Electronic signatures versus digital signatures

The words are used interchangeably in marketing copy, which is unhelpful, because the two things solve different problems.

An electronic signature is a mark

This is an image of a signature placed on a page: drawn with a mouse or finger, typed in a script font, or uploaded as a photograph of a real signature. It shows intent. In many jurisdictions, for many kinds of agreement, that intent is enough to form a binding contract. A signature has never needed to be cryptographic to be valid.

What it does not do is prove anything about the document. Nothing stops the signature image being moved to a different page, or the surrounding text being altered afterwards. It is evidence of intent, not evidence of integrity.

A digital signature is a proof

This uses a cryptographic key tied to a verified identity. Signing produces a value derived from the document's contents. Any later change to the document breaks that value, and a viewer will say so. The signature also chains back to a certificate authority that has, to some standard, checked who you are.

That gives you two things the drawn mark does not: tamper evidence, and identity assurance.

Where the distinction matters

For most everyday agreements, a freelance contract, a rental reference, an internal approval, an electronic signature is what is used and what everyone expects.

For regulated contexts it may not be. Some jurisdictions define tiers, such as the advanced and qualified electronic signatures in EU and UK law, with specific technical requirements. Certain transactions, often involving property, wills or some court filings, have their own rules that a drawn image will not satisfy.

The practical advice

Ask the person receiving the document what they need. That is a faster route to an answer than reading regulations, and it is the only thing that determines whether the document will be accepted.

If a drawn signature is fine, flatten the document afterwards so the signature becomes permanent page content rather than a movable annotation. And check the metadata before sending, because the file will otherwise record which software placed the signature and when.

Nothing in this article is legal advice. If the stakes are high, the cost of asking a solicitor is very small next to the cost of an unenforceable agreement.

What a digital signature actually proves

Two things, and it is worth being precise about them.

Integrity. The signature is computed from the document's contents. Change a single character afterwards and the value no longer matches, so a viewer can tell you the document has been altered since signing.

Identity, to a degree. The signing key is bound to a certificate issued by an authority that performed some level of identity check. How much that is worth depends entirely on how rigorous that check was, which varies enormously.

Note what it does not prove: that the signer read the document, understood it, or intended to be bound by it. Those are questions of law, not cryptography.

Where each is normally used

Electronic signatures cover the overwhelming majority of everyday agreements: engagement letters, rental references, internal approvals, consent forms, delivery notes.

Digital signatures appear where tamper evidence matters to a third party or where regulation demands it: some financial filings, certain government submissions, qualified signatures under EU and UK frameworks, and anything where a document may be challenged years later.

The practical test

Ask the recipient what they will accept. That single question resolves the matter faster than any amount of research, and it is the only answer that determines whether your document will be accepted.

If they say a signed PDF is fine, a drawn signature is fine. If they name a platform or a certificate standard, use it.

Making an electronic signature more defensible

You cannot make a drawn mark cryptographic, but you can make the surrounding record better.

Flatten the document after signing, so the mark becomes permanent page content rather than a movable annotation. Keep the covering email, which establishes who sent what and when. Keep the signed file itself rather than a link to it, because links expire and hosted copies change.

And clear the metadata before sending, since it will otherwise record which software placed the signature and on whose machine.

Nothing here is legal advice. Where a signature carries real consequences, asking a solicitor what form it needs to take costs very little next to an agreement that turns out not to bind anyone.

What happens when a document is challenged

The question in dispute is rarely whether a signature is cryptographically valid. It is usually whether a particular person agreed to a particular set of terms.

That makes the surrounding record matter more than most people expect: the covering email, the version history, and whether the signed copy you hold matches the copy the other party holds. A drawn signature with a clear paper trail is frequently more useful in practice than a certificate with none.

Keep the file rather than a link to it, and keep the correspondence with it.