Guides
How to sign a PDF on your phone
Walkthroughs for the app's current capabilities: a USB token on iPhone or Mac, the Romanian electronic ID card (CEI) over NFC, and how to check a signature. If something here is unclear or wrong, tell us and we will rewrite it.
Signing with a USB token on iPhone or iPad
Your certificate never leaves the token. The phone sends it a fingerprint of the document and gets a signature back.
-
Unlock the phone first
Then plug the token into the USB-C port. iOS only talks to the chip on an unlocked device, so connecting it to a locked phone does nothing.
-
Use an adapter if the token is USB-A
Most tokens issued in Romania, the eToken 5110 among them, have a full-size USB plug. A plain USB-C to USB-A adapter is enough; you do not need a powered hub.
-
Open the document
Share any PDF to TapSign from Mail, Files, WhatsApp or anywhere with a share sheet. You can also open the app first and pick the file from there.
-
Put the signature where you want it
Tap the page to drop the stamp, then drag it or pull a corner to resize. If you would rather not think about it, switch to Auto-sign and it goes in the usual corner.
-
Enter the token password
The same one you set when your provider issued the certificate, and the one their own software asks for. It goes to the token and nowhere else.
-
Share the signed file
The signed copy is saved with a suffix you can change in Settings, and the share sheet opens straight from the confirmation screen.
Signing with a USB token on a Mac
TapSign talks to the token directly, so there is no vendor software to install and nothing running in the background.
-
Plug the token in
Any USB port. macOS has the driver for standard readers and tokens built in, so nothing needs installing.
-
Open TapSign
The name on your certificate appears at the top right once the token is recognised. If it does not, use Scan again.
-
Add the document
Drop the PDF onto the window, or press Command-O to pick one.
-
Place the signature and sign
Click the page to drop the stamp, drag it where you want it, then enter the token password.
-
Find the signed copy
It is saved next to the original. The first time you sign from a particular folder, macOS asks you to confirm that folder once; after that it saves without asking.
Signing with the Romanian electronic ID card
The card signs over NFC, so an iPhone is all you need. On a Mac the same card works through a contact reader, because no Mac has an NFC reader that can talk to one.
-
Enter the CAN once
Six digits printed on the front of the card, bottom right, under the expiry date. Settings keeps it so you do not type it every time. Without it the chip will not open a connection.
-
Open the document and place the signature
Exactly as with a token.
-
Enter the six-digit signing PIN
The one you chose when the card was activated at the counter. Not the four-digit PIN, which is for logging in to websites.
-
Hold the card against the top of the phone
Keep it still until the phone says it is done. It takes a couple of seconds.
-
On a Mac, use a contact reader instead
Everything else is the same: put the card in the reader, enter the CAN once, then the six-digit signing PIN.
Worth knowing before you rely on it: the certificate the state writes on the card is for an advanced electronic signature. Romanian law gives that the same effect as signing by hand, so it works for contracts, declarations and correspondence. It is not a qualified signature, and the state portals - ANAF, ONRC, SEAP - accept only qualified ones, so for those you still need a certificate from a trust service provider. Adobe Acrobat will then show a yellow bar that says at least one signature has problems. That is Acrobat not recognising the Ministry of Interior, not a broken file. The chip does hold a second, empty key pair reserved for a qualified certificate, so this may change once a provider offers to write one onto the card.
Checking a signature
You can check any signed PDF, whoever produced it, and nothing is uploaded to do it.
-
Open the Verify tab and pick the file
TapSign recomputes the document fingerprint and checks the signature against the certificate embedded in the file.
-
Read the result
It tells you whether the document is unchanged since signing, whether the signature covers the whole file, who signed it and when.
What hardware works
TapSign does not care which brand you own, as long as it is a standard smart card device. These are the ones people in Romania actually have.
USB tokens
Sold with a qualified certificate by certSIGN, DigiSign, Trans Sped, CertDigital and AlfaSign. Most are the same Thales hardware under different labels, usually a SafeNet eToken 5110, and they work on iPhone with a USB-C adapter.
- SafeNet eToken 5110, the one shipped most often in Romania
- SafeNet eToken 5110 CC, the Common Criteria version
- SafeNet eToken 5110+ FIPS
- Thales IDPrime MD 940, a card rather than a stick, so it needs a reader
- Athena IDProtect Key, older but still in circulation
Card readers
Needed on a computer if your certificate is on a card rather than a stick. Any CCID reader works on macOS and Windows without installing drivers, so buy on price and connector.
- Identiv uTrust 2700 R, or the older SCR3310 v2
- ACS ACR39U, and the ACR38U before it
- Thales IDBridge CT30 or CT40
- HID Omnikey 3021 and 3121
- Gemalto PC Twin Reader
Almost all of these are USB-A. On a recent Mac a plain USB-C adapter is fine, or buy the USB-C version where the maker offers one.
Questions people ask
Before you start
Do I need to buy a certificate from you?
No. TapSign does not issue certificates and never will. It uses the one you already own, on your token or on your ID card.
Does a certSIGN, DigiSign or Trans Sped SafeNet token work on iPhone?
Yes. The app talks to the chip, not the vendor software. Most Romanian qualified certificates ship on a SafeNet eToken 5110. Plug it into USB-C, with an adapter if the stick is USB-A, unlock the phone, and sign. The same token works on iPad and Mac.
Can I sign with the Romanian electronic ID card (CEI)?
Yes. On iPhone the card signs over NFC. On a Mac it needs a contact reader. That is an advanced signature, not a qualified one, so it is fine for contracts and declarations but not for ANAF, ONRC or SEAP.
Is this a qualified PAdES signature?
With a qualified token, yes: the file is a PAdES signature and across the EU it has the legal weight of a handwritten one. With the electronic ID card it is still PAdES, but advanced rather than qualified.
Do I need an account?
No. Signing works fully signed out. An account syncs settings and can also keep an encrypted vault of documents you choose to store.
Does anything leave my device?
Signing does not upload the file: the signature is produced by your token or card, and the signed PDF is written locally. If you turn on the vault, those documents sit with us as ciphertext we cannot read.
When something does not work
Nothing appears when I connect the token
On iPhone, check the phone is unlocked and reconnect. On either platform, open Settings and use Scan again. Desktop readers that draw a lot of power sometimes need a powered hub; a bare token usually does not.
How many PIN attempts do I have?
Five on most tokens. Where the device reports the counter, TapSign reads it before sending anything and refuses to spend the last attempt, because a blocked qualified token means buying a new one.
I blocked the PIN on my ID card
The card has no PUK. Any office that issues identity cards will reset it free of charge, and you choose new PINs there.
The card is not detected
Check the CAN in Settings, take the phone out of a thick case, and hold the card against the very top of the phone rather than the middle.
Adobe says “At least one signature has problems”
If you signed with the Romanian electronic ID card, that warning is expected and it does not mean the file is broken. Acrobat checks two different things: whether the document still matches the signature, and whether it recognises the issuer. The first is fine: the bytes were not changed and the card produced a valid signature. The second fails because the Ministry of Interior is not on Adobe’s list of trusted certificate authorities, so there is no green tick. The same file, opened in TapSign’s Verify tab, will say the document is intact. A qualified certificate from certSIGN, DigiSign or Trans Sped usually does get the green tick, because those issuers are on the list. Nothing TapSign writes into the file can change Adobe’s list.
About the signature itself
Will Adobe accept it?
Adobe checks the cryptography anywhere in the world. A green tick is a separate question: it appears only when your certificate authority is on Adobe’s trusted list. Qualified certificates from Romanian providers usually get one. A signature from the electronic ID card does not, and Acrobat shows a yellow warning instead: “At least one signature has problems.” That is a property of the certificate, not of TapSign.
What does "covers the whole document" mean?
A signature protects a byte range. If content was added afterwards, the signature is still valid for what it covered but no longer for the whole file. In a document signed by several people, every signature except the last legitimately covers less than the whole.
Can several people sign the same document?
Yes. Each signature is added without touching the bytes already there, so earlier signatures stay valid.
Where is the signed file saved?
On a Mac, next to the original with a suffix you can change in Settings. On iPhone it goes to the app folder and you share it from there.