Signing a PDF with a USB token or smart card on a Mac: who actually supports it
In short: A Mac reaches a signing token in one of two ways: through a CryptoTokenKit driver, which makes the token look like part of the keychain, or through the maker's PKCS#11 library, which the app has to load itself. In November 2026, Acrobat documents both. Most other editors document only keychain or file certificates. Better PDF signs through both routes for free, and the PKCS#11 route needs the direct download.
Many people who sign PDFs for work are not allowed to use a certificate stored as a file. Their certificate lives on a USB token or a smart card. That is the rule for Indian Class 3 DSC tokens, many EU qualified certificates, national ID cards and plenty of company smart cards, and the private key never leaves the hardware. On a Mac, this is where PDF apps quietly divide.
We make Better PDF, which signs with tokens, so take this with that in mind. We have kept to what each vendor documents on its own pages, checked on 9 November 2026. Where a vendor does not say, we say that it does not say.
Two ways a Mac talks to a token
CryptoTokenKit. This is macOS’s own framework for smart cards and tokens. If the token’s maker ships a CryptoTokenKit driver, the certificate shows up as if it were in your keychain, and the Mac asks the card to do the signing. Any app that signs with a keychain identity can then use the token without knowing it is one.
PKCS#11. This is an older, cross-platform standard. The maker ships a library file, a .dylib on the Mac, and the signing app has to load that library, find the token, ask for the PIN and send the data to be signed. If the app does not load PKCS#11 modules, the token is invisible to it, however well it works elsewhere.
Plenty of tokens support only the second route on the Mac, or ship a CryptoTokenKit driver that lags behind the PKCS#11 one. Thales documents both routes for its SafeNet Authentication Client on macOS. Belgium’s eID middleware builds both. For the Feitian ePass2003 and Watchdata ProxKey tokens common in India, the Mac drivers we could find are PKCS#11 libraries, and we could not confirm a CryptoTokenKit driver for either.
What the apps document
| App | Certificate signing | Token through the keychain | Loads a PKCS#11 library | PAdES | RFC 3161 time-stamp |
|---|---|---|---|---|---|
| Adobe Acrobat (Mac) | Yes | Yes, CryptoTokenKit setting on by default | Yes, “Attach Module” | CAdES-based format available; default is PKCS#7 | Yes, server must be set up |
| Preview | No, handwritten only | No | No | No | No |
| PDF Expert | No, “basic electronic signature” | No | No | No | No |
| Nitro PDF Pro (Mac) | Yes, from the keychain | Not documented | Not documented | Not documented | Not documented |
| PDFgear (Mac) | Yes | Not documented | Not documented | Not documented | Not documented |
| UPDF (Mac) | Yes, create or import a digital ID | Not documented | Not documented | Not documented | Not documented |
| Foxit PDF Editor (Mac) | Yes, from the keychain | Not documented | Not documented | Not documented | Not documented for Mac |
| JSignPdf (Java) | Yes | Not documented | Yes, through a config file | Yes, levels B, T, LT, LTA | Yes |
| PDF Studio | Yes | Not documented | Yes, since 11.0.4 | Not documented | Not documented here |
| Better PDF | Yes, free | Yes, both editions | Yes, direct download | PAdES B-B, or B-T with a time-stamp | Yes, off by default |
“Not documented” does not mean the feature is missing. An app that signs with keychain identities may well see a token that has a working CryptoTokenKit driver. It means the vendor does not promise it, so try your own token before you rely on it.
What PAdES means for the file
PAdES is the European standard for signatures inside PDF files, and it is what most qualified signature rules and many government portals expect. In practice it decides how the signature is stored: a CMS signature in the format the standard names, the signing certificate bound into the signed data, and the signature written so that the bytes it covers are fixed.
The baseline levels build on each other:
- B-B: the signature and the certificate.
- B-T: plus a trusted time-stamp from an RFC 3161 server, which proves the signature existed at that moment.
- B-LT and B-LTA: plus the revocation data needed to check the signature years later, and archive time-stamps over it.
Of the apps above, only JSignPdf names these levels in its documentation. Acrobat offers the CAdES-based format the standard uses as an option, while its default is the older PKCS#7 format, and it does not label levels. The other editors do not mention PAdES at all.
One more detail matters if a document has several signers. A signature should be written as an incremental update, appended after the original bytes, so a second signature does not break the first. Not every tool says how it saves.
Where Better PDF stands
Better PDF signs with a certificate in its free tier. There are three routes:
- Keychain certificates, including those imported from a
.p12file. - Smart cards and tokens with a CryptoTokenKit driver. The key stays on the card, and this works in both editions.
- USB tokens with a PKCS#11 library, such as the Watchdata ProxKey. Better PDF loads the maker’s library, shows the token’s state and asks for the PIN on a card of its own. You can be asked for the PIN every time, have it remembered until you quit, or keep it in the Keychain behind Touch ID.
The Mac App Store edition is sandboxed and cannot load a PKCS#11 library, so those tokens need the direct download from betterpdf.co. Keychain and CryptoTokenKit signing work in both editions.
Every signature is a PAdES signature written as an incremental update. With time-stamps turned on in Settings › Signing it is PAdES B-T: Better PDF asks an RFC 3161 server for a time-stamp and sends only a hash, never the document. Time-stamps are off until you turn them on.
What Better PDF does not do yet: it does not write the long-term levels, B-LT and B-LTA, and it does not check revocation online when it verifies a signature. If your workflow needs long-term validation embedded in the file, that is a real gap today, and we would rather you knew before you buy anything.
Opening a signed PDF, Better PDF checks its signatures on the Mac and lists each one: unchanged since signing, time-stamped, certificate valid, untrusted root, or changed after signing.
How to test your own token
- Install the token’s driver from the maker or your certificate authority.
- Open Keychain Access. If the certificate appears there with the token plugged in, a CryptoTokenKit driver is working, and keychain-based apps should see it.
- If it does not appear, find the PKCS#11 library the driver installed, usually a
.dylibunder/usr/local/libor inside the driver’s app bundle, and use an app that loads PKCS#11 modules. - Sign a test file, then open it in a second app and check the signature there too.
The step by step for Better PDF is in Help: Sign with a certificate or USB token. The free app signs from the first launch; download it and plug in your token. If your token does not work, write to [email protected] with its make and model.
Sources checked on 9 November 2026: Adobe Acrobat, https://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Macintosh/Security.html, https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSigDC/planning.html and https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSigDC/standards.html · Preview, https://support.apple.com/guide/preview/fill-in-and-sign-pdf-forms-prvw35725/mac · PDF Expert, https://support.readdle.com/pdfexpert/en_US/fill-and-sign-pdfs/sign-pdf-documents · Nitro PDF Pro, https://gonitro.com/user-guide/mac/article/digital-signatures · PDFgear, https://www.pdfgear.com/sign-pdf/sign-pdf-with-certificate.htm · UPDF, https://updf.com/updf-mac-user-guide/sign-pdf-mac/ · Foxit, https://help.foxit.com/manuals/pdf-editor/mac/en-us/11.1.0/PDF_Sign.html · JSignPdf, https://jsignpdf.eu/ · PDF Studio, https://kbpdfstudio.qoppa.com/how-to-setup-usb-smart-card-hardware-pkcs11-signing-on-mac/ · Thales SafeNet Authentication Client, https://cpl.thalesgroup.com/sites/default/files/content/product_briefs/safenet-authentication-client-pb.pdf · Belgian eID middleware, https://github.com/fedict/eid-mw
Questions people ask
- Why does my USB token work in one app and not another?
- Usually because of the driver. If your token ships only a PKCS#11 library, an app has to load that library itself, and most Mac apps do not. If it ships a CryptoTokenKit driver, any app that signs from the keychain can see the certificate.
- Does Preview sign with a certificate?
- No. The built-in viewer adds a handwritten signature captured with the trackpad, camera or an iPhone, which is an image on the page. It does not write a certificate signature into the file.
- Can a sandboxed Mac App Store app use a PKCS#11 token?
- Generally not, because a sandboxed app cannot load a third-party driver library from the disk. That is why Better PDF's Mac App Store edition signs through the keychain and CryptoTokenKit only, and PKCS#11 tokens need the direct download from betterpdf.co.