TrackMy Sign is a free, open-source desktop app for Windows, macOS and Linux that signs PDFs and other files
with your USB DSC token. These are its 30 features in five groups, with what each one checks, writes
and leaves alone.
01 · Signing
Signing
TrackMy Sign writes a standard PKCS#7 detached signature (adbe.pkcs7.detached, SHA-256) as an incremental update, so the original bytes and any signatures already on the document are left exactly as they were. Adobe Acrobat Reader shows the result as “Signature is valid”. These are the ways to apply it.
Tokens
Every common Indian DSC token
Drivers for the tokens Indian Certifying Authorities ship are found automatically, and certificates from all of them are listed together.
The app talks to your token through PKCS#11, using the driver that came with the token. It looks for the drivers of Hypersecu HyperPKI (tested with the HYP2003), Feitian ePass2003, Watchdata ProxKey, Longmai mToken CryptoID, Trust Key, Watchdata, SafeNet eToken, Gemalto IDPrime and Bit4id, loads every one that is installed, and falls back to OpenSC when nothing else is found. Settings shows which drivers were found.
The private key never leaves the token: the app sends it a 32-byte SHA-256 hash and gets the signature back. Tokens whose key asks for the PIN on every signature work too, with the PIN entered once, and the PIN dialog warns when few attempts are left. A driver in an unusual place can be added with the TRACKMYSIGN_PKCS11_MODULE environment variable.
Windows, macOS and Linux driver paths searched
OpenSC as a last resort; p11-kit proxy on Linux
PIN never stored, never written to disk
Signing always uses the driver the certificate came from
Batch
Many PDFs, one PIN
Select a stack of PDFs, place the box once and sign them all in one session. A file that fails never stops the rest.
Add as many PDFs as you need, place the signature box once and press Sign: every file is signed in one token session with one PIN entry. Each result is reported separately, so a damaged or protected file is listed with the reason while the others are signed.
Every signed copy is saved as name_signed.pdf next to its original, or in a folder you choose. An existing file is never replaced; the copy becomes name_signed_2.pdf instead. On the command line, trackmysign sign a.pdf b.pdf c.pdf does the same.
Also for keys that ask for the PIN on every signature
Add files from the window, Explorer, Finder or a file manager
Command line: trackmysign sign *.pdf
Pages
Every page, one signature
Show the signature box on all pages or a range such as 1-3, 5. It is still one signature and one PIN entry.
Some offices want the signature visible on every page of a resolution or an agreement. Choose All pages or type a range under Placement → Pages and the box appears on each selected page, in the same position.
It remains a single signature over the whole document, so the token signs once and Adobe Reader lists one signature, with a widget on each page.
Ranges: 1-3,5 or all
One signature field, several widgets
Command line: --pages all or --pages 1-3,5
Forms
Sign into existing boxes
Bank and government PDFs often carry empty signature fields. Click one and the signature fills it, honouring its locks.
Forms from banks, registrars and government offices often come with empty signature fields already placed by the author. TrackMy Sign highlights them on the page and lists them in the side panel; click one and the signature fills exactly that field instead of a box you drew.
If the field says which other fields to lock after signing, the lock is recorded in the signature as the form's author intended. A field that demands a signature format the app cannot produce is refused with an explanation instead of producing a signature Adobe would reject.
Fields named and listed in the side panel
Field locks (FieldMDP) honoured
Command line: trackmysign info lists fields, sign --field NAME
Certify
Lock the document
Make the first signature a certification that says what may change afterwards.
A certification signature is the author's signature. It is applied first and records what later users may do: nothing at all, fill in forms and sign, or also add comments. Adobe Reader shows a blue certification bar and flags anything that breaks these rules.
Only an unsigned document can be certified, and a document certified with “no changes” cannot be signed again, which is what you want for a final version. In the app this is Signature type → Certify in the side panel.
DocMDP levels 1, 2 and 3
Shown in Adobe Reader as a certified document
Command line: --certify none|forms|annotations
Long-term
Valid after the DSC expires
Optional trusted timestamp and embedded revocation data, so the signature can still be checked years later.
A DSC is valid for one to three years. If the signature also carries a trusted timestamp and the certificate authority's revocation answers from the time of signing, a validator can confirm it was valid when it was made, long after the certificate has expired.
Both are optional and off by default, so signing works with the network cable unplugged. When switched on, only a hash of the signature goes to the timestamp server, and if a server cannot be reached nothing is saved and you can sign again without it.
Default timestamp server: timestamp.digicert.com, or your own
What the signature looks like on the page, how to prepare a document before signing it, and how to sign files that are not PDFs at all.
Designer
Design your signature box
Company seal or logo, “For Company — Director” lines, fonts, colours, border and date format, with a preview that matches the PDF exactly.
Appearance → Design… sets the layout: text only, signature image left of or above the text, or the image alone. A company seal or logo (PNG with transparency, or JPEG) goes right of the text or behind it at an opacity you choose.
Text lines can be switched on and off and put in any order: Digitally signed by, your name, For the organisation (from the certificate or typed), a role such as Director or Authorised Signatory, the date, reason, location and two lines of your own. The preview is drawn from the same layout the PDF is written from, so what you see is what is signed. Hindi and Tamil typed into a line are transliterated into English letters for the standard PDF fonts.
Layouts: text only, image left, image above, image only
Date: 2026.10.24 14:05:09 +05:30, 24-10-2026 14:05 IST, 24 Oct 2026
Border, background, padding, colour, alignment
Command line: --style style.json --seal seal.png
Stamp
Handwritten signature image
Add a scanned signature beside or above the “Digitally signed by” text.
Many people want their handwritten signature on the page as well as the digital one. Pick a scan of it and it is drawn inside the signature box, to the left of the text or above it. A PNG with a transparent background looks best on coloured letterheads.
If you do not want anything on the page at all, sign invisibly: the signature is still in the document and shown in Adobe Reader's signature panel.
Save the reason, location, box position, pages and design once, and pick them per document.
A board resolution, a bank form and an invoice each need the signature in a different place with a different reason. Save each combination as a preset and pick it from the side panel; the box moves to the saved position, given in millimetres from the top-left of the page.
Presets carry the signature image and the box design too, and the watch folder signs with a copy of the preset you choose.
Position remembered between sessions
Placement in millimetres
Command line: --preset-json for the watch command
Prepare
Page tools
Merge PDFs, reorder, rotate, delete or insert pages, and save a prepared copy ready to sign. The original is never changed.
Pages in the toolbar shows the document as thumbnails. Drag them into order, turn them left or right, delete them, insert a blank page the size of the page before it, append other PDFs with Add PDF… and undo any step. Save as… writes a new PDF, name_prepared.pdf by default, which then opens ready to sign.
Contents, fonts, images, links, comments and form fields are copied; page sizes and rotation stay as they were. Existing signatures cannot survive changes to the pages, so the app warns and asks again when a source is already signed: use the page tools to prepare a document, not to edit a signed one.
Same-named form fields renamed (company → company_2)
Opens RC4 and AES encrypted PDFs. The signed copy keeps the same password and restrictions.
Statements and forms are often encrypted. Most only restrict editing and open without asking; if a PDF needs a password, the app asks for it and keeps it only while the document is open.
The signed copy is encrypted with the same password and keeps the same restrictions. If the document's security settings do not allow signing, give its owner (permissions) password instead.
Security handler revisions 2–6
Command line: --password
Signed copy keeps the original's encryption
Files
Sign any file (.p7s / .p7m)
Sign Word, Excel, ZIP or XML files as a standard CMS signature, and check signatures you receive.
Sign other files… (or dropping a file that is not a PDF) shows the file panel: each file with its size, SHA-256 and any .p7s already next to it, checked. Choose a separate signature file (bid.docx.p7s, the original stays as it is) or the file inside the signature (bid.docx.p7m), optionally with a timestamp, and sign them all with one PIN.
The format is CMS / PKCS#7 (RFC 5652), DER, SHA-256, with signingCertificateV2 and the certificate chain, the same signature the app puts into a PDF. A .p7s or .p7m you receive is checked the same way, and Save original… extracts the file from a .p7m. Check what the receiving office expects before relying on one format.
RSA or ECDSA, as the key is
Reads DER, PEM, Base64 and BER signatures
Command line: sign-file, verify-file --extract
03 · Verification & records
Verification & records
Signature checks that do not need Adobe, reports an auditor can file, and a private record of everything signed on your computer.
Verify
Check any signed PDF
See who signed, whether each signature is valid, whether the chain reaches CCA India, and what changed after signing.
The Signatures panel lists every signature in the open PDF, in signing order, with the signer, issuer, signing time, reason and location. For each one it checks that the signed bytes are intact, that the signature matches the signer's certificate, whether the chain reaches the CCA India 2022 root, and what later revisions changed: nothing, more signatures, form filling or comments, or the content itself.
Revocation (CRL and OCSP) and timestamp tokens are not checked, even when the PDF contains them, and the app says so instead of implying otherwise.
Statuses: valid, invalid, unknown
Certification level and allowed changes shown
Command line: trackmysign verify file.pdf
Audit
Verification report
Export a PDF report of every signature in a document for auditors, or JSON from the command line.
Export report… in the Signatures panel saves a plain A4 PDF: the file name, its SHA-256, page count, the time of the check in IST and UTC and the TrackMy Sign version, a one-line summary such as “3 signatures — all valid, document unchanged since the last signature”, and every signature's status, signer, organisation, issuer, serial, validity, signing time, timestamp, certification level, what changed after it and whether it chains to CCA India.
The footer of every page states what is not checked. Names in Indian scripts are transliterated in the PDF and marked as such; the JSON keeps the original text.
Check every signed PDF in a folder at once, filter the problems, and export one PDF report or a spreadsheet.
Verify folder… checks every PDF in a folder, optionally with its subfolders, and lists each file as it is checked: all valid, invalid signature, changed after signing, unsigned, unreadable, or needs a password. One password typed in the dialog is tried on every protected file and not stored.
Export one PDF report for the folder, with the totals, a table of files and signers and an appendix with every signature's details, or a CSV with one row per signature. The CSV is UTF-8 with a byte order mark so spreadsheets show Indian scripts, and text that starts with = + - or @ is escaped so it is never run as a formula.
Hidden and system files skipped
Totals such as “12 files: 8 all valid, 2 with problems”
A private, tamper-evident log of everything you sign, with search and CSV or PDF export. Can be turned off.
Every signature made on this computer is recorded: single documents, batches, every-page and form-field signatures, certifications, .p7s and .p7m files, the watch folder and GST portal requests, from the app and the command line. History lists them newest first with the document, certificate and outcome; open an entry for both files' SHA-256 hashes, the certificate's issuer, serial and fingerprint, and the options used.
Each entry holds the SHA-256 of the line before it, so Check log integrity names the line where an edit outside the app breaks the chain. It is evidence of edits, not a signature. Keep entries forever, for 1 year or for 90 days, export them as an A4 PDF or CSV, or turn the history off.
Stored in the app's data folder, nowhere else
Retention: forever, 1 year or 90 days
Command line: trackmysign history --since --json --report
Certificate
See and share your DSC
Class, CA, validity, fingerprints and chain at a glance. Save the public certificate for a bank or portal that asks for it.
Certificate details shows the holder, organisation, PAN hash (subject serial number), email, issuing CA, serial number, validity with days left, key type and size, key usage, and the certificate policies with India PKI Class 1, 2, 3 and eKYC named. The chain is shown up to the CCA India root.
Fingerprints can be copied, and the public certificate saved as .cer (DER), .pem, or with its chain as .p7b, for a bank, registrar or portal that asks you to upload it. The private key never leaves the token.
Opens from the certificate picker or Settings → DSC token
Chain up to CCA India
Command line: certs --details, certs --export N
Reminders
DSC expiry reminder
Days left are always shown, with a reminder before your certificate expires, even when the token is not plugged in.
Every certificate list shows the days left. The app reminds you 30 days before the DSC expires (15 or 60 days, or off, under Settings → Expiry reminder), also when the token is not plugged in.
Once a certificate has expired, signing with it is turned off, since a signature made with it would not be valid. The command-line tool refuses one too unless you pass --allow-expired.
Works without the token plugged in
Days left wherever certificates are listed
Command line: certs shows the expiry date and days left
04 · Automation
Automation
For the GST portal, the accounts team's exports, the scanner PC and the scripts around them. Every automatic path still needs your token and PIN.
GST portal
Sign on the GST portal
Turn on portal signing and the GST portal signs DSC registration and returns through TrackMy Sign. Every request asks for your approval and PIN.
The GST portal signs DSC registrations and returns through a program on your computer, which it reaches over a local secure WebSocket. With Settings → GST portal signing turned on, TrackMy Sign answers those requests with the DSC on your token, so no separate signer utility is needed. It creates a certificate authority for this computer only, issues one certificate for 127.0.0.1, deletes the authority's private key and adds its certificate to your user's trusted certificates.
Each request brings the app to the front with the site, the PAN and exactly what will be signed; it picks the certificate for that PAN when the certificate shows it, and nothing is signed without your PIN. It listens only on 127.0.0.1, answers only pages from gst.gov.in, and Disable and remove takes the certificate out again. MCA21 V3, the Income Tax portal and TRACES use a different, licensed protocol and are not supported.
Ports 1585, 2095, 2568, 2868 or 4587
Windows, macOS and Linux (on Linux: Chrome and Firefox certificate lists)
Expired certificates refused
Background
Always ready for the portal
Runs from the tray or menu bar and can start when you sign in, so portal signing works without opening the app.
With Keep running in the background (on by default once portal signing is on), closing the window leaves TrackMy Sign in the system tray on Windows and Linux or the menu bar on macOS. A portal request brings the window up as usual.
Start TrackMy Sign when I sign in starts it there at sign-in, without a window. Turning background mode off removes the sign-in entry again, and the Windows uninstaller removes it too.
Tray menu: Open TrackMy Sign, Quit
GNOME needs the AppIndicator extension (Ubuntu has it)
Settings → Background
Watch
Watch folder
Drop PDFs into a private folder and they are signed with your preset after one PIN entry, with time and daily limits.
For invoices exported by an accounting program or scans from a copier: press Start watching, enter the PIN once, and every PDF put into the folder is signed with a copy of the preset you chose. A file is picked up once it has stopped changing and opens as a PDF; temporary files are left alone.
Signed copies go to signed/ (never overwritten), originals move to done/, and a file that cannot be signed goes to failed/ with a note saying why. Watching stops after the time you chose, when the computer sleeps, on quit, when the token is removed and at the daily limit. Anyone who can write to the folder while watching can get documents signed, so use a private folder on your own computer.
Status bar and tray show Watching — N signed, with Stop
Select one or many PDFs in Explorer, Finder or your file manager and sign them as one batch. Your default PDF viewer stays as it is.
On Windows, right-click a PDF and choose Sign with TrackMy Sign; on every platform, Open With → TrackMy Sign works too. Your default PDF viewer is not changed.
Select several PDFs first and they arrive together as one batch, signed with one PIN entry. If a batch is already loaded, the app asks whether to add them or replace it. Other files go to the file panel to be signed as .p7s or .p7m.
Default PDF viewer untouched
Files arriving together form one batch
Drag and drop onto the window works too
Command line
A command-line tool
Everything the app signs and checks is also a command, for scripts and batch jobs.
The trackmysign command lists certificates (certs), shows a PDF's pages, signatures and empty fields (info), signs (sign, sign-file), checks (verify, verify-folder, verify-file), watches a folder (watch), reads the signing history (history) and prepares pages (pages).
It is a single executable built from the same Rust library as the desktop app, so a signature made from a script is byte-for-byte the same kind of signature. It asks for the PIN on the terminal and never stores it.
Verification and history results come out as JSON or CSV, with exit codes a script can act on.
trackmysign verify --json, verify-folder --json and history --json print documented JSON with a schema name and version, raised only when a field is removed or changes meaning. A script can archive the result next to the document or feed it to another system.
The exit status is 2 when a signature is invalid, the content changed after signing, a PDF could not be read, or the history's integrity check finds a problem, so a nightly job can fail loudly instead of quietly.
schema_version 1 for every report
--require-signed to treat unsigned PDFs as failures
CSV safe for spreadsheets (formula escaping)
05 · Platform & privacy
Platform & privacy
How TrackMy Sign is built, installed, updated and kept private.
Privacy
Offline, no account
Your documents, certificates and PIN never leave your computer. You can sign with the network cable unplugged.
TrackMy Sign has no server and no sign-up. Documents are read and written on your own disk, the token signs on your own computer, and the PIN is passed to the token and forgotten.
The only network requests are the update check against GitHub Releases, which can be turned off, and, when you switch them on, a timestamp request (a hash only) and certificate revocation checks. See the privacy statement for details.
No analytics or tracking of any kind
Update check can be turned off
Privacy statement: PRIVACY.md
Platforms
Windows, macOS and Linux
Native apps for all three, with the same features. Small downloads, no admin rights needed on Windows.
The Windows installer is about 3 MB and installs for your user only, without admin rights. The macOS app is a universal build for Apple Silicon and Intel, signed with a Developer ID and notarized by Apple. On Linux there is an AppImage for any x86_64 distribution and a .deb for Ubuntu 22.04+ and Debian 12+.
On Windows it can also be installed with winget once the package is approved: winget install --id TrackMyTech.TrackMySign.
Linux: glibc 2.35+, needs pcscd and the token's driver
Built with Rust, Tauri 2 and PDF.js
winget id TrackMyTech.TrackMySign
Updates
One-click updates
New versions are offered in the app and install when you say so, after a signature check.
On launch the app fetches latest.json from the latest GitHub release; nothing about you or your documents is sent. If a newer version is out, a bar offers Install and restart: the update is downloaded, checked against the signing key built into the app, installed, and the app reopens.
On Linux the AppImage replaces itself and a .deb install asks for your password. Turn the check off, or check by hand, under Settings → Updates.
Install and restart, nothing silent
AppImage and .deb updated on Linux
Settings → Updates
Languages
English, हिन्दी, தமிழ்
The whole app in Hindi or Tamil, following your system language or chosen in Settings.
Every screen, dialog and message of the desktop app is available in English, Hindi and Tamil. It follows the system language, or choose one under Settings → Appearance → Language.
The text printed in the signature box stays in English letters, because the standard PDF fonts cannot show Indian scripts; names typed in Hindi or Tamil are transliterated, and the designer shows how a line will print.
Settings → Appearance → Language
Indian-script names transliterated in the box
Reports mark transliterated names
Recent
Pick up where you left off
Recent documents on the start screen, the last folder remembered, and an optional folder for signed copies.
The start screen and the arrow next to Open… list the last 10 PDFs you opened, with their folder and date. Files signed in the app are marked and their signed copy opens with one click; files that no longer exist drop out.
Settings → Save signed copies to keeps copies next to the original or in a folder you choose. An existing file is never replaced: the copy becomes name_signed_2.pdf, name_signed_3.pdf, and so on. The recent list can be turned off or cleared.
Settings → Recent files
Settings → Save signed copies to
List kept in the app's data folder
Open source
Open source, built in public
MIT licensed. Every release is built by GitHub Actions from the public source, and tested against an independent validator.
The signing engine is a small Rust library you can read in an afternoon, and the whole app is on GitHub under the MIT licence. Every release is built by GitHub Actions from that source; no binary is built on a personal machine.
The end-to-end tests sign real PDFs on a virtual token and check the results with independent tools, pyHanko and qpdf, so the format is verified by software that is not ours.
Source: github.com/rahuldk1105/trackmysign
Issues and token driver reports welcome
SHA-256 of each download shown on this site
Download
Free for Windows, macOS and Linux.
No account, no telemetry, MIT licence. Your token's own driver is all it needs.