Digital vs electronic signature

In the ordinary sense the term is used in PDF tools, an electronic signature is an image or a drawn mark placed on the page: a photographed wet signature, a scribble made with a trackpad or stylus, or a name typed in a script typeface. Technically it is an annotation or an image drawn into the page content, no different in kind from a logo. The document now depicts a signature.

What it does not do is bind anything. There is no cryptography involved, so nothing in the file records who placed the mark, when, or what the document contained at that moment. If the text above the signature is edited afterwards, the mark sits there unchanged and unbothered, because it has no relationship to the content it appears to endorse. Nothing can detect the edit from the signature alone.

It is also trivially transferable. A signature image can be extracted from one PDF and placed on a completely different one in seconds, with no technical trace of the move. That is not a flaw in any particular tool; it follows inevitably from the mark being pixels on a page. None of which makes electronic signatures useless — for internal approvals, routine acknowledgements and low-stakes paperwork they are convenient and widely accepted. It simply means the assurance they provide is social and procedural, not technical.

A digital signature works on the bytes rather than the appearance. The signing software computes a cryptographic hash of the document — a fixed-length value that changes unrecognisably if any byte changes — and encrypts that hash with the signer’s private key. The result, together with the certificate containing the corresponding public key, is embedded in the PDF as a signature object. A visible appearance may be drawn alongside it, but the appearance is decoration; the signature is the cryptographic data.

Verification reverses the process. The reader recomputes the hash over the signed byte range, decrypts the stored hash using the public key from the certificate, and compares. If they match, the signed bytes are exactly as they were at signing and the holder of that private key produced the signature. If anything in the covered range was altered — a figure, a date, a single character — the hashes differ and verification fails visibly. Tamper evidence is not an added feature here; it is a mathematical consequence of how the construction works.

The certificate is what connects the key to an identity. It is issued by a certificate authority that performed some level of identity checking, and it chains up to a root the verifier trusts. This is the part people skip and should not: a signature can be cryptographically perfect and still tell you nothing useful if the certificate is self-issued, unchained to any trusted root, or expired. A verification panel reporting "signed, but the signer’s identity could not be verified" is telling you precisely that the maths held and the identity claim did not. Signatures can also carry a timestamp from a trusted timestamping authority, which asserts independently when the signing happened rather than relying on the signer’s own clock.

A signature that verifies today may be hard to verify in a decade, and not because the cryptography weakened. Certificates expire. Revocation information — the lists and responses that record whether a certificate was withdrawn — is published at the time and may not be available later. Verifying an old signature therefore requires evidence about the state of the world at the moment of signing, and that evidence is not automatically part of the file.

PAdES, the PDF Advanced Electronic Signatures family of profiles standardised under ETSI, exists to address this. It specifies how signatures are embedded in PDF and defines levels that progressively add the material needed for long-term validation: the certificate chain, revocation data gathered at signing time, and trusted timestamps, with provision for adding further timestamps later so the evidence remains checkable as algorithms age. The intent is that a verifier in the distant future can establish that the signature was valid when made, without needing to contact services that may no longer exist.

This matters for anything with a long life — contracts, records retained for statutory periods, archival documents. If a signed PDF must still be verifiable long after signing, the question to ask is not simply whether it is digitally signed but whether it carries long-term validation material and a trusted timestamp. Inspecting a file’s signature objects tells you what is actually there rather than what was intended.

It is tempting to conclude that digital signatures are legally valid and electronic ones are not. That is not how it works, and treating it as a rule will eventually cost someone dearly. Whether a signature is legally effective depends on the jurisdiction, the type of document, the applicable regulation, and sometimes the specific requirements of an institution or counterparty rather than of any law.

Different frameworks exist and they differ in structure. In the European Union, eIDAS establishes tiers of electronic signature with different evidentiary treatment and defines qualified trust service providers. In the United States, the ESIGN Act and state-level UETA adoptions take a different approach. Other countries have their own regimes, and these frameworks do not map neatly onto each other. Meanwhile some categories of document — wills, certain property transfers, particular court filings — carry additional formal requirements that may demand notarisation or physical execution regardless of what any signature technology can prove.

The honest guidance is therefore narrow and practical. Understand what each mechanism proves technically, which is what this article covers. For anything legally sensitive, verify the requirements that apply to your document, in your jurisdiction, before relying on a particular signature method — and take professional advice where the stakes justify it. No tool, including any on this site, can tell you whether a given signature satisfies a given legal requirement.