How do you sign a PDF without uploading it anywhere?

Why “no upload” is a real distinction

Nearly every free PDF signing tool is a website with a server behind it. You choose a file, the browser uploads it, the server draws your signature onto it, and you download the result. The privacy promise is then a promise about how long the copy is kept — Smallpdf states one hour, iLovePDF states two — and about who can reach it while it is there.

That is not nothing. It is also not the same thing as the file never going. A signature page is usually the most sensitive page of the most sensitive document a person handles all year: an employment contract, a tenancy agreement, a power of attorney, a settlement. The copy that was never made cannot be breached, subpoenaed, retained by mistake, or covered by a later change to a privacy policy.

Browsers have been able to do the whole job locally for years. Rendering a PDF, capturing a stroke, compositing an image onto a page and writing a new file are all things the platform provides. FormworkPDF is that, with no fallback path that uploads on a bad day, because there is nowhere for it to fall back to.

Three ways in, one thing out

Whichever route you take, what lands on the page is a cropped PNG with a transparent background.

Draw it. Finger on a phone, trackpad or stylus on a laptop. The stroke is captured at the resolution the pointer reports, which on a stylus is a great deal finer than the signature box needs.

Type it. Four handwriting faces ship with the app, and you can name any Google Font instead — the one request the signing flow makes. Typed signatures are rasterised rather than embedded as a font, which welds no font into your exported PDF and keeps the file the same shape it would be if you had drawn it. At the size it is rendered, a typed signature lands around 335 DPI once it has been fitted into a signature box.

Photograph it. Sign a sheet of paper, take a picture, and the paper is removed from behind the ink so what goes onto the form is the signature alone. This is the route people who dislike drawing with a finger end up using, and it produces the most convincing result.

Initials are the same artefact at a different size, and they get their own tool because forms ask for them page after page.

Placing it where it belongs

If the PDF has a real signature field, the signature goes in it. If it does not — and on a scan or a print-out it will not — the blank on the signature line is found like any other blank, or you place the signature by hand.

Anything placed by hand can be moved afterwards: drag it, pull the corner handle to resize, or nudge it with the arrow keys, holding shift for 10-point steps. Positions are stored in PDF points rather than screen pixels, so they survive zooming and land exactly where the preview showed them.

What the exported file contains

On export the signature is drawn into the page content and the document is flattened. The practical consequences:

• It cannot be dragged off, hidden or deleted in another PDF reader.
• It prints and renders identically everywhere, including on phones and in whatever twelve-year-old viewer the other party uses.
• The rest of the form is fixed at the same time, so the answers cannot be edited after you send it.

The file is rebuilt from the bytes you opened, not from the on-screen preview. The original is kept untouched in memory and every export starts from it again, which is why filling is never destructive and why exporting twice gives you the same file twice.

What is kept, and where

Your signature, your details and the answers you typed are stored in IndexedDB on your device, keyed by a hash of the file, so reopening the same PDF offers them back. The PDF itself is only kept if you switch on Keep the PDF too, which is off until you say otherwise.

There is no account, so there is nothing to sync. Download my data writes one readable JSON file with your details, your signature and your saved answers, and importing it merges rather than replaces. That file never contains a PDF.