Security Insights · Signing · 9 min read
Digital Signature vs Electronic Signature: What's the Difference?
An electronic signature shows intent to sign. A digital signature adds a certificate and cryptography. How they differ, and where each is legally recognized.
Contracts, approvals and consent forms are often signed on a screen now, and the terms "electronic signature" and "digital signature" get used as if they mean the same thing. They don't, and the difference matters when a signed document is challenged or a regulator asks how it was signed.
What is the difference between a digital signature and an electronic signature?
An electronic signature is any electronic mark or action that shows a person's intent to sign, such as a typed name, a drawn signature or a click on "I agree". A digital signature is a specific cryptographic type: the signer's private key signs a hash of the document, and anyone can check it using the signer's certificate.
A digital signature can serve as an electronic signature, but an electronic signature does not have to be a digital signature.
What counts as an electronic signature
US federal law defines an electronic signature as any electronic sound, symbol or process linked to a record and adopted by a person intending to sign it (15 U.S.C. 7006). Depending on the circumstances, that can include:
- a name typed into a signature field
- a signature drawn with a finger or mouse
- an image of a handwritten signature placed on a PDF
- a click on a button marked "I agree" or "Sign"
- a recorded spoken confirmation
Intent, not technology, is what makes these signatures. Showing who signed depends on evidence around the signature, such as the account used or an audit record of the signing.
How a digital signature works
A digital signature uses public key cryptography. NIST's Digital Signature Standard, FIPS 186-5, published on February 3, 2023, approves three algorithms for creating digital signatures: RSA, ECDSA and EdDSA.
- The signing software calculates a hash of the document, a short fingerprint of its exact contents.
- The signer's private key, which only the signer should hold, signs that hash.
- The signature and the signer's certificate are attached to the document.
- The recipient's software recalculates the hash and checks the signature with the public key in the certificate. If even one bit of the document has changed, the check fails.
The certificate links the public key to a named person or organization. A certificate authority issues it after checking the applicant's identity to the level its policy requires, and certificates commonly follow the X.509 format profiled in IETF RFC 5280. NIST also approved two post-quantum signature standards, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), on August 13, 2024.
Electronic signature vs digital signature
| Electronic signature | Digital signature | |
|---|---|---|
| What it is | Any electronic sign of intent to sign: a typed name, a drawn mark or a click | A cryptographic value created with the signer's private key over a hash of the document |
| How identity is shown | Evidence around the signing, such as sign-in, email verification and audit records | A certificate from a certificate authority that binds the signer's name to a public key |
| Tamper evidence | Depends on the platform's records; the mark itself does not reveal later changes | Any change to the signed document makes verification fail |
| Legal recognition | Recognized under the ESIGN Act and UETA in the US and the Electronic Transactions Act 1999 in Australia, with exceptions | Recognized under the same laws as a type of electronic signature |
| Typical uses | Contracts, approvals, consent forms and HR documents | Files that recipients must verify independently, code signing, and systems that require certificate-based signing |
Are electronic signatures legally binding?
Yes, for most documents, in both the US and Australia.
United States: the Electronic Signatures in Global and National Commerce Act (ESIGN Act), signed into law on June 30, 2000, says that in transactions affecting interstate or foreign commerce, a signature, contract or record can't be denied legal effect solely because it is electronic. Most states have also adopted the Uniform Electronic Transactions Act (UETA), approved by the National Conference of Commissioners on Uniform State Laws in 1999. New York has its own Electronic Signatures and Records Act instead. Neither law requires a particular technology, so a signature does not need to be digital to be valid.
Australia: under the Electronic Transactions Act 1999 (Cth), a signature required by Commonwealth law can be given electronically if the method identifies the person and shows their intention, is as reliable as appropriate for the purpose (or is proven in fact to have done so), and, where the signature goes to someone other than a Commonwealth entity, that person consents. Each state and territory has its own electronic transactions law for its own legislation.
Documents with different rules
The ESIGN Act does not apply to wills, codicils and testamentary trusts, to adoption, divorce and other family law matters, or to orders, notices and official papers in legal proceedings, such as briefs and pleadings. It also excludes some consumer notices, such as utility shutoff, foreclosure and eviction notices. In Australia, regulations under the Electronic Transactions Act 1999 exempt listed Commonwealth laws, and wills are governed by state and territory succession laws with their own signing and witnessing requirements.
Which signature to use when
- Tamper evidence: if a file must show on its own, years later, that it hasn't changed since signing, use a digital signature.
- Identity assurance: a digital signature ties the signer to a certificate issued after an identity check. An electronic signature relies on how the signer was authenticated, such as a sign-in with two-factor authentication.
- Regulatory requirements: some regulators and counterparties specify the form of signature they accept. Where none is specified, an electronic signature with a reliable record of who signed and when is generally recognized under ESIGN, UETA and Australia's Electronic Transactions Act 1999.
Where DekkoCORE fits
Signing in DekkoCORE is an electronic signature, not a certificate-based digital signature: a signature mark is applied to the PDF, and the signing is recorded against the file. Each person named on a signature request must sign, and signers sign in before they can sign. Every view and download is recorded in the audit log.
Common questions
Frequently Asked Questions
Is a typed name a legal signature?
A typed name can be a legally valid electronic signature in the US when the person types it intending to sign the record, under the ESIGN Act and state laws based on UETA. In Australia, a typed name can meet the Electronic Transactions Act 1999 if the method identifies the person, shows their intention and is reliable enough for the purpose. Some documents, such as wills, follow their own rules.
Is a digital signature more secure than an electronic signature?
A digital signature gives stronger tamper evidence than a basic electronic signature, because any change to the signed file makes verification fail. A digital signature's identity assurance depends on how carefully the certificate authority checked the signer and how well the private key is protected. An electronic signature backed by strong sign-in and audit records can still show who signed.
Do I need a certificate to sign a PDF?
A certificate is needed only for a certificate-based digital signature. Adding an electronic signature to a PDF, such as a typed or drawn signature mark, needs no certificate. The PDF format supports both kinds.
Is a scanned signature an electronic signature?
A scanned image of a handwritten signature placed on a document is a form of electronic signature when the person adopts it intending to sign. A scanned signature is not a digital signature, because it has no cryptographic link to the document's contents. Anyone with the image file could paste it onto another document, so a record of who applied it matters.
Can a will be signed electronically?
Wills are outside the US ESIGN Act, so whether a will can be signed electronically depends on state law. In Australia, wills are governed by state and territory succession laws, each with its own signing and witnessing requirements. Check the law where the will is made before relying on an electronic signature.
What is a certificate authority?
A certificate authority (CA) is an organization that issues digital certificates, each linking a public key to a named person or organization after an identity check. Software trusts a certificate when it can trace it back to a CA it already trusts. Certificates commonly follow the X.509 standard, profiled for internet use in IETF RFC 5280.