How to sign a PDF on Windows

What your PC needs

On Windows, Attest runs in Edge or Chrome, with nothing to install. You sign with a passkey: a cryptographic key only you control, created for one website and unlocked with Windows Hello, with your phone or, in Chrome with Google Password Manager, with the confirmation Chrome asks for, such as a Google Password Manager PIN.

• Windows Hello. Microsoft describes it as signing in with "facial recognition, fingerprint, or a PIN". Face sign-in needs a Hello-compatible camera, and fingerprint sign-in a fingerprint reader; Windows Hello unlocks passkeys with either, or with your PIN. You set it up in Settings, under Accounts, then Sign-in options.
• Or your phone. At the passkey prompt, you can use an iPhone, iPad or Android phone instead: scan the QR code with the phone and confirm there. Microsoft says both devices need Bluetooth turned on and an internet connection.
• Or Google Password Manager, in Chrome. Chrome saves new passkeys to Google Password Manager by default, Google says, and its help adds: "If this is your first passkey, you'll find a prompt to create a Google Password Manager PIN. This PIN will be requested every time you log in to a website where you have a passkey saved in Google Password Manager." When you use a passkey, Chrome "may require additional confirmation" by asking for your desktop password or PIN, your fingerprint or your Google Password Manager PIN. An Attest signature uses the passkey the way a sign-in does, so the same confirmation appears.

Your face and fingerprint stay on your PC. Microsoft says biometric information used in the authentication process "remains on the user's device and isn't transmitted across the network or to the service". Windows Hello only unlocks the passkey; the passkey signs a statement that names the exact document and everything you entered on it, and Attest receives that signature, never the passkey's secret.

Where Windows saves your passkey

When you create a passkey, the prompt suggests where to save it. Microsoft says you can accept with Continue or Create, or pick another place with Change or Save another way:

Where	What it means
This PC, with Windows Hello	Saved locally on this computer. Google notes that passkeys saved to Windows Hello can't be recovered if the computer is lost or Windows is reinstalled
A password manager	Microsoft Password Manager, Google Password Manager or another one. Microsoft says synced passkeys "sync through your cloud account", so you can use them on another device
Your iPhone, iPad or Android phone	Saved on the phone, which you use to confirm

For Attest, the choice matters in one way: a passkey saved only on this PC stays on this PC. Keep the recovery phrase Attest gives you when you set up your key, and add a passkey on a second device from Attest's Security page, so you can still unlock your key if this PC is lost or reinstalled.

One Windows setting to know: from Windows 11 version 24H2, Windows asks for your consent before an app can use passkeys. If you declined it for your browser, passkeys won't work there until you allow it again in Settings, under Privacy & security, then Passkey access.

Before you start

You need the PDF saved on your PC, for example in your Downloads folder, of up to 8 MB, and your email address. Starting free needs nothing else, not even a credit card.

Sign a PDF someone emailed you

This is for a document you received outside Attest, such as a supplier agreement or an engagement letter emailed to you to sign and return. The video above records the signing part, from Sign a document yourself on.

1. In Edge or Chrome, go to attest.datahubz.com/sign and click Start free.
2. Type your email, click Email me a sign-in link, and open the link Attest sends you.
3. Set up your signing key, once. Click Security in the sidebar, under Settings, then click Set up with a passkey.
4. In the passkey prompt, choose where to save the passkey (see above) and confirm with your face, fingerprint or PIN, or scan the QR code with your phone. In Chrome, the first time you save a passkey in Google Password Manager, Chrome asks you to create a Google Password Manager PIN, Google says, and it can ask for that PIN when you use the passkey.
5. Save the recovery phrase Attest shows you somewhere safe, such as your password manager. Attest can't recover it for you. Check I saved my recovery phrase. and click Continue.
6. Open Documents and click Sign a document yourself.
7. Click Attach the document to be signed and choose your PDF. Its file name becomes the title, which you can change.
8. Under Verification, keep Public certificate, or choose Private so that only you can see the certificate (anyone else who looks it up is told it exists and is private).
9. Click Next: place your signature, then click the page where you sign. For initials or a date, choose Initials or Date signed and click the page the same way. Drag a field to move it, or drag its corner to resize it.
10. Click Continue to sign. Attest opens the signing page.
11. Click Open and start signing. The PDF is decrypted in your browser; confirm the passkey prompt if one appears, because your passkey also unlocks your key.
12. Click your signature field. Type your full name, then pick a style or switch to Draw and sign with your mouse, pen or touchscreen, and click Adopt and sign here. Click the date field and it fills in the date.
13. Click Sign with your passkey and confirm with Windows Hello or your Google Password Manager PIN, or with your phone.
14. Click View and download the signed copy, then Download signed copy, and attach the PDF to your reply.

Send the copy once it reads "every party signed, sealed and anchored". If it says "anchoring now (preliminary copy)", close it and open it again a little later: on the Free plan the anchor is written within about 10 minutes, and on the Signing plan right after you sign. You can also open it later from Documents, with View the signed copy.

If the document came to you through Attest instead, you need no account and pay nothing: How to sign a document someone sent you walks through every screen.

If Attest asks for your recovery phrase

Some passkey providers can sign but can't unlock your key. If yours is one of them, the Security page says so under that passkey, and Attest asks for your recovery phrase when you open or release a document. You still sign with your passkey. A passkey you add with a provider that can protect your key unlocks it (the Security page shows no such note under it).

What your signed copy contains

Every party gets the same signed PDF: the signed pages, with a "Signed with Attest" stamp on each signature and a seal line at the foot of every page, a certificate of completion, the audit trail up to completion and a "Verify it yourself, without us" page, with the full evidence, the original document and a standalone verifier attached inside. Each stamp carries the document's verification code, the signing date and a QR code that opens its certificate.

Download signed copy saves the full sealed copy. Signed pages only saves just the document's own pages, stamps included, for a filing that must keep its page count. Both verify. Anyone can check them for free at attest.datahubz.com/verify, with no account, and the open-source verifier inside the PDF runs in any browser, even without Attest: it checks each signer's passkey signature, the original document, the pages you see and Attest's anchored record on Horizen, a public blockchain.

Attest or ink in Microsoft Edge

Edge's built-in PDF reader lets you draw on a PDF, and Microsoft says inking "comes in handy to take quick notes for easy reference, sign, or fill out PDF forms". That places ink strokes on the page. Nothing in them ties the signature to you or to this version of the document.

For a quick form, that may be all you need. When you may have to prove the signature later, to a client, a supplier or a lender, use Attest: the signature comes from your passkey, the signed state is anchored on a public blockchain, and if one byte of the document or of your entries changes, verification fails.

What it costs

What you sign on your PC	Cost
A document someone sends you through Attest	Free, on any plan. It uses none of your documents
A PDF you upload and sign yourself	One of your documents: 2 free in total, then the Signing plan, $5 a month for 20
A document you send to other people	One of your documents, the same way

The people who sign never pay, and paid plans can be cancelled any time.