate of Execution narrows the gap: it records the SHA-256 of the exact source file plus the stamps placed, so a recipient holding the original can verify the match. That is evidence, not a notarisation.
Does the PDF leave my device?
No. The file is read into memory in the browser tab and the signed copy is generated there. There is no upload step to disable — the code path does not exist.
Do I need an account?
No. Three downloads a month are free with no sign-up. A pass removes the limit; it is checked against an email you enter at checkout, not an account you create.
Can I sign on a phone?
Yes. Draw with a finger, or type the name if the signature needs to be legible. The layout works at phone width.
Is it legally binding?
In most jurisdictions with e-signature law, a signature showing intent is binding. It is not a qualified signature under eIDAS and carries no trusted timestamp, so check what the recipient requires before relying on it for regulated filings.
This page is general information, not advice for your document. The tools do what they say on their own pages, and every limit is printed there.