SOURCE_URL: https://majikah.solutions/products/majik-signature/docs/signing-documentation

---
title: "Signing Files and Text"
id: "signing-documentation"
group: "majik-signature"
type: "products"
version: "0.11.0"
lastUpdated: "2026-09-04T00:00:00.000Z"
difficulty: "Beginner"
time: "10-15 minutes"
tags: [signing, digital-signatures, ed25519, ml-dsa-87, post-quantum, hybrid-crypto, file-signing, text-signing, embedding, offline, batch, folder, zip, sealing, multi-signature, allowlist, trusted-timestamps, tsa, document-stamping, audio-stamping, image-stamping, signing-wizard, windows-hello, notary, solana, blockchain, anchor, sha3-512, revision-chain, file-versioning, chain-verification]
---

# Signing Files and Text

> Complete guide to signing files, text, folders, and ZIP archives with Ed25519 + ML-DSA-87 hybrid signatures, including stamping, TSA, and multi-signature workflows

## Overview
Learn how to sign any file or text with hybrid post-quantum cryptography using Majik Signature. This guide covers the complete signing workflow — single file signing, plain text signing, document/audio/image stamping, Trusted Timestamps, multi-party signing with allowlists, sealing, batch signing of folders and ZIP archives, and result interpretation.

### What Does Signing Mean?

Signing content creates a cryptographic proof that the content originated from you and has not been modified since signing. Majik Signature uses a hybrid approach: every signature is produced by two independent algorithms — Ed25519 (classical) and ML-DSA-87 (post-quantum, NIST FIPS-204). Both algorithms sign the same canonical payload that binds together your signer ID (fingerprint), a timestamp, the content type, and a SHA-256 hash of the content. Anyone with your public keys can verify the signature — no private key is needed for verification, making it safe to verify anywhere. Beyond the base signature, you can optionally layer on a visual, audio, or image stamp, request an independently signed Trusted Timestamp, or route the file through a multi-party signing and sealing workflow.

> **NOTE:** Access the signing interface from the Sign tab — the second tab in the top navigation bar. Choose the guided Signing Wizard for a step-by-step flow, or Advanced Mode for full control over stamping, Trusted Timestamps, and multi-signer options in a single view.

### Signing Wizard vs. Advanced Mode

Majik Signature offers two ways to sign. The Signing Wizard walks you through signing step by step — Select File → Choose Signers → Configure Signing (stamp, TSA) → Review & Sign — and is recommended for most users and new signers. Advanced Mode is the original full-control interface: file, text, and batch modes are all available in one screen, alongside every stamping option, Trusted Timestamp toggle, and multi-signer/allowlist control, without being walked through separate steps. Both modes produce identical signature envelopes — the choice is purely about interface flow, not capability.

### Interface Layout (Advanced Mode)

In Advanced Mode, the Sign tab is split into two side-by-side panels. The left panel (input) is where you provide the content to sign — either a file, text, or a batch of files. The right panel (output) shows the signature result after signing completes. At the top of the panels is a mode toggle: File (blue), Text (green), or Batch (purple). Above the panels is the Signing Account selector, where you choose which of your Majik Key accounts should sign the content. For file signing, an expandable Stamp section (document, audio, or image, depending on file type), a Trusted Timestamp toggle, and a Signers section (for multi-party/allowlist configuration) sit between the file drop zone and the Sign button. Below the input panel is a footer with action buttons.

### Account Must Be Unlocked

> ⚠️ **WARNING:** The selected account must be unlocked before signing — either by entering your passphrase or, on the Windows Desktop App if you've opted in, by authenticating with Windows Hello (face, fingerprint, or PIN). If you see a No Keys badge on an account, it means the account was imported without signing keys and needs to be re-imported via mnemonic backup. Accounts without signing keys cannot sign — the Sign button will be disabled.

### Signing a File

1. **1. Open the Sign Tab**
   *Navigate to the signing interface*
   - Go to the Sign tab — second tab in the navigation bar
   - Choose the Signing Wizard or Advanced Mode
   - The interface loads in File mode by default

2. **2. Select Your Signing Account**
   *Choose which identity will sign*
   - At the top of the page is the Signing Account selector
   - Your active account is pre-selected
   - If you have multiple accounts, click on a different account to switch
   - Each account shows its display name, fingerprint (first 32 chars), and a status badge: Selected (active), Ready (has keys), or No Keys (needs re-import)
   - If the selected account shows No Keys, you must re-import it via mnemonic backup before it can sign — go to Accounts tab → Import Account → enter your seed phrase (12-word or 24-word)

3. **3. Provide Your File**
   *Drop or browse for the file to sign*
   - In the left panel (input), drag-and-drop a file onto the drop zone, or click to browse
   - Any file format is accepted — PDFs, images, audio, video, documents, code, archives, executables, and more
   - Once loaded, the panel shows the filename, size, MIME type, and a file icon
   - Below the file info is an inline preview for supported formats: images display as thumbnails, audio files show a waveform player, video plays inline, PDFs render in an iframe, and text files show their content
   - If you want to change the file, click the ✕ Remove button and drop a new one

4. **4. (Optional) Add a Stamp, TSA, or Multi-Signer Setup**
   *Configure additional options before signing*
   - For PDF/DOCX/XLSX, open the Document Stamp section to add a visual stamp
   - For audio files, open the Audio Stamp section to add a producer tag or watermark
   - For image files, open the Image Stamp section to add a logo or watermark with Smart Anchor Placement
   - Enable Trusted Timestamp to request an independently signed TSA timestamp instead of a local one (requires Majikah sign-in and internet)
   - Open Signers to add additional expected signers and turn this into a multi-party, allowlisted signing session
   - All of these are optional — skip this step for a plain single-signer signature with a local timestamp

5. **5. Sign the File**
   *Trigger the signing operation*
   - Click the ✦ Sign button in the footer of the left panel
   - The right panel shows a progress bar and step indicators: ① Extract signature → ② Hash content → … → ⑤ ML-DSA-87
   - After a moment (typically under 1 second for local timestamps; longer if requesting a TSA timestamp), the signature result appears in the right panel
   - The progress bar fills to 100% and the status badge changes from Signing… to Signed

6. **6. Review the Signature Result**
   *Inspect the signature metadata*
   - The right panel shows a green success banner: File signed successfully · Ed25519 + ML-DSA-87 · Hybrid post-quantum signature
   - Below that is a metadata grid showing: filename, format (MIME type), embed handler (e.g., 'PDF', 'WAV', 'MP4/MOV'), signed by (your display name or fingerprint), signer fingerprint (first 32 chars + …), algorithm (Ed25519 + ML-DSA-87), timestamp (local and/or TSA, when you signed it), and SHA-256 content hash (first 28 chars + …)
   - If a Trusted Timestamp was requested, an additional badge shows the TSA that issued it and its own independent timestamp
   - If a multi-signer allowlist was configured, a Signers section shows who is expected to sign and who has signed so far
   - At the bottom is the Detached Signature (base64) section — this is the serialized signature envelope you can copy and share separately if needed (click Copy)

7. **7. Download the Signed File**
   *Save the file with embedded signature*
   - Click Download Signed File in the footer of the right panel
   - The file downloads with the same filename as the original
   - The signature (wrapped in a MultiSigEnvelope, even for a single signer) is embedded in the file's native metadata — PDF signatures are stored as a binary trailer after %%EOF, PNG in iTXt chunks, WAV in RIFF LIST INFO, MP4 in moov → udta → majk box, and so on
   - Any stamp you configured (document, audio, or image) is embedded alongside the signature as a visual/audible layer
   - The signed file is the same format as the original — a signed PDF is still a valid PDF, a signed WAV is still playable, etc.
   - You can share this file anywhere — email, cloud storage, USB — and anyone with your public keys can verify it


> **NOTE:** Re-signing a single-signer file is always safe. If you sign a file that already carries a Majik Signature from the same signer, with no other signer added, the old envelope is automatically stripped before the new one is created (unless the file is sealed — see below, where re-signing is blocked entirely). This is idempotent — signing the same unmodified file twice produces the same content hash (modulo timestamp). Adding a signature to a multi-signer file works differently: nothing is stripped. Each additional signer's pass is recorded as its own revision in the file's chain, so earlier signers' signatures stay valid even if the file's visual content changed along the way.

### Adding a Document Stamp (PDF, DOCX, XLSX)

When signing a PDF, DOCX, or XLSX file, open the Document Stamp section before clicking Sign to add a visual, professional mark alongside the cryptographic signature. Import an image (PNG/JPG) to use as your stamp, or draw one directly with your mouse or stylus. If you imported an image, enable chroma key to automatically remove a solid background color. Resize, rotate, and reposition the stamp on the page or sheet, and optionally add name and position text with custom font size and color. The stamp is a visual layer only — it never changes what's cryptographically signed. The underlying signature always covers the original document content, regardless of whether a stamp is present or how it's styled.

### Adding an Audio Stamp

When signing a WAV or other compatible audio file, open the Audio Stamp section to embed a producer tag, voice signature, or branded audio watermark using the built-in multi-track editor. Import one or more audio clips as reusable stamps, then arrange them on the timeline. Adjust per-track volume, pan, pitch, EQ, trimming, and looping to layer multiple stamps together. Save your mix as a preset to reuse in future signing sessions. Like document stamps, the audio stamp is embedded as an audible layer alongside — not instead of — the cryptographic signature.

### Adding an Image Stamp

When signing a PNG, JPG, WebP, or other compatible image file, open the Image Stamp section to add a logo, watermark, or branding overlay directly onto the image. Import the image you want to use as a stamp, then use Smart Anchor Placement to position it relative to an anchor point (e.g., bottom-right, center) with a margin and relative size — this keeps the stamp consistently positioned even across images of different dimensions and aspect ratios. To apply the same stamp across many images in one operation, use Batch Image Stamping from Batch mode: configure your stamp once, and it's applied consistently to every image in the batch while each file is still signed individually.

> **NOTE:** Document, audio, and image stamps are a presentation layer — a visual or audible complement to the signature, not a replacement for it. Verification always checks the underlying Ed25519 + ML-DSA-87 signature over the original file bytes, regardless of any stamp present.

### Requesting a Trusted Timestamp (TSA)

By default, Majik Signature uses a local, self-reported timestamp — accurate, but not independently verifiable. To get a stronger, independently signed proof of when a file was signed, enable Trusted Timestamp before clicking Sign. This requires signing in to a Majikah account (separate from your Majik Key signing account) and an internet connection. Majik Signature sends a small digest-only request to an independent timestamp authority server, which returns a timestamp token signed with the same hybrid Ed25519 + ML-DSA-87 cryptography used everywhere else in the system — so the TSA timestamp carries the exact same forgery resistance as your own signature. Every Majikah account includes 5 free Trusted Timestamps every 24 hours; re-signing the same unmodified file again within that window doesn't consume an additional credit. Additional TSA credit packs can be purchased if you need more.

> **NOTE:** Local (self-reported) timestamps remain the default and continue to work fully offline. Trusted Timestamps are optional and mainly useful for legal or compliance scenarios where independent proof of signing time matters.

### Multi-Party Signing and Allowlists

For documents that need more than one signer, open the Signers section before your first signature. As the issuer (the first signer), you can leave signing open — anyone with the file can add a signature — or add specific people to a signing allowlist, restricting who is permitted to sign. When a subsequent signer needs to stamp, draw over, or otherwise visually modify the file before adding their signature — a common case for documents, stamped photos, and stamped audio — Majik Signature preserves every earlier signer's signature by recording each pass as its own entry in the file's append-only revision chain, instead of overwriting bytes in place. As signers are added, a progress view shows who is still pending and who has completed their signature. Only the issuer can later seal the file (see below), and if you set an allowlist, tampering with it after the fact is cryptographically detectable — it invalidates your own (the issuer's) signature the next time the file is verified.

> **NOTE:** Revisions are tracked automatically. Any time a signed file is modified before an additional signature is added, Majik Signature appends a new entry to the file's revision chain rather than discarding the previous version's proof. Each entry is matched to its recorded signature by content, not by filename or drop order. This is what lets every signer's signature stay independently valid, and it's what powers Full Chain Verification on the Verify tab.

> **NOTE:** An allowlist restricts who may sign, not who may verify. Anyone can still verify a restricted file's signatures — restriction only applies to adding new signatures.

### Sealing — Finalizing a Signed Document

Sealing is an optional final step that permanently locks a file's set of signers. Only the issuer — the signer who started the signing session — can seal a file, and once sealed, no further signatures are accepted from anyone, including the issuer. This is useful for approval workflows where you want to indicate that all required parties have signed and the document is finalized. Under the hood, sealing computes a SHA3-512 hash over every current signer plus a seal timestamp and stores it in the file — this hash lets anyone confirm the exact set of signers hasn't changed since sealing, separately from verifying each individual signature. Sealing is non-destructive to the existing signatures — it adds seal metadata without replacing or altering any signer's signature. There is no way to "unseal" a sealed file; if changes are needed, the underlying content must be re-signed from scratch as a new signing session.

### Sealing Is Permanent

> ⚠️ **WARNING:** Unlike a normal re-sign (which safely strips and replaces an existing signature), sealing cannot be undone and does not permit further signing afterward — not even by the issuer. Only seal a file once you're certain all required signers have signed.

> **NOTE:** Sealed files can be notarized. Once a file is sealed, a Notarize option becomes available — this anchors the file's seal hash to a public blockchain for an independent, tamper-evident timestamp, for a small per-file fee. This is separate from sealing itself and entirely optional. See the dedicated Notarizing on Solana guide.

### Signing Plain Text

In addition to files, you can sign plain text or clipboard snippets. This produces a detached base64 signature that you can share alongside the original text through any channel — email, messaging apps, notes, etc. The signature is not embedded into the text itself; instead, you share both the text and the signature separately. Stamping and multi-party allowlists apply to file signing only — text signing always produces a single-signer detached signature.

### Signing Text

1. **1. Switch to Text Mode**
   *Toggle the mode switcher*
   - At the top of the panels is a mode toggle
   - Click Text — the toggle turns green
   - The left panel now shows a text input area instead of a file drop zone

2. **2. Enter Your Text**
   *Paste or type the content to sign*
   - In the left panel, type or paste your text into the input box
   - There is no size limit, but keep in mind that very long text will take slightly longer to sign
   - Below the text box is a character counter showing how many characters you've entered

3. **3. Sign the Text**
   *Trigger the signing operation*
   - Click the ✦ Sign button in the footer of the left panel
   - The right panel shows the same progress animation as file signing
   - After a moment, the signature result appears

4. **4. Copy the Signature**
   *Save the detached signature*
   - The right panel shows a green success banner: Text signed successfully · Ed25519 + ML-DSA-87
   - Below that is the metadata grid showing: signed by, fingerprint, algorithm, timestamp, and content hash
   - At the bottom is the Detached Signature (base64) section
   - Click Copy Signature to copy the base64 string to your clipboard
   - Share this signature alongside the original text — both are needed for verification


> **NOTE:** Text signatures are detached. Unlike file signatures which are embedded in the file, text signatures are separate base64 strings. You must share both the original text and the signature. If you change even one character in the text, the signature will no longer verify.

### Batch Signing — Folders and ZIP Archives

Batch mode lets you sign multiple files in a single workflow. Switch to Batch mode using the mode toggle at the top of the panels (purple). You can drop an entire folder or a ZIP archive onto the input panel — Majik Signature automatically detects all contained files, recursively traverses nested folders and nested ZIPs, and signs each file individually. Each file receives its own embedded hybrid signature envelope, enabling granular per-file verification later. Batch mode also supports Batch Image Stamping — configure one image stamp and apply it consistently across every image file in the batch. The output is repackaged as a ZIP that preserves your original directory structure. Batch mode also provides detailed per-file results — you can see exactly which files were signed successfully, which failed, and why.

### Batch Signing a Folder or ZIP

1. **1. Switch to Batch Mode**
   *Toggle the mode switcher*
   - At the top of the panels is a mode toggle
   - Click Batch — the toggle turns purple
   - The left panel now shows a batch drop zone and file list area

2. **2. Select Your Signing Account**
   *Choose which identity will sign all files*
   - The Signing Account selector above the panels works the same as in single-file mode
   - The selected account will be used to sign every file in the batch

3. **3. Provide Files, a Folder, or a ZIP**
   *Drop your content onto the batch input panel*
   - Drag-and-drop one or more individual files, an entire folder, or a ZIP archive onto the input panel
   - You can also click to browse and select multiple files or a folder
   - Majik Signature automatically detects all files — if you drop a ZIP, it is extracted and all contents are recursively processed, including nested folders and nested ZIPs
   - The input panel displays a file list showing each detected file with its name, size, and type
   - Click the popup preview icon on any file to inspect it before signing
   - Use the ✕ Remove button on individual files to exclude them from the batch
   - If the batch contains image files, an optional Batch Image Stamp section lets you configure one stamp with Smart Anchor Placement to apply across all of them

4. **4. Sign the Batch**
   *Trigger batch signing*
   - Click the ✦ Sign All button in the footer of the input panel
   - The right panel shows a per-file progress list — each file advances through the signing steps independently
   - The overall progress bar tracks total completion across all files
   - After all files are processed, the output panel shows a summary: total files, successful signatures (✅), and failed signatures (❌) with failure reasons

5. **5. Review Per-File Results**
   *Inspect the signing outcome for each file*
   - The right panel shows a detailed per-file results list
   - Each file row shows: filename, signing status (✅ Signed / ❌ Failed), embed handler used, and signer fingerprint
   - Failed files show an inline failure reason (e.g., unsupported format for a specific operation, file read error, or an attempt to re-sign a sealed file)
   - Shared metadata visible across all files — algorithm, signing account, timestamp range — is shown in a summary panel above the file list
   - If any file already had an existing (unsealed) signature, the old signature was stripped and replaced — this is shown per file

6. **6. Seal and Download**
   *Finalize and export the signed files*
   - After signing, the issuer of each file can seal it to permanently lock its set of signers against further signing
   - Seal files individually by clicking the seal icon next to each file, or use Seal All to bulk-seal all successfully signed files at once
   - Sealing is permanent — a sealed file rejects all further signing attempts, including from the issuer
   - Click Download ZIP to download all signed files repackaged as a ZIP archive that preserves your original directory structure
   - Files that failed signing are excluded from the output ZIP by default — you can review failure reasons and re-sign if needed


> **NOTE:** ZIP files are signed at the file level, not the container level. When you sign a ZIP, Majik Signature extracts its contents and signs each individual file with its own embedded signature envelope. This provides granular verification — you can verify any single extracted file independently, without needing the original ZIP. Container-level signing (signing the ZIP as a single binary blob) is not used, as it would prevent individual file verification.

### What's Inside a Signature?

Every file you sign holds a wrapper envelope containing an array of one or more signer entries — even a single-signer file uses this wrapper, so adding another signer later never requires restructuring the file. Each signer's entry is a JSON object containing: version (always 1), signerId (that signer's fingerprint — SHA-256 of their Ed25519 public key), signerEdPublicKey (Ed25519 public key, base64, 32 bytes), signerMlDsaPublicKey (ML-DSA-87 public key, base64, 2592 bytes), contentHash (SHA-256 of the content, base64, 32 bytes), contentType (advisory MIME type, e.g., 'audio/wav' or 'text/plain'), timestamp (ISO 8601 string of when they signed), edSignature (Ed25519 signature, base64, 64 bytes), and mlDsaSignature (ML-DSA-87 signature, base64, 4595 bytes). Two additional fields appear only when relevant: allowlistHash (present only on the issuer's entry, if a signing allowlist was set) and a tsa object (present only if a Trusted Timestamp was attached). The wrapper itself also carries optional seal metadata once a file has been sealed, along with a chainAnchors array (one entry per blockchain the sealed file has been notarized to) and a fileVersions array (the append-only revision chain covering every signed revision) once either feature has been used.

### What Gets Signed (Canonical Payload)

Both Ed25519 and ML-DSA-87 sign the same canonical payload string. This ensures the signature is bound to all the metadata, not just the content. The payload format is: "majik-signature-v1:" + JSON({ v, id, ts, ct, hash[, alh] }), where v is the envelope version, id is the signer's fingerprint, ts is the timestamp, ct is the content type (optional), hash is the SHA-256 of the content, and alh — present only when this signer is establishing a signing allowlist — is the SHA-256 of that allowlist. The domain separator ("majik-signature-v1:") prevents cross-protocol signature reuse — a Majik Signature cannot be mistaken for a signature from another system, such as a seal or a Trusted Timestamp, each of which uses its own distinct separator. Because the fingerprint, timestamp, and (when applicable) allowlist hash are all part of the signed payload, a valid signature cannot be transferred to a different signer, replayed with a modified timestamp, or have its allowlist quietly edited afterward.

### Signature Components (Per Signer)

| Component | Size | Purpose |
| --- | --- | --- |
| Ed25519 signature | 64 bytes | Classical signature |
| ML-DSA-87 signature | 4595 bytes | Post-quantum signature |
| Ed25519 public key | 32 bytes | Signer's classical public key |
| ML-DSA-87 public key | 2592 bytes | Signer's PQ public key |
| Content hash (SHA-256) | 32 bytes | Tamper detection — any byte change invalidates |
| Timestamp | ~24 chars | When this signer signed |
| Signer ID | 44 chars | SHA-256 of Ed25519 public key (base64) |
| Content type | variable | Advisory MIME type (optional) |
| Allowlist hash | 44 chars (optional) | Present only on the issuer's entry when an allowlist was set |
| Trusted Timestamp (TSA) | ~10 KB (optional) | A full independent hybrid signature from a timestamp authority |

*Caption: What's included in every signer's entry within a Majik Signature*

### File Embedding — Native Metadata Containers

Majik Signature embeds directly into each file format's native metadata container. This is what the Embed handler field in the signature result refers to. Tier 1 formats use built-in metadata: PDF uses a spec-compliant binary trailer after the last %%EOF marker, PNG uses iTXt chunks, JPEG uses native metadata, WAV uses RIFF LIST INFO chunks, MP3 uses ID3v2 TXXX frames, MP4/MOV uses moov → udta → majk boxes, FLAC uses native metadata, DOCX/XLSX/PPTX/ODT/ODS/ODP use a dedicated ZIP entry (majik-signature.json), and HTML/Markdown/source code use comment blocks. Tier 2 formats (MKV/WebM and any other file without a dedicated handler) use a universal self-describing binary trailer: [original file bytes][signature JSON UTF-8][8-byte payload length LE][8-byte magic: MAJIKSIG]. The magic bytes at the end allow detection and clean stripping without knowing the format.

> **NOTE:** Tier 1 signatures survive re-save. For formats like PDF, PNG, WAV, MP4, and DOCX, the signature survives standard open → save round-trips in most tools — Office formats additionally use deterministic ZIP re-canonicalization so identical content always strips to identical bytes. Tier 2 signatures do not survive re-encoding. If you re-mux an MKV or re-compress an archive, the trailer is stripped. Use Tier 1 native-metadata formats where signature durability matters.

### Embed Handlers by Format

| Format | Handler Name | Metadata Location | Survives Re-save? |
| --- | --- | --- | --- |
| PDF | PDF | Binary trailer after %%EOF (PDF 1.7 §7.5.6 compliant) | Yes (most tools) |
| PNG | PNG | iTXt chunk | Yes |
| JPEG | JPEG | Native metadata | Yes |
| WAV | WAV | RIFF LIST INFO chunk | Yes |
| MP3 | MP3 | ID3v2 TXXX frame | Yes |
| MP4/MOV/M4A/M4V | MP4/MOV | moov → udta → majk box | Yes |
| FLAC | FLAC | Native metadata | Yes |
| MKV/WebM | MKV/WebM | Binary trailer | No (re-mux strips) |
| DOCX/XLSX/PPTX/ODT/ODS/ODP | Office | Dedicated ZIP entry (majik-signature.json) | Yes |
| HTML/Markdown/source code | Text | Comment block | Yes |
| Any other | Fallback (Universal Trailer) | Binary trailer | No |

*Caption: How signatures are embedded in different file types*

### Signing Account Selector — Multiple Identities

If you have multiple Majik Key accounts, the Signing Account selector lets you choose which identity should sign the content. Each account is a separate cryptographic identity with its own seed phrase, fingerprint, and signing keys — you can store up to 100 accounts locally. This is useful for separating personal, work, and project identities. The selector shows all your accounts with their display names, fingerprints (first 32 chars), and status badges. Selected (green) means this is the active signing account. Ready (neutral) means the account has signing keys and can be selected. No Keys (red) means the account was imported without signing keys — it needs to be re-imported via mnemonic backup before it can sign. In batch mode, the selected account signs every file in the batch. Note this Majik Key account selector is separate from your optional Majikah account sign-in, which is only needed for Trusted Timestamps.

### Accounts Without Signing Keys

> ⚠️ **WARNING:** If an account shows a No Keys badge, it means the account was imported using a JSON backup or created in an older version of Majik Message before signing keys were added. To enable signing, you must re-import the account using your seed phrase (12-word or 24-word). Go to the Accounts tab → click the Import button → paste your mnemonic → enter your passphrase → click Import. The account will be upgraded with Ed25519 and ML-DSA-87 signing keys.

### File Previews — See What You're Signing

When you load a file in the input panel, Majik Signature shows an inline preview for supported formats. Images (PNG, JPEG, GIF, WebP, SVG) display as thumbnails up to 320px height. Audio (WAV, MP3, OGG, FLAC) shows a waveform player with play/pause controls, a seek bar, and a timer. Video (MP4, WebM, MOV) plays inline with native HTML5 video controls up to 320px height. PDFs render in an iframe (380px height) so you can see the first page. Text files (TXT, Markdown, JSON, CSV, source code) show their content up to 240px height with syntax highlighting. In Batch mode, each file in the list has a popup preview icon — click it to open an inline preview overlay for that specific file before committing to signing. For generic formats (executables, archives, fonts, 3D assets, etc.), a file icon and MIME type are shown with a message: 'No preview available for [MIME type] — The file will be signed as-is.'

> **NOTE:** File previews are purely for your convenience — they do not affect what gets signed. The signature always covers the raw file bytes, not the preview rendering or any stamp overlay.

### Quick Reference

| Task | Panel | Mode | Notes |
| --- | --- | --- | --- |
| Sign a file | Left (input) + Right (output) | File | Drag-and-drop or browse |
| Choose signing account | Signing Account selector (above panels) | Any | Must have keys and be unlocked (passphrase or Windows Hello) |
| Add a document stamp | Left panel — Document Stamp section | File | PDF, DOCX, XLSX only |
| Add an audio stamp | Left panel — Audio Stamp section | File | WAV and other compatible audio |
| Add an image stamp | Left panel — Image Stamp section | File | PNG, JPG, WebP and other compatible images |
| Apply the same image stamp to many images | Left panel — Batch Image Stamp section | Batch | Uses Smart Anchor Placement |
| Request a Trusted Timestamp | Left panel — Trusted Timestamp toggle | File or Batch | Requires Majikah sign-in + internet |
| Set up multi-party signing / allowlist | Left panel — Signers section | File | Configure before the first signature |
| Download signed file | Right panel footer | File | Signature embedded in metadata |
| Sign plain text | Left (input) + Right (output) | Text | Paste or type |
| Copy detached signature | Right panel — Detached Signature section | File or Text | Base64 string |
| Re-sign a file | Left panel | File | Old signature auto-stripped (unless sealed) |
| Batch sign a folder or ZIP | Left (input) + Right (output) | Batch | Each file signed individually |
| Preview file before signing | Left panel — preview area or popup icon | File or Batch | Images, audio, video, PDF, text |
| Seal individual files | Right panel — per-file seal icon | Batch | Issuer only; permanent |
| Seal all files at once | Right panel footer — Seal All | Batch | Bulk sealing; permanent |
| Notarize a sealed file | Right panel, after sealing | File | Solana anchor, small per-file fee; see Notarizing on Solana guide |
| Download signed batch | Right panel footer — Download ZIP | Batch | Preserves original directory structure |
| Switch accounts | Signing Account selector | Any | Click on a different account |

*Caption: Common signing tasks and where to find them*

### Privacy & Security Guarantees

All core signing happens entirely on your device. Your files, private keys, and signatures never leave your computer. The only exception is an explicit Trusted Timestamp request, which sends a small digest-only payload to a TSA server and requires internet access. Every signer's entry is self-contained and only breakable by cryptographic attacks on both Ed25519 and ML-DSA-87 simultaneously — which is infeasible even for quantum computers. The combination of Ed25519 (128-bit classical security) and ML-DSA-87 (NIST Category 5 post-quantum security) ensures your signatures remain secure today and in the future. No server is required for core signing, and no internet connection is needed unless you opt in to a Trusted Timestamp. You can sign files completely offline — including entire folders, ZIP archives in batch mode, and multi-party/allowlisted signing sessions.

> **NOTE:** Core signing works completely offline, including stamping, multi-party signing, and sealing. No internet connection is required unless you explicitly request a Trusted Timestamp. Your files, keys, and signatures never leave your device.

> **NOTE:** For anchoring a sealed file to a blockchain, see Notarizing on Solana. For checking a file's full revision history against its signatures, see Verifying Signatures.