How Signature Tools works
Signature Tools is a free, private signature generator. It runs entirely in your browser as an installable PWA — typing, drawing, and tracing all happen on your device. Your name, your strokes, and your image never leave your device.
Your name, strokes, and image are never uploaded
There is no server and no backend. Typing renders through the Canvas API as plain JavaScript, drawing captures pointer events onto a <canvas> in memory, and an uploaded image is decoded locally with the browser's image decoder. Your name, your drawn strokes, and your image never leave your browser. The site's Content-Security-Policy (connect-src 'self') even restricts which hosts the page may contact, so the privacy guarantee is enforced by the browser itself.
Bundled fonts — no Google Fonts fetch
The cursive type styles (Dancing Script, Caveat, Great Vibes, Sacramento) are vendored as woff2 files under /fonts/ and declared same-origin via @font-face. The browser loads them from your own origin — there is no request to a font CDN, so the fonts work offline once cached and the strict CSP stays intact. The exported SVG for a typed signature embeds the font as a base64 data URI, so it renders identically on any machine, even one without the font installed.
Real output — not stubs
Everything exported is genuinely produced on your device. A typed signature is real canvas fillText in the loaded font; a drawn signature is a real vector <path> built from quadratic curves through your pointer samples; an uploaded signature is cleaned pixel-by-pixel with a luminance threshold. PNG, SVG, and PDF are generated locally through same-origin blob: URLs (PDF via pdf-lib). Change the name, the strokes, the size, or the threshold and the exported bytes change — deterministically.
No WASM, no CDN, no third-party script
Signature Tools needs no WASM, no SharedArrayBuffer, and no cross-origin isolation — it is pure JavaScript plus the Canvas/SVG API and pdf-lib. That makes its Content-Security-Policy one of the simplest in the portfolio: script-src 'self' with no 'wasm-unsafe-eval', no COOP/COEP headers, and connect-src 'self' as the only network allowance. There is no model CDN, no ad host, and no analytics host in this build.
No device permissions needed
Signature Tools never needs the camera, microphone, or location. The Permissions-Policy fully disables all three (camera=(), microphone=(), geolocation=()) — you type, draw, or upload and download the result.
This is a signature image, not a legal e-signature
Signature Tools creates a signature image you can place onto a document. It does not create cryptographic or AcroForm signature fields, it does not bind a signature to a document hash, and it does not record an audit trail of who signed what and when. In other words, it is not a legally binding e-signature service. The Pro embed on PDF feature places that image onto a page of your PDF (drag-to-position, then export) — it is image placement, not a certified digital signature. For contracts and agreements that need enforceability, identity verification, and an audit log, use a dedicated e-signature provider (such as DocuSign, Adobe Sign, or a notary). Signature Tools is the fast, private way to produce the signature image itself — what you do with it is up to you.