Digital signatures · Published
B-B, B-T, B-LT, B-LTA: which PAdES level do you need?
The four levels of a PAdES signature in plain language: what each one adds, and when it is enough for an agreement, an invoice, or a document someone must still be able to verify in ten years.
PAdES is the European format for digital signatures inside a PDF. The standard that defines it, ETSI EN 319 142-1, sets out four levels: B-B, B-T, B-LT and B-LTA. They are not degrees of “more legal”. Each one adds something that keeps the signature verifiable for longer.
The level also doesn’t decide whether a signature is advanced or qualified — that depends on the certificate and where its key lives, and it is what the legal levels describe. The PAdES level answers a different question: for how long, and with what evidence, can this signature still be checked?
B-B: the basic signature
The cryptographic signature made with your certificate, and nothing more. It proves who signed and that the document hasn’t changed since.
What it doesn’t prove is when. The time it carries comes from the signer’s own computer clock, which the signer controls. If someone later disputes that the document existed on a given date, a B-B signature can’t settle it.
B-T: adding a trusted timestamp
B-T adds a timestamp issued by a third party, a timestamping authority. The standard describes it as a trusted token proving that the signature existed at a specific date and time.
That matters more than it sounds. If your certificate expires or is revoked later, the timestamp shows you signed before that, while it was still valid. There is a whole article on this: why your signature needs a third party’s clock.
B-LT: the signature carries its own evidence
To check a signature you need to know whether the certificate was revoked when it was used. The issuer answers that question online (via OCSP or revocation lists), and one day it will stop answering for old certificates.
B-LT embeds that information in the PDF: the certificate chain and the revocation responses. The document stays verifiable even when the issuer no longer answers for that certificate.
B-LTA: ready for the archive
B-LTA adds timestamps over everything above, validation material included. It is for when the problem is no longer the certificate but time itself: algorithms that weaken, validation data that expires. The standard describes it as an appropriate technique for preserving signed data over the long term.
Which one you need
| Case | Sensible level | Why |
|---|---|---|
| An agreement between two people, an accepted quote, a consent form | B-T | Proves who signed, that nothing changed, and when — which is what almost every dispute is about |
| An invoice, or anything you must keep for several years | B-LT | The certificate will expire before the retention period ends; with revocation data inside, the signature can still be checked |
| Anything that must be verifiable in ten years or more: deeds, case files, archives | B-LTA | Also protects against ageing algorithms and expiring validation data |
Plain B-B is rarely a good idea for a document anyone might dispute: it lacks a time that doesn’t depend on you.
Two caveats. A level can be extended later: a B-T signature can become B-LT or B-LTA by adding the material in an incremental update of the PDF, as long as the revocation information can still be obtained — so sooner is better. And the standard asks whoever sends a signed document to use at least a level that lets the recipient trust the signature at the time of the exchange.
What PDFsigna does
The Free plan signs in PAdES B-T, with a qualified timestamp from the public timestamping authority of the ACCV, a Spanish qualified trust service provider. Offline, you can still sign, without a timestamp, and the app tells you so. And any signed PDF you open shows, in its validation card, which PAdES profile it was signed with.
This article is general information, not professional advice. Laws, prices and how software works change over time: before you decide, check the official, up-to-date documentation from each authority or vendor.