eID card
--mode beidQualified-grade cryptographic signature (QES)
The strongest legal weight, and the slowest for large batches — the PIN is requested for every document.
Open source · GPL-3.0
Cachet
Batch PDF signing with the Belgian eID card
Cachet signs a whole batch of PDFs in one pass — with your Belgian eID card, with your personal certificate in Azure Key Vault, or with a plain image stamp. Every cryptographic signature is PAdES, timestamped, long-term verifiable, and re-checked the moment it is written.
- Qualified eID signatures
- PAdES B-LTA by default
- Whole folders at once
- No Python required
Latest version
Download · v1.3.0
Released September 1, 2026
Standalone builds — a windowed app and a console binary in one archive. No Python installation needed on the target machine.
Linux
cachet-1.3.0-linux-x86_64.tar.gz
112 MBDownload
SHA256 checksum
156cc1ea5df98a96d14bc0ef1fd97d156bfdc602ed3dbda0699bbc5a7416d350Windows
cachet-1.3.0-windows-x86_64.zip
73 MBDownload
SHA256 checksum
4afcafe7b6080f38e93212128686d8e23ba30a084d0f7fa32f524592f43a2e2cWhat is in the archive
cachet— the graphical wizardcachet-cli— the console tool
Before you sign
- For eID signing, install the Belgian eID middleware and connect a card reader.
- Levels b-t and above need network access for the timestamp authority, the EU trusted list and revocation checks.
- Level b-b and image mode work fully offline.
What it does
The short version. The documentation covers each point in depth.
Whole batches at once
Point Cachet at files or folders. The same mark, page and position are applied to every document in the batch.
Three signing modes
A qualified eID signature, an advanced signature from Azure Key Vault, or a plain image stamp with no legal value.
PAdES up to B-LTA
Levels b-b, b-t, b-lt and b-lta, selectable per run. b-lta is the default — the strongest and longest-lasting.
Trusted timestamping
An RFC 3161 timestamp authority proves when you signed. Point it at a qualified TSA when eIDAS-qualified preservation matters.
Long-term validation
CA certificates and OCSP/CRL responses are embedded at signing time, so the PDF stays verifiable after the certificates expire.
Verified on the spot
Each signed file is re-opened and validated, and the achieved level is reported. Levels are never silently downgraded.
Template validation
Inputs are accepted only if their page count and per-page dimensions match a model PDF exactly. Rejected files are never signed.
Click to place
A real preview of the target page, rendered by the bundled PDFium engine. Click where the mark belongs — that is where it is signed.
Visible signature mark
eID signatures stamp the cardholder photo, name and date; Azure signatures stamp the name and date.
Nothing overwritten
Output is written as
{name}_signe.pdfin a folder you choose, and existing files are never replaced.Six languages in the app
The wizard speaks English, French, Dutch, German, Spanish and Portuguese, and follows your system language by default.
Standalone binaries
One windowed app and one console tool per platform, for Linux and Windows. Nothing to install beyond the eID middleware.
Three ways to sign
Pick the mode that matches the legal weight the document needs.
Azure Key Vault
--mode azureAdvanced electronic signature (AES)
Only the document digest is sent to Azure; the file itself never leaves your machine, and the private key never leaves the vault.
Image stamp
--mode imageNot a cryptographic signature
A visual mark only. It carries no legal value and proves nothing about who applied it.