DOCX Signer User Manual

Digitally sign your Word, Excel and PowerPoint documents in a few clicks, with an invisible signature or with a visible signature line, add a trusted time stamp, let several people sign the same document, and sign whole folders automatically. No technical knowledge needed; developers find PowerShell, C# and VB.NET examples at the end.

1. What is DOCX Signer?

A Word, Excel or PowerPoint document can be changed by anyone who has the file. A digital signature solves two problems:

• Who signed it? The signature is created with your personal digital certificate, so it proves your identity.
• Was it changed? If even one character of the document is modified after signing, Word, Excel and PowerPoint report the signature as invalid.

The main function of DOCX Signer is to sign Office documents with X.509 digital certificates. The signatures are the same kind that Microsoft Office creates (File → Info → Protect Document → Add a Digital Signature), so the people who receive your documents see them in Word, Excel and PowerPoint without installing anything. You can sign a single document, or select an input folder and an output folder and sign hundreds of documents at once (bulk signing), which is ideal for the documents of a company. The same signatures can be created automatically, without any window, from the command line (section 14).

Who is this manual for?

• Users — sections 1 to 15 explain, step by step, how to install the product, register it, choose a certificate, sign documents, add visible signatures, let several people sign, and check the signatures.
• Developers and administrators — sections 16 to 18 explain that DOCX Signer is built on the Signature Library (SignLib), and show how to create the same signatures from Windows PowerShell, C# or VB.NET. One of the purposes of DOCX Signer is to let you see what the library can do before you write a single line of code.

Useful links

2. Product installation

We recommend installing the product with an Administrator account. After the setup file is verified, the operating system might ask for your permission to install the program: click Yes.

What you need

• Windows 8 or later (including Windows 10, Windows 11 and Windows Server).
• Microsoft .NET Framework 4.6.2 or newer. It is already part of Windows 10 and Windows 11.
• A digital certificate to sign with. If you do not have one yet, you can create a test certificate (section 11).
• Microsoft Office is not needed to sign. It is needed only to open the documents and to see the signatures, as for the people who receive them: Office 2010 or later.

Installation steps

1. Download the setup file. Get DOCXSigner.msi from the product page and run it.
2. If Windows SmartScreen appears, allow the program to run. You may see the window Windows protected your PC. Click More info and then Run anyway. See the explanation below.
3. Read the license agreement. Read the EULA (End-User License Agreement). If you want to continue, select I Agree and click Next until the setup is finished.
4. Start the program. Start DOCX Signer from the Windows Start menu. By default the files are in the Secure Soft\DOCX Signer folder of Program Files (on a 64-bit Windows: C:\Program Files (x86)\Secure Soft\DOCX Signer).

What is Windows SmartScreen?

SmartScreen is a protection built into Windows. When you run a program you downloaded, Windows compares it with a list of programs that are known and were already downloaded by many people. A program that Windows does not know yet, for example a new version that was published recently, is shown as an unrecognized app, and the window below appears.

This message does not mean that the file contains a virus. It only means that Windows has no reputation data about it yet. To continue:

1. Click More info. The name of the file and of the publisher are displayed.
2. Click Run anyway and the setup starts.

3. Trial period and product registration

A new, unregistered installation works for a trial period of about 30 days. The title of the window shows how much is left, for example DOCX Signer - Expires in 30 days, and the buttons Register Now and Buy Now! are visible.

How to register the product

1. Get a serial number. To register the product you need a serial number (also called license code). You can buy it online directly from the product page, https://www.signfiles.com/docx-signer/. You can also click Buy Now! in the program, which opens the same page.
2. Open the registration window. Open DOCX Signer and click the Register Now button (or Help → Register Now...).
3. Type the license code. Enter the received serial in the first box. The second box, Licensed to (optional), is for a name: if you type one, it is shown in the title of the window.
4. Click Register. If the serial number is correct, the product is successfully registered.

4. Sign your first document

This is the whole process. It takes less than a minute once you have a certificate.

1. Choose the document. Keep A single Office document selected. Click the ... button under Source and select the Word, Excel or PowerPoint file you want to sign.
2. Check where the signed copy is saved. The Destination is filled in automatically with the same name followed by [signed] (for example contract[signed].docx). Click the ... button under Destination to choose another folder or name. The destination must be a different file from the source.
3. Select your digital certificate. Click Select the Digital Certificate.... Choose the certificate from the Windows store, or a .pfx file, and click OK (details in section 6).
4. Leave the format on the recommended value. XAdES-B - basic (recommended) and SHA256 are already selected and are the right choice for most uses (see section 7.3).
5. Optional: a visible signature. To add a signature line to a Word document, click Visible Signature and Signer Details... (section 8). Without it, the signature is invisible.
6. Click Apply Digital Signature. After a moment you see the message The file was digitally signed succesfully. Your signed document is in the destination you chose.

Before the signed document is saved, DOCX Signer verifies the new signature: a signed document is delivered only if its signature is valid, and only if the signatures that the document already had are still valid.

5. The main window

Menus

6. Digital certificates

A digital certificate is your electronic identity card, issued by a certification authority. To sign with DOCX Signer you need one. This section explains where certificates are kept and how to select the one you want to sign with.

6.1 Where the certificates are stored

A certificate that can sign documents has two parts: a public key (the part other people see, inside the certificate) and a private key (the secret part, which only you have). The digital signature is created with the private key. The certificates are kept in two places:

• in the Windows Certificate Store (called Microsoft Store in the program);
• in a PFX (or P12) file.

The Windows Certificate Store (Microsoft Store)

The Windows Certificate Store is the place where Windows keeps the certificates of the computer and of each user. In DOCX Signer it appears as Windows Certificate Store and Certificates Available on Microsoft Store.

To see the certificates of your account:

1. Press Win + R, type certmgr.msc and press Enter.
2. Open Personal → Certificates.

(The older way still works: Internet Options → Content tab → Certificates button, tab Personal.)

To create digital signatures, the certificates of the Personal store are used. They must have a public and a private key. You can check this by opening a certificate: in the General tab Windows writes You have a private key that corresponds to this certificate.

The private key itself can be stored:

• on the file system of the computer (for example, an imported PFX file);
• on a cryptographic smart card or USB token (like Aladdin eToken or SafeNet iKey) — see 6.2;
• on an HSM (Hardware Security Module), a device that keeps keys for a company.

The certificates you can use are listed per store location: Current User (your own certificates, the usual case) or Local Machine (certificates installed for all the users of the computer). DOCX Signer works with RSA and ECDSA (elliptic curve) certificates.

PFX and P12 files

Another way to keep a digital certificate is a PFX (or P12) file. The file contains the public and the private key of the certificate, and it is protected by a password, to keep the key pair safe.

6.2 Certificates stored on smart cards or USB tokens

If your certificate is stored on a smart card or on a USB token (like Aladdin eToken or SafeNet), the private key never leaves the device: it signs inside the device. For DOCX Signer to use it, the certificate must appear in the Windows Certificate Store (6.1).

Usually, the driver of the smart card or its middleware (the software delivered with the token) installs the certificate in the Windows store automatically when the token is connected. If the certificate does not appear in the list, ask your vendor how to add it to the store, and look at the options of the middleware, like below:

Once the certificate is in the store, select it in DOCX Signer as described in 6.3.

6.3 Select the digital certificate for creating signatures

To digitally sign a document, a digital certificate must be selected first. Click Select the Digital Certificate... (or Tools → Select the Digital Certificate...). The certificate can be stored in the Windows store or in a PFX file.

Option A: a PFX file

Some certificates are delivered as a file with the extension .pfx (or .p12), protected by a password.

1. Select PFX digital certificate file.
2. Click ... and pick your .pfx file (or type its path).
3. Type the PFX file password. The Show button next to it displays the details of the certificate so you can check you picked the right one.
4. Click OK.

Option B: a certificate installed in Windows

Certificates installed on the computer, or stored on a USB token or smart card, appear in the Windows Certificate Store.

1. Select Windows Certificate Store.
2. In Certificate Store choose Current User (your own certificates, the usual case) or Local Machine (certificates installed for the whole computer).
3. Pick your certificate from the list Certificates Available on Microsoft Store. The list shows the name of the owner, the issuer and the expiry date; an expired certificate is marked EXPIRED and is placed at the end. Show displays the full certificate.
4. Click OK.

Certificate Information

In the lower part of the window, Certificate Information summarizes the selected certificate: to whom and by whom it was issued, until when it is valid, and Certificate Service Provider. The last one is the name of the software (or of the device driver) that manages the private key of the certificate. It helps you understand where the key is:

(The abbreviations are CSP, Cryptographic Service Provider, for the classic providers, and KSP, Key Storage Provider, for the newer ones. You do not have to choose them: DOCX Signer uses the provider of the certificate.) If the private key is not available on this computer, the line The private key is not available is added.

Long-term validation data

At the bottom of the window, Revocation data of the XAdES-LT signatures chooses what proof of validity is saved inside those signatures (see section 7.3):

• OCSP responses (CRL only when OCSP is not available) — the default and the best choice for most users.
• CRLs, CRLs and OCSP responses, or No revocation data (only the certificates).
• Maximum size of a CRL (default 1024 kilobytes) limits how large a revocation list may be to be included.

The button Create a self-signed Certificate... at the bottom left is explained in section 11.

7. Electronic signature laws and signature formats

DOCX Signer creates the digital signatures of Microsoft Office: an XML signature stored inside the document, with the XAdES properties (XAdES 1.3.2) that Office 2010 and later write and read. This section explains what gives such a signature its value, and which format to choose.

7.1 Electronic signature laws

In the United States, the ESIGN Act and the Uniform Electronic Transactions Act (UETA), adopted by most states, give electronic signatures the same legal effect as handwritten signatures: a contract cannot be denied legal effect only because it was signed electronically. Many countries in Asia have laws dedicated to certificate-based digital signatures, for example India (Information Technology Act, Digital Signature Certificates issued by licensed certification authorities), Singapore (Electronic Transactions Act), Malaysia (Digital Signature Act), Japan (Act on Electronic Signatures and Certification Business) and Hong Kong (Electronic Transactions Ordinance).

A digital signature created with an X.509 certificate goes further than a typed name or a scanned image: it identifies the signer through his certificate and proves that the document was not changed after signing, which makes it strong evidence in case of a dispute.

7.2 What gives a signature its value

The value of a signature is given by the certificate and by the device that holds its private key, not by the software. DOCX Signer works with all the kinds of certificates:

7.3 Signature formats

The format decides how much information is stored inside the signature. If you are not sure, keep the first one.

The letters come from the XAdES standard: Basic, Time-stamp and Long Term. The archival level (LTA) of the XML and PDF signatures is not used in Office documents.

7.4 Checking the signatures

Office documents are checked in the programs that open them: Word, Excel and PowerPoint show who signed, when, and whether the document was changed, and they check the trust of the certificate (section 15). DOCX Signer has its own Verify Signatures window for a quick check on your computer.

8. Visible signature and signer details

Click Visible Signature and Signer Details... in the main window (or Tools → Visible Signature and Signer Details...). The window has two parts: the information about the signer, which is part of every signature, and the visible signature of the Word documents.

Signer details

These values are signed: they become part of the signature and nobody can change them later without invalidating it. Office shows them in the details of the signature (section 15). They are optional.

Visible signature (Word documents)

Tick Add a visible signature to sign a signature line: the box with an X, a line and the name of the signer that Word shows in the document. When the signature is valid, Word draws the signature on the line; if the document is changed later, the line shows Invalid signature.

9. Several signers

A document can be signed by several people: every new signature is added to the document and the existing ones remain valid. For visible signatures, prepare the document first, with one signature line for each signer, and then send it to the signers.

1. Open the preparation window. Click Tools → Prepare a Document for Several Signers....
2. Choose the Word document and the file where the prepared document is saved (Save as; by default the same file).
3. Type the signers, one per row: the name (required), the title, the e-mail address and, if you want, instructions for the signer. The lines are added at the end of the document, in this order, with the chosen Alignment.
4. Click Add Signature Lines. The window shows the signature lines of the document.
5. Each signer signs his own line. With DOCX Signer, tick Add a visible signature and keep First unsigned line... or choose An existing signature line only (section 8): the first line that is not signed yet is signed. The signer can also sign in Word, by double-clicking his line.

10. Time stamp settings

A time stamp is issued by a Time Stamp Authority (TSA), an independent service. It proves that your signature existed at a given moment and cannot be back-dated. It is used by XAdES-T and XAdES-LT. Open it with Time Stamp Settings....

11. Creating a test certificate

If you do not have a certificate yet and only want to try the program, DOCX Signer can create a self-signed one. Open Tools → Create a self-signed Digital Certificate... (or the button in the certificate window).

1. Choose where to save it: On Microsoft Certificate Store or On a password protected PKCS#12 PFX file (you will be asked for the file name and a password).
2. Type Issued to (your name, required) and, if you wish, the organization, unit, title, e-mail address and country code.
3. Choose the Validity period (default 3 years), the RSA Key Algorithm length (default 2048 bits) and the Signature Algorithm (default SHA256WithRSA). The defaults are fine.
4. Keep Set as current digital certificate ticked to use it right away, then click OK.

12. Signing a whole folder

To sign many documents at once, select A folder with Office documents.

1. Under Source choose the folder with your documents. The Word, Excel and PowerPoint documents of the folder are signed (.docx, .docm, .xlsx, .xlsm, .pptx, .pptm); the other files and the temporary files of Office (~$...) are skipped.
2. Under Destination choose another folder. Each document is signed and saved with the same name in the destination folder. The source and the destination must be different folders.
3. Click Apply Digital Signature. When it finishes you see how many documents were signed.

13. Saving your settings

The program remembers your choices (certificate, format, hash algorithm, visible signature, time stamp server...) the next time you start it. You can also keep several sets of settings in files — for example one for contracts and one for reports:

• File → Save Configuration As... saves the current settings in a file you name.
• File → Load Configuration... loads them again.
• Tools → Restore Defaults returns everything to the original values.

A saved configuration file is also what the command line uses to sign documents automatically.

14. Batch signatures (automatically made without user intervention)

DOCX Signer can also sign without showing its window, for example from a scheduled task, from a script or from another program. Nobody has to click anything: the program reads the settings from a configuration file, signs, and closes.

By default, DOCX Signer is installed in the folder C:\Program Files (x86)\Secure Soft\DOCX Signer (on a 32-bit Windows: C:\Program Files\Secure Soft\DOCX Signer) and the program is DOCX Signer.exe.

Command line parameters

"DOCX Signer.exe" <source file> <destination file | destination folder> [<configuration file>]
"DOCX Signer.exe" <source folder> <destination folder> [<configuration file>]
"DOCX Signer.exe" <Office document | folder>      (opens the window with the file or folder selected)
"DOCX Signer.exe" /?                               (shows this help)

• source folder: all the Office documents (docx, xlsx, pptx and their macro-enabled versions) of the folder are signed, with the same names, in the destination folder.
• configuration file: a file saved with File → Save Configuration As.... When it is not given, the current configuration of the window is used.
• Do not end a path written between quotes with a backslash: write "C:\Folder", not "C:\Folder\". Windows would read the last backslash and quote as one character and the arguments would be mixed up.

Sign one file

To automatically sign a file, use a command like this one:

c:\Program Files (x86)\Secure Soft\DOCX Signer>"DOCX Signer.exe" c:\Contract.docx "c:\Contract[signed].docx"

Sign a folder

To automatically sign all the documents of a folder:

c:\Program Files (x86)\Secure Soft\DOCX Signer>"DOCX Signer.exe" c:\InputFolder c:\OutputFolder

Custom configuration

In some cases you need a different signature configuration (for example a different certificate, a visible signature or a time stamp) for different files or folders. To save a specific configuration, open the window, set everything you want, and go to File → Save Configuration As... Save the configuration in a file. Later you can use that file in batch mode to apply a different signature configuration on the signed files.

To automatically sign a folder using a custom configuration:

"DOCX Signer.exe" c:\InputFolder c:\OutputFolder c:\config-client2.xml

The configuration file is an XML file that you can also edit with a text editor. The values of the visible signature and of the signer details are:

A value that is not valid is not replaced silently in batch mode: nothing is signed, the result code is 2 and the message lists the wrong values. The passwords and the PIN are saved encrypted, so set them in the window.

Result codes

DOCX Signer is a Windows application, so the command prompt does not wait for it. To wait and read the result code:

cmd:         start "" /wait "DOCX Signer.exe" C:\Demo\Contracts C:\Demo\Signed C:\Demo\contracts.config
             echo %errorlevel%

PowerShell:  (Start-Process "DOCX Signer.exe" -ArgumentList '"C:\Demo\Contracts" "C:\Demo\Signed" "C:\Demo\contracts.config"' -Wait -PassThru).ExitCode

Log files

Every signed file is recorded in log.txt, and every error in errorlog.txt. Both are in your user profile, in the folder %APPDATA%\Secure Soft\DOCX Signer\<version> (the last part is a folder named after the version of the program). The error messages are also written in the command window.

15. Checking the signatures

The Verify Signatures window

Click Verify Signatures... in the main window (or Tools → Verify Signatures...). When a single document is selected, its signed copy (or the document itself) is opened automatically; otherwise choose a document with ....

Select a signature to see its details below the list: the certificate, the issuer, the algorithm, the level (XAdES-B, -T or -LT), the commitment type and the role. View Certificate... opens the Windows certificate window. The bottom line shows how many signature lines the document has and how many are not signed yet.

In Word, Excel and PowerPoint

Open the signed document. Office shows a Signatures message bar and opens the document as Marked as final. Click View Signatures... (or File → Info → View Signatures) to open the Signatures pane; double-click a signature, or choose Signature Details, to see the signer, the time, the purpose and the commitment type.

16. The Signature Library behind DOCX Signer

DOCX Signer is an application built on the Signature Library (SignLib), a library for .NET that creates and verifies digital signatures: PDF (PAdES), CAdES / PKCS#7, XML (XAdES), ASiC, Office and more. Everything DOCX Signer does is available to your own programs and scripts through the library:

• Library page: https://www.signfiles.com/signature-library/
• Download (library, samples and PowerShell scripts): https://www.signfiles.com/sdk/SignatureLibrary.zip
• Code samples: https://www.signfiles.com/code-samples/

The library works with Windows PowerShell, C#, VB.NET and ASP.NET, on .NET Framework 4.6.2 and on .NET 8 and .NET 9, and it supports certificates from PFX files, from the Windows store and from smart cards, USB tokens and HSMs.

From the window to the code

Office signatures are created with the class SignLib.OfficeSignature. The table shows what each setting of DOCX Signer is in the library.

The library can do more than the window: an explicit signature policy, signing documents kept in memory or in streams, and signing with an external device through your own code. They are shown in section 18.

17. Digitally sign Office files using Windows PowerShell

The main functions of DOCX Signer are available in the SignLib library, which you can download from this link: https://www.signfiles.com/sdk/SignatureLibrary.zip

To digitally sign an Office file using Windows PowerShell, download the library above and inspect the Signature Library\PowerShell Scripts folder. The scripts below sign a document and list its signatures.

The signing script

Save it as signOfficeDocument.ps1, in the same folder with SignLib.dll. It creates a test PFX certificate on the fly, signs the document in the XAdES-B format (SHA256) with a visible signature line, and verifies the result. For an Excel or PowerPoint document the signature is invisible; to sign a Word document without a signature line, remove the two lines of SignatureLine.

#digitally sign an Office document (docx, xlsx, pptx) in the XAdES format, using a PFX certificate created on the fly
#the script can be configured to use an existing PFX file or a certificate loaded from Microsoft Store (smart card certificate)

if ($args.Length -eq 0)
{
    echo "Usage: signOfficeDocument.ps1 <unsigned file> <signed file>"
}
else
{
    #SignLib.dll must be on the same folder as the script (or write its full path)
    $DllPath = Join-Path $PSScriptRoot 'SignLib.dll'
    [System.Reflection.Assembly]::LoadFrom($DllPath) | Out-Null

    #create a PFX digital certificate
    $generator = new-object -typeName SignLib.Certificates.X509CertificateGenerator("serial number")
    $pFXFilePassword = "tempP@ssword"
    $generator.Subject = "CN=Your Certificate, E=useremail@email.com, O=Organization"
    $generator.Extensions.AddKeyUsage([SignLib.Certificates.CertificateKeyUsage]::DigitalSignature)
    $generator.Extensions.AddEnhancedKeyUsage([SignLib.Certificates.CertificateEnhancedKeyUsage]::DocumentSigning)

    echo "Create the certificate..."
    $certificate = $generator.GenerateCertificate($pFXFilePassword)

    #digitally sign the document (XAdES-B, SHA256)
    $sign = new-object -typeName SignLib.OfficeSignature("serial number")
    $sign.DigitalSignatureCertificate = [SignLib.Certificates.DigitalCertificate]::LoadCertificate($certificate, $pFXFilePassword)

    #a visible signature: a signature line at the end of a Word document (remove these lines for an invisible signature)
    $sign.SignatureLine = new-object -typeName SignLib.Office.OfficeSignatureLine
    $sign.SignatureLine.SuggestedSignerTitle = "Manager"

    echo "Perform the digital signature..."
    $sign.ApplyDigitalSignature($args[0], $args[1])

    #verify the signature
    echo ("Signatures: " + $sign.GetNumberOfSignatures($args[1]))
    echo ("Valid: " + $sign.VerifyDigitalSignature($args[1]))
}

How to run it

How to run the Windows PowerShell script from the command line:

powershell -executionPolicy bypass -file d:\signOfficeDocument.ps1 d:\test.docx "d:\test[signed].docx"

The result in the window:

Create the certificate...
Perform the digital signature...
Signatures: 1
Valid: True

List the signatures of a document

Save it as verifyOfficeDocument.ps1, in the same folder with SignLib.dll:

#list the signatures of an Office document (docx, xlsx, pptx) and verify them

if ($args.Length -eq 0)
{
    echo "Usage: verifyOfficeDocument.ps1 <signed file>"
}
else
{
    $DllPath = Join-Path $PSScriptRoot 'SignLib.dll'
    [System.Reflection.Assembly]::LoadFrom($DllPath) | Out-Null

    $verifier = new-object -typeName SignLib.OfficeSignature("serial number")

    foreach ($info in $verifier.GetSignatures($args[0]))
    {
        echo ("Signature " + ($info.Index + 1) + ": " + $info.Status + ", signer: " + $info.SignerName + ", visible: " + $info.IsVisible + ", time stamp: " + $info.HasTimestamp)
    }
}

For the contract signed by two people (section 9):

powershell -executionPolicy bypass -file d:\verifyOfficeDocument.ps1 d:\agreement.docx

Signature 1: Success, signer: Elaine Smith, visible: True, time stamp: True
Signature 2: Success, signer: John Miller, visible: True, time stamp: False

18. Digitally sign Office files using C# or VB.NET

The main functions of DOCX Signer are available in the SignLib library (download). To digitally sign a file using C# or VB.NET, download the library, add a reference to SignLib.dll in your project, and inspect the sample projects of the package and the code samples page.

Office documents are signed with the class OfficeSignature (namespace SignLib). It creates the XAdES signatures of Microsoft Office at the levels B, T and LT (section 7.3), invisible or visible, and verifies them. Its properties and methods follow the same rules as the class XadesSignature of the XML signatures.

All the examples below use these namespaces. Every example was run with the library to check the result.

using SignLib;                 // OfficeSignature, HashAlgorithm
using SignLib.Certificates;    // DigitalCertificate
using SignLib.Office;          // OfficeSignatureLine, OfficeSignatureInfo
using SignLib.Xml;             // XadesSignatureStandard, XadesCommitmentType, XadesProductionPlace

18.1 Sign a document and verify the signature

The smallest program: load a certificate from a PFX file, sign, and verify. The signature format is XAdES-B and the hash is SHA256, exactly like the defaults of DOCX Signer. The signature is invisible.

using SignLib;
using SignLib.Certificates;

// "serial number" is the serial number of the library
OfficeSignature signature = new OfficeSignature("serial number");
signature.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate("certificate.pfx", "123456");

// apply the digital signature: the input file is not changed, the signed copy is saved in the output file
signature.ApplyDigitalSignature("contract.docx", "contract-signed.docx");

// verify the signature
OfficeSignature verifier = new OfficeSignature("serial number");
Console.WriteLine("Signatures: " + verifier.GetNumberOfSignatures("contract-signed.docx"));
Console.WriteLine("Valid: " + verifier.VerifyDigitalSignature("contract-signed.docx"));
Console.WriteLine("Signer: " + verifier.GetDigitalSignatureCertificate("contract-signed.docx").Subject);
Console.WriteLine("Algorithm: " + verifier.GetSignatureAlgorithm("contract-signed.docx"));

The result:

Signatures: 1
Valid: True
Signer: CN=Elaine Smith, O=Demo Company, C=US
Algorithm: RSA-SHA256

The same example in VB.NET, with a visible signature:

Imports SignLib
Imports SignLib.Certificates
Imports SignLib.Office
Imports SignLib.Xml

Module Module1
    Sub Main()
        Dim signature As New OfficeSignature("serial number")
        signature.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate("certificate.pfx", "123456")
        signature.SignatureStandard = XadesSignatureStandard.XadesB
        signature.HashAlgorithm = HashAlgorithm.SHA256

        'a visible signature: a signature line at the end of the Word document
        signature.SignatureLine = New OfficeSignatureLine()
        signature.SignatureLine.SuggestedSignerTitle = "Chief Executive Officer"

        'apply the digital signature
        signature.ApplyDigitalSignature("contract.docx", "contract-signed.docx")

        Dim verifier As New OfficeSignature("serial number")
        Console.WriteLine("Signatures: " & verifier.GetNumberOfSignatures("contract-signed.docx"))
        Console.WriteLine("Valid: " & verifier.VerifyDigitalSignature("contract-signed.docx"))
    End Sub
End Module

18.2 Signature levels, time stamp and long-term validation

The level of the signature is chosen with SignatureStandard. The levels that contain a time stamp (XadesT, XadesLT) need the address of a time stamp server (section 10). As for the XML signatures, a XadesB signature also gets a time stamp when TimeStamping.ServerUrl is set.

OfficeSignature signature = new OfficeSignature("serial number");
signature.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate("certificate.pfx", "123456");

signature.HashAlgorithm = HashAlgorithm.SHA384;                        // SHA256 (default), SHA384 or SHA512
signature.SignatureStandard = XadesSignatureStandard.XadesLT;          // XadesB, XadesT or XadesLT
signature.TimeStamping.ServerUrl = new Uri("https://ca.signfiles.com/TSAServer.aspx");
signature.LtvLevel = XadesLtvLevel.IncludeOcspOnly;                    // the revocation data saved in the LT signatures

signature.ApplyDigitalSignature("contract.docx", "contract-lt.docx");

If the time stamp server asks for authentication, or you want to set other options of the request, use the other properties of TimeStamping:

signature.TimeStamping.UserName = "user";                  // only if the server requires authentication
signature.TimeStamping.Password = "password";
signature.TimeStamping.UseNonce = true;                    // a random number that protects the request
signature.TimeStamping.HashAlgorithm = HashAlgorithm.SHA256;
signature.MaxCrlSize = 2 * 1024 * 1024;                    // the largest CRL that is included, in bytes (default: 1 MB)

18.3 A certificate from the Windows store or a smart card

When the certificate is in the Windows store (for instance, a smart card certificate, section 6.2), load it with a search criterion. No window is shown, so the code can run without a user. RSA and ECDSA certificates are both supported.

OfficeSignature signature = new OfficeSignature("serial number");

// the first certificate of the current user whose common name (CN) is "Elaine Smith"
// true = only the valid certificates (issued by a trusted authority); false = any certificate, also a self-signed test one
signature.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(true, DigitalCertificateSearchCriteria.CommonNameCN, "Elaine Smith");

// the PIN of the smart card, to avoid the PIN window. It applies to the next signature, made on this thread
DigitalCertificate.SmartCardPin = "1234";

signature.ApplyDigitalSignature("contract.docx", "contract-signed.docx");

Other search criteria are the other fields of the subject (OrganizationO, EmailE...), the thumbprint and the serial number of the certificate. To let the user choose the certificate in a Windows window, call DigitalCertificate.LoadCertificate() without parameters.

A signing device that is not in the Windows store (an HSM, a remote signing service, a PKCS#11 token) can be used through your own class that implements SignLib.Certificates.IExternalSignature: set DigitalCertificate.UseExternalSignatureProvider before ApplyDigitalSignature, and give the public certificate in DigitalSignatureCertificate.

18.4 A visible signature

Set SignatureLine to sign a signature line of a Word document (section 8). Without it, the signature is invisible.

OfficeSignature signature = new OfficeSignature("serial number");
signature.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate("certificate.pfx", "123456");

signature.SignatureLine = new OfficeSignatureLine
{
    Placement = OfficeSignatureLinePlacement.UseExistingOrAddNew,   // the first unsigned line, or a new one at the end
    SuggestedSigner = "Elaine Smith",                                // the name under the line
    SuggestedSignerTitle = "Chief Executive Officer",
    SuggestedSignerEmail = "elaine.smith@example.com",
    SignatureImage = File.ReadAllBytes("signature.png"),             // the handwritten signature (optional)
    ShowSignDate = true,
    Alignment = OfficeSignatureLineAlignment.Right
};

signature.ApplyDigitalSignature("contract.docx", "contract-visible.docx");

The other values of Placement are UseExisting (an existing unsigned line only; set SetupId to choose a specific line) and AddNew (always a new line). SignatureText replaces the name written on the line; Width and Height set the size of a new line, in points (default 192 x 96).

18.5 Several signers

Prepare the document with one signature line for each signer, before the first signature; then each signer signs the first line that is not signed yet. The index of the signatures starts at 0.

// 1. prepare the document: one signature line for each signer, BEFORE the first signature
OfficeSignature document = new OfficeSignature("serial number");
document.AddSignatureLine("contract.docx", "agreement.docx", new OfficeSignatureLine { SuggestedSigner = "Elaine Smith", SuggestedSignerTitle = "Chief Executive Officer" });
document.AddSignatureLine("agreement.docx", "agreement.docx", new OfficeSignatureLine { SuggestedSigner = "John Miller", SuggestedSignerTitle = "Chief Financial Officer" });

// 2. each signer signs the first signature line that is not signed yet
OfficeSignature first = new OfficeSignature("serial number");
first.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate("manager.pfx", "123456");
first.SignatureLine = new OfficeSignatureLine { Placement = OfficeSignatureLinePlacement.UseExisting };
first.ApplyDigitalSignature("agreement.docx", "agreement.docx");          // the output can be the input file

OfficeSignature second = new OfficeSignature("serial number");
second.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate("accountant.pfx", "123456");
second.SignatureLine = new OfficeSignatureLine { Placement = OfficeSignatureLinePlacement.UseExisting };
second.ApplyDigitalSignature("agreement.docx", "agreement.docx");

// 3. check the signatures and the signature lines
OfficeSignature verifier = new OfficeSignature("serial number");
int count = verifier.GetNumberOfSignatures("agreement.docx");
for (int i = 0; i < count; i++)
    Console.WriteLine("Signature " + (i + 1) + ": " + verifier.VerifyDigitalSignature("agreement.docx", i) + ", signer: "
        + verifier.GetDigitalSignatureCertificate("agreement.docx", i).GetNameInfo(X509NameType.SimpleName, false));

foreach (OfficeSignatureLineInfo line in verifier.GetSignatureLines("agreement.docx"))
    Console.WriteLine(line);

The result:

Signature 1: True, signer: Elaine Smith
Signature 2: True, signer: John Miller
Elaine Smith, Chief Executive Officer - signed
John Miller, Chief Financial Officer - signed

(X509NameType is in the namespace System.Security.Cryptography.X509Certificates.) An invisible signature needs no preparation: sign the signed file again without SignatureLine. AddSignatureLine on a document that is already signed throws an InvalidOperationException, because the new line would invalidate the existing signatures.

18.6 Signer details and signature policy

// the commitment declared by the signer, shown by Office as "Commitment type"
signature.CommitmentType = XadesCommitmentType.ProofOfApproval;

// the purpose for signing the document and the role of the signer
signature.SignatureComments = "Approval of the service agreement";
signature.SignerRole = "Chief Executive Officer";

// the place where the signature was created
signature.SignatureProductionPlace = new XadesProductionPlace { City = "New York", StateOrProvince = "NY", PostalCode = "10001", CountryName = "United States" };

// an explicit signature policy (by default the policy is implied, as for the signatures of Office):
// identifier (OID or URI), digest of the policy document, the algorithm of the digest, the address of the policy
signature.SetSignaturePolicyInformation("2.16.724.1.3.1.1.2.1.9", policyHash, "SHA256", "https://example.com/policy.pdf");

18.7 Read the signatures of a document

GetSignatures verifies every signature and returns its details: the same information as the Verify Signatures window.

OfficeSignature verifier = new OfficeSignature("serial number");

foreach (OfficeSignatureInfo info in verifier.GetSignatures("agreement.docx"))
{
    Console.WriteLine("Signature " + (info.Index + 1) + ": " + info.Status);
    Console.WriteLine("  Signer:       " + info.SignerName);
    Console.WriteLine("  Signing time: " + info.SigningTime.Value.ToLocalTime());          // the times are in UTC
    Console.WriteLine("  Time stamp:   " + (info.HasTimestamp ? info.TimestampTime.Value.ToLocalTime().ToString() : "no"));
    Console.WriteLine("  Visible:      " + info.IsVisible);
    Console.WriteLine("  Algorithm:    " + info.SignatureAlgorithm);
}

The result:

Signature 1: Success
  Signer:       Elaine Smith
  Signing time: 10/1/2026 11:31:48 PM
  Time stamp:   no
  Visible:      True
  Algorithm:    RSA-SHA256
Signature 2: Success
  Signer:       John Miller
  ...

Status is Success for a valid signature, ContentModified when the document was changed after it was signed, ReferenceNotFound when a signed part of the document is missing, and InvalidSignature otherwise. The other properties are Certificate, HasValidationData (XAdES-LT), SignatureComments, CommitmentType, SignerRole and SetupId (the signature line).

A changed document

If the document is modified after the signature, the verification returns False. For example, after the price of the contract is edited from 12,500.00 to 92,500.00:

Console.WriteLine("Valid: " + verifier.VerifyDigitalSignature("agreement-changed.docx"));
Console.WriteLine("Status: " + verifier.GetSignatures("agreement-changed.docx")[0].Status);
// Valid: False
// Status: ContentModified

The library checks that the document was not changed. To check the certificate itself (expired, revoked), use DigitalCertificate.VerifyDigitalCertificate, or open the document in Office, which also checks the trust of the certificate.

18.8 Excel, PowerPoint, streams and byte arrays

OfficeSignature signature = new OfficeSignature("serial number");
signature.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate("certificate.pfx", "123456");

// Excel and PowerPoint documents are signed in the same way (invisible signatures)
signature.ApplyDigitalSignature("budget.xlsx", "budget-signed.xlsx");
signature.ApplyDigitalSignature("presentation.pptx", "presentation-signed.pptx");

// a document in memory (for example from a database or a web request)
byte[] signed = signature.ApplyDigitalSignature(File.ReadAllBytes("contract.docx"));

using (MemoryStream stream = new MemoryStream(signed))
    Console.WriteLine("Valid: " + new OfficeSignature("serial number").VerifyDigitalSignature(stream));

ApplyDigitalSignature(Stream) signs a document in place, in a readable, writable and seekable stream. Every method that reads a file has a version with a Stream.

18.9 How the signature looks

An Office document is a ZIP package. The signature is added as a new part, _xmlsignatures/sig1.xml (sig2.xml for the second signer...), and a signature line adds its image, word/media/signatureline1.emf. The values below are shortened.

<Signature Id="idPackageSignature" xmlns="http://www.w3.org/2000/09/xmldsig#">
  <SignedInfo>
    <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
    <Reference URI="#idPackageObject" ...>      <!-- the signed parts of the document -->
    <Reference URI="#idOfficeObject" ...>       <!-- the Office information: signature line, purpose -->
    <Reference URI="#idSignedProperties" ...>   <!-- the XAdES properties -->
    <Reference URI="#idValidSigLnImg" ...>      <!-- the images of the signed line, valid and invalid -->
    <Reference URI="#idInvalidSigLnImg" ...>
  </SignedInfo>
  <SignatureValue>vMvzpuO0BHkd...</SignatureValue>
  <KeyInfo><X509Data><X509Certificate>MIIDCjCCAfKg...</X509Certificate></X509Data></KeyInfo>
  <Object Id="idPackageObject">
    <Manifest>
      <Reference URI="/word/document.xml?ContentType=application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml">
        <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
        <DigestValue>IAGLE3St0Vxj...</DigestValue>
      </Reference>
      ...                                          <!-- the styles, the images, the relationships... -->
    </Manifest>
    <SignatureProperties> ... <mdssi:Value>2026-10-01T20:31:48Z</mdssi:Value> ... </SignatureProperties>
  </Object>
  <Object Id="idOfficeObject"> ... <SignatureInfoV1> <SetupID>{...}</SetupID> ... </SignatureInfoV1> ... </Object>
  <Object>
    <xd:QualifyingProperties Target="#idPackageSignature" xmlns:xd="http://uri.etsi.org/01903/v1.3.2#">
      <xd:SignedProperties Id="idSignedProperties">
        <xd:SignedSignatureProperties>
          <xd:SigningTime>2026-10-01T20:31:48Z</xd:SigningTime>
          <xd:SigningCertificate> ... </xd:SigningCertificate>
          <xd:SignaturePolicyIdentifier><xd:SignaturePolicyImplied /></xd:SignaturePolicyIdentifier>
        </xd:SignedSignatureProperties>
      </xd:SignedProperties>
    </xd:QualifyingProperties>
  </Object>
  <Object Id="idValidSigLnImg">AQAAAGwAAAAA...</Object>
  <Object Id="idInvalidSigLnImg">AQAAAGwAAAAA...</Object>
</Signature>

A time stamp (XAdES-T and XAdES-LT) and the validation data (XAdES-LT) are added as unsigned properties of the signature, after SignedProperties.

18.10 Good to know

19. Problems and solutions

20. Glossary

21. Warning and disclaimer, trademarks

Every effort has been made to make this manual as complete and accurate as possible, but no warranty or fitness is implied. The information provided is on an “as is” basis. The author shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this manual.

.NET, Windows, PowerShell, SmartScreen, Microsoft Office, Word, Excel, PowerPoint and Visual Studio are trademarks of Microsoft Corporation. All other trademarks are the property of their respective owners.