What Is a Digital Signature?

A digital signature is a cryptographic operation that proves two things about a document: who signed it, and that not a single byte has changed since. It works by computing a mathematical fingerprint of the file and encrypting that fingerprint with a private key that only the signer holds. Anyone can check the result using the signer’s public certificate, which was issued by a trusted third party that verified who they are.

That is a much narrower thing than most people mean by “digital signature”. In everyday use the phrase usually describes any signature applied on a computer — a name drawn with a mouse, a signature image pasted onto a page, a typed name at the bottom of an email. Those are electronic signatures, and for most documents they are exactly what is required. The two terms are not interchangeable, and the difference occasionally decides whether a document is accepted.

The short answer, before the detail

If a form asks you to sign it, you almost certainly need an electronic signature, and you can sign a PDF in your browser in about a minute. If a form asks specifically for a digital certificate, a qualified electronic signature, or says the signature must be “certificate-based” or “verifiable”, you need a certificate issued to you by a certificate authority, and that is a process involving identity checks and usually a fee.

The rest of this guide explains what is actually happening in each case, because knowing that is what lets you tell which one a document is asking for.

Digital signature vs electronic signature

An electronic signature is any mark made electronically with the intent to sign. Its legal weight comes from that intent, plus whatever surrounding evidence exists that you were the person who made it — an email trail, an IP address, an audit log, a timestamp. The signature itself carries no proof of identity. A drawn signature is a picture of a signature; nothing in the image establishes who drew it.

A digital signature is a specific technology, and it is not really a picture at all. There may be a visible signature block on the page, but the part that matters is invisible: a block of encrypted data embedded in the file. It carries its own proof. A reader such as Acrobat can check it without contacting you, without contacting the sender, and without any external log, and it will report exactly one of three states — valid, invalid, or signed by someone whose certificate it does not trust.

The useful comparison is a signed letter against a wax seal. A signature on a letter is a mark you made; establishing that it was really you means comparing it to other samples or trusting the context it arrived in. A seal pressed with a ring only you possess is different in kind: it proves possession of the ring, and if the envelope is opened the seal breaks visibly. A digital signature is the seal. Tamper with one byte of the document afterwards and the verification fails — not subtly, not partially, but with a red banner across the top of the reader.

How a digital signature actually works

Three pieces of cryptography combine, and none of them is complicated on its own.

1. Hashing. The document is run through a hash function — SHA-256 in current practice — which reduces a file of any size to a fixed-length fingerprint. The function is one-way: you cannot reconstruct the file from the hash. What matters here is that it is extremely sensitive. Change one character, one pixel, one space, and the resulting hash is entirely different rather than slightly different.

2. Asymmetric encryption. The signer holds a key pair: a private key that never leaves their possession, and a public key that anybody may have. They are mathematically related such that data encrypted with one can only be decrypted with the other. Signing encrypts the hash with the private key. Because only the private key could have produced that result, anything the public key successfully decrypts must have come from the holder of the private key.

3. The certificate. A public key on its own is just a number, and a number does not tell you whose it is. A certificate binds the public key to a verified identity and is itself signed by a certificate authority. That is what turns “this was signed by whoever holds this key” into “this was signed by this named person or organisation”.

Verification runs the process backwards. The reader hashes the document as it stands now, decrypts the signature with the public key to recover the hash as it was at signing, and compares the two. Identical means the file is untouched. Different means something changed after signing, and the reader says so. It then checks the certificate: is it from an authority the reader trusts, is it still in date, and has it been revoked?

This is also why a digital signature cannot be copied from one document to another. The encrypted hash is derived from this document’s contents. Paste it onto a different file and the hashes will not match, so verification fails immediately. An image of a signature can of course be copied anywhere, which is precisely the difference.

Certificates, PKI, and who issues them

The whole arrangement rests on trust in the issuer, and that structure is called Public Key Infrastructure. A certificate authority verifies who you are before issuing a certificate, and its own certificate is trusted by operating systems and PDF readers by default. Well-known commercial CAs include DigiCert, Sectigo, GlobalSign and Entrust; many countries also run national CAs for citizen identity schemes, and India’s Digital Signature Certificates for tax and corporate filings work this way.

Getting one means proving your identity — documents, sometimes a video call, sometimes an in-person appointment — and paying an annual fee, typically tens to low hundreds of pounds or dollars depending on the assurance level. Higher assurance levels require stronger identity checks, and the highest require the private key to live on dedicated hardware such as a smart card or USB token so that it cannot be copied off a computer at all.

You will also meet self-signed certificates, which you can generate yourself for free. These provide the tamper-evidence half of the deal — any change still breaks the signature — but not the identity half, because nobody vouched for who you are. Readers show them as “signature validity is unknown”, and a recipient has no reason to accept one from a stranger. They are useful inside an organisation that has agreed to trust its own certificates, and close to useless outside one.

What the law says

Three legal frameworks cover most readers of this page. All three broadly agree that a signature is not invalid merely because it is electronic — and all three carve out categories where that is not enough.

United States. The Electronic Signatures in Global and National Commerce Act (the ESIGN Act, 2000) establishes at federal level that a contract or signature may not be denied legal effect solely because it is in electronic form. Most states also enact the Uniform Electronic Transactions Act (UETA), which does similar work at state level. The Act deliberately does not mandate a technology: a typed name can satisfy it where intent is clear. It does exclude several categories, including wills, codicils and testamentary trusts, adoption and divorce and other family law matters, court orders and official court documents, notices of utility disconnection, foreclosure and eviction notices, cancellation of health or life insurance benefits, and product recall notices affecting health or safety.

European Union. Regulation (EU) No 910/2014, known as eIDAS, is the most structured of the three and defines three tiers. A simple electronic signature is any electronic mark with intent to sign. An advanced electronic signature must be uniquely linked to the signer, capable of identifying them, created using data under their sole control, and linked to the data such that later changes are detectable — in practice, a digital signature. A qualified electronic signature is an advanced one created by a qualified signature creation device using a qualified certificate from a trust service provider on the EU Trusted List. Only the qualified tier is given explicit legal effect equivalent to a handwritten signature across every member state.

United Kingdom. Section 7 of the Electronic Communications Act 2000 makes electronic signatures admissible as evidence in legal proceedings. Following EU exit, the eIDAS Regulation was retained in domestic law as the UK eIDAS Regulation, keeping the same three tiers with a UK trust list. The Law Commission’s 2019 report on electronic execution of documents concluded that an electronic signature is generally capable of executing a document where the signatory intends to authenticate it, subject to any specific statutory requirements. Deeds and documents requiring a witness carry additional formalities, and land registration has its own rules.

This is general information about how these technologies and frameworks work. It is not legal advice. Requirements vary by jurisdiction, by document type and over time, and whether a particular signature is valid for a particular purpose is a question for a qualified professional in your jurisdiction.

So which one do you need?

An electronic signature is enough for the overwhelming majority of what people are asked to sign: employment contracts and offer letters, tenancy agreements, NDAs, consent and permission forms, invoices and purchase orders, school and medical forms, internal approvals. If the document simply says “sign and return”, this is what it means, and signing the PDF in your browser is the whole job.

You need a certificate-based digital signature when the recipient asks for one by name. The signals are specific: a request for a “digital signature certificate” or DSC, for a “qualified electronic signature”, for a signature that is “certificate-based” or “cryptographically verifiable”, or an instruction to sign with a smart card or USB token. This is common in government procurement and tax filings, some regulated financial and pharmaceutical submissions, certain court filings, and cross-border transactions inside the EU where the qualified tier is specified. No browser tool can issue you a certificate, because issuing one requires verifying your identity.

Whichever kind you need, a signature is rarely the only thing a document wants. Dates, printed names and reference numbers usually go alongside it, and typing those directly onto the PDF keeps the whole job in one place. If the completed document is confidential, encrypting it with a password is the right last step — after signing rather than before, since an encrypted file cannot be signed.

One practical note that catches people out: adding anything to a digitally signed PDF — a comment, a page, another signature applied the wrong way — can invalidate the existing signature, because the file’s bytes changed. If you receive a digitally signed document and need to add your own signature, use a tool that applies an incremental signature rather than rewriting the file, and check the original signature still verifies afterwards.

Frequently asked questions

What is a digital signature in simple terms?

It is a cryptographic seal on a document. Signing computes a fingerprint of the file and encrypts it with a private key only you hold. Anyone can check it with your public certificate, and because the fingerprint covers the file itself, any later change to the document breaks the signature visibly.

What is the difference between a digital signature and an electronic signature?

An electronic signature is any mark made with intent to sign, such as a drawn or typed name; its weight comes from intent and surrounding evidence. A digital signature is a specific cryptographic technology using a certificate, and it proves both who signed and that the file has not changed since.

Is a typed name a legal signature?

In many cases yes. The US ESIGN Act, the EU eIDAS Regulation and the UK Electronic Communications Act all provide that a signature is not invalid merely because it is electronic, and none of them mandates a particular technology for ordinary agreements. Specific document types are excluded, and this is general information rather than legal advice.

Do I need a certificate to sign a PDF?

Not for most documents. A signature image applied with intent to sign is an electronic signature and is what nearly every form means. You need a certificate only when the recipient asks for a certificate-based or qualified signature by name, which is common in government filings and some regulated submissions.

How do I get a digital signature certificate?

From a certificate authority such as DigiCert, Sectigo, GlobalSign or Entrust, or from a national authority where your country runs one. Expect an identity check, an annual fee, and for higher assurance levels a hardware token that holds the private key so it cannot be copied.

Can a digital signature be forged or copied?

The encrypted hash is derived from that specific document, so pasting it onto another file fails verification immediately. Forging one means obtaining the signer’s private key. That is why high-assurance certificates keep the key on a smart card or token rather than on a computer.

What happens if a signed document is edited afterwards?

The signature breaks. The reader hashes the document as it stands and compares it to the hash recovered from the signature; any difference at all means they do not match, and the reader reports the document as modified since signing.

What is a qualified electronic signature?

The highest tier under the EU eIDAS Regulation: an advanced electronic signature created by a qualified signature creation device using a qualified certificate from a provider on the EU Trusted List. It is the only tier given legal effect explicitly equivalent to a handwritten signature across all member states.

In short

The distinction is worth carrying around, because it is the thing that tells you whether a five-minute job is in front of you or a two-week one. Nearly every document wants an electronic signature and you can apply one now, in your browser, without an account and without the file leaving your device. The rarer certificate-based case announces itself in the wording of the request — and now the wording will mean something.

Written by Mehran

Founder of QuickMerge. Practical guides built around the real behavior and limits of the tools. Connect on LinkedIn.