How It Works
Architecture & Signing Workflow
XignAll runs entirely on your machine. No documents leave your environment. Here is exactly what happens at each step.
Phase 1 — Document Preparation
Before signing, source files must be in PDF format. XignAll's Pipeline tab handles this automatically for any combination of office documents and PDFs.
Source files are never modified. Each step writes to a separate output folder. Already-processed files are skipped on re-run.
Phase 2 — Digital Signing
XignAll uses pyhanko to apply PAdES-format digital signatures. Each signature is embedded directly in the PDF structure as an incremental update — existing signatures from other signers are preserved.
Signature format
- → PAdES (PDF Advanced Electronic Signatures)
- → eIDAS-compliant — accepted across all EU member states
- → Compatible with QES (Qualified Electronic Signature) when using a qualified certificate on a hardware token
- → Optional RFC 3161 trusted timestamp (DigiCert, GlobalSign, any TSA)
- → Incremental update — preserves existing signatures
Credential handling
- → PKCS#12: .p12/.pfx file + PIN entered once per session
- → PKCS#11: hardware USB token identified by serial number
- → PIN never stored on disk
- → Wrong PIN detection for PKCS#11 — stops signing to prevent token lockout
- → Token detected automatically from installed drivers (Windows, macOS, Linux)
Signature placement
- → Drag-and-drop on live PDF preview
- → Position saved per signer profile
- → Sign all pages, even/odd, or custom range (e.g. 1,3,5–8)
- → Visible appearance: name, reason, location, date, logo image
- → Logo: any PNG/JPG — transparent PNG for stamp overlay supported
Performance
- → 20–60 documents per minute
- → Parallel processing — multiple PDFs signed simultaneously
- → Progress bar per file + overall batch progress
- → Atomic output write — no partial files on crash
Phase 3 — Multi-Signer Serial Workflow
When a document batch requires multiple signers in a defined order, the Workflow tab orchestrates the chain automatically.
- 1.Administrator defines an ordered list of signers — each with their own XignAll profile (certificate + placement).
- 2.First signer receives an email notification. Opens XignAll, selects the workflow, signs the batch. XignAll notifies the next signer automatically.
- 3.Each subsequent signer repeats. Absentee handling: a signer can be skipped and the chain continues.
- 4.Optional SEAL at end of chain. After all individual signers complete, XignAll applies an organizational SEAL signature — certifying the document is finalized and authentic.
- 5.Signature table replacement. If a marker line exists in the document, XignAll removes the old signature table and rebuilds it from scratch across all documents in the batch.
Server Edition — Automated Folder Watch
The Server Edition runs as a background service. No user interaction required — documents placed in a monitored folder are signed automatically.
/SEAL/Signed/. On error: moved to Failed/ with error entry in journal.Telegram Bot — Remote SEAL Signing
The Server Edition includes a Telegram bot that allows authorized users to sign documents remotely — from any device, without opening XignAll.
Flow
- User sends a file (or photo) to the bot in Telegram
- XignAll receives the file on the server
- Converts to PDF if needed (same engine as folder watch)
- Signs with configured SEAL profile
- Sends the signed PDF back to the user — typically within seconds
Supported input
- → Office documents: .docx, .doc, .odt, .rtf, .txt, .xlsx, .xls, .ods, .csv
- → Images: .jpg, .png, .bmp, .tiff, .gif, .webp
- → Phone camera photos (Telegram sends as compressed JPG)
- → PDF: signed directly without conversion
Access is whitelist-based — only pre-authorized Telegram user IDs can interact with the bot. Admin commands: /status, /users, /log.
Supporting Tools
Built into XignAll — no external software required.
Merge & Split
Combine multiple PDFs into one or split by page ranges. Batch operation.
Rotate & Watermark
Rotate specific pages or add text/image watermarks across entire batches.
Anonymize
Auto-redact emails, IBANs, phone numbers, passport numbers, bank cards using regex patterns.
Extract Text & Images
Extract all text to .txt files or extract embedded images from any PDF.
Edit Metadata
View and edit PDF metadata: title, author, subject, keywords, producer.
Encrypt / Decrypt
Password-protect PDFs with AES-128 or remove password protection in batch.
Stamp Extractor
Photo of handwritten signature or ink stamp → background removed → transparent PNG ready for signature logo.
Verify Signatures
Inspect any signed PDF: signer name, certificate, timestamp, modification detection.
Signature Profiles
Save unlimited signer profiles — certificate path, placement, appearance — switch in one click.
Ready to sign your first batch?
Free edition available with no time limit on Windows, macOS, and Linux.