E-signatures · Glossary
What is DocMDP?
DocMDP stands for document modification detection and prevention. It is a permission recorded with a certifying signature in a PDF that declares which later changes are acceptable. Readers use it to decide whether an edit made after signing invalidates the signature or is treated as permitted.
It is the setting that decides whether a signed document is finished or still fillable. Most signing problems that look mysterious come down to which level was chosen.
Nuwan Madhusanka · Co-founder
5 min read · Published
| Level | What stays allowed | Typical use |
|---|---|---|
| P equals 1 | Nothing. Any change invalidates the signature | A finished agreement that nobody should touch |
| P equals 2 | Filling form fields and adding signatures | A template circulated for completion |
| P equals 3 | Form filling, signing and annotations | A document under review with comments |
Certifying against ordinary signing
An ordinary signature says a person approved the document as it stood. A certifying signature also constrains the future: it is applied by the author of the finished file, there can be only one per document, and it must be the first signature in the file. The permission travels with it in the document's permissions dictionary, alongside flags telling readers that signatures exist and that the file may only be extended by appending. That combination is what allows a reader to distinguish a legitimate later signature from an edit that should raise an alarm. Who holds the certifying key matters as much as the level chosen. In a hosted signing service the key belongs to the service rather than to any of the parties, so the assertion a reader sees is that this service produced this file and considers it final. That is appropriate, because the service is the only participant present at the end of the process, but it means the certifying signature is not evidence about the signers themselves. Their participation is evidenced by the signing record instead, and the two artefacts answer different questions. Reading them together is what lets somebody say both that the file is intact and that named people agreed to it.
Reading the levels as promises
Level one is a promise that the file is final. Level two says the shape is final but the blanks are not, which suits a template sent out for completion where the sender wants the wording protected. Level three adds annotations, which is useful during review but weak as a final state, since a comment box placed over a figure can mislead a casual reader while leaving the signature intact. Choosing a level is therefore a statement about what stage the document is at, not a security dial to be turned up or down.
Why the strictest level suits completed agreements
A completed agreement has no remaining blanks and no legitimate reason to accept changes, so anything less than the strictest level would tolerate edits nobody wants. The cost is that the document becomes genuinely inert: no annotations, no form filling, no appending anything afterwards. That is usually the desired outcome for a signed contract, and it is the reason a certificate of completion has to be attached before certification rather than after, since attaching pages later is exactly the kind of change the level forbids.
What a reader shows when the rule is broken
Behaviour varies slightly between readers, but the common outcome is a warning that the document has been modified since it was certified, sometimes with a note that the modification is not permitted by the author. The signature panel will typically show the certifying signature as invalid rather than merely unknown, which is a stronger statement than an untrusted issuer warning. Readers may also flag the document at open time rather than waiting for the panel to be inspected, which is the point of the mechanism.
Common ways documents end up broken
Re-saving through a viewer that rewrites the file structure. Running a certified PDF through a compression or conversion tool. Merging it with a cover page. Adding a stamp or a page number after the fact. Each is a routine document handling step that would be harmless on an unsigned file, and each produces a certified document that reports itself as altered. The remedy is procedural: treat the certified file as the final artefact and do any assembly before it is produced.
How the certification is applied here
The completed document is certified at level one, written into the permissions dictionary with the signature flags for existing signatures and append only extension, and the recorded algorithm string is PAdES-SHA256-DocMDP. Certification is the last step in the pipeline, which is why an appended completion certificate is added before it. If the step fails, the envelope is marked as failed and the owner is emailed rather than an uncertified document being released as though it were complete.
Questions people ask
Can a document have two certifying signatures?
No. The format allows one certifying signature per document and it must be the first one. Additional approval signatures can be added afterwards if the permission level allows, but a second certification would contradict the first, so readers reject it.
Does level one stop anyone opening the file?
No. Opening, reading, printing and copying text are unaffected by the permission. It concerns modifications to the file, not access to its contents. If access needs restricting, that is a separate encryption feature with quite different trade offs, and it is not part of the signature machinery at all.
Can I add a signature to a document certified at level one?
No, because adding one changes the file. That is why multi party signing stamps everybody first and certifies once at the end, rather than certifying after the first signer. Where a document must accept later signatures, level two is the setting that permits it.
How do I see the level in a file?
A signature panel usually reports whether the signature is certifying and what changes are permitted. Inspecting the file structure directly shows the permissions entry with the numeric value. For most purposes the reader's wording, such as no changes allowed, is the practical answer.
Is DocMDP part of PAdES?
It comes from the PDF specification rather than from the European signature standards, but the two are used together: a PAdES signature carried in a PDF can be a certifying one with a permission level set. The standards describe the signature format, the specification describes what the permission means.
What if I need to correct a certified document?
Produce a corrected document and have it signed again. Editing a certified file is not repairable, because the whole point of the mechanism is that the change is recorded. In a signing workflow that means voiding the envelope and sending a new one rather than patching the output.
Make one with e-signatures
The button opens the generator with this use case already described. Change the wording to match your own.
Send a document for signingRelated questions
- Certified PDF against signed PDFA signed PDF carries an approval signature. A certified PDF carries the author's certifying signature and a rule about later changes. How readers show each.
- What is LTV in a PDF signature?LTV embeds the certificates and revocation data a signature needs, so it can still be checked after the certificate expires. What gets stored and why.
- What is PAdES?PAdES is the ETSI standard for digital signatures embedded in a PDF. What it adds over a plain signature, its levels, and how to spot one in a reader.
Written and checked by the OneCraft team. Last checked .