Electronic signature or digital signature: what is the difference?

The two things share a name and nothing else

An electronic signature is a mark on a document indicating that you agreed to it: your name drawn with a mouse, typed in a script face, or a photograph of your signature placed on the page. It is the digital equivalent of signing a printed page, it carries intent, and its legal force comes from the context around it rather than from anything technical.

A digital signature is a cryptographic operation. The document is hashed, the hash is encrypted with a private key that only you hold, and the result travels with the file. Anyone can verify two things from it: that the document has not been altered by so much as a byte since it was signed, and that it was signed by the holder of that specific key.

The first says I agree. The second proves this document has not changed and this key signed it. Different problems.

Which do you need?

For nearly everything ordinary people sign: a rental agreement, a permission slip, a delivery note, an invoice, a contractor's quote: an electronic signature is what is being asked for and what is accepted.

In the EU, eIDAS recognises simple electronic signatures and says they may not be denied legal effect merely for being electronic. In the US, the ESIGN Act does the same. Neither requires cryptography for an ordinary agreement. What matters is that you intended to sign, that the other party can show you did, and that the document is kept.

You need a digital signature when a specific regime demands one, qualified electronic signatures under eIDAS for certain instruments, some government filings, some regulated industries, and anywhere a document must be provably unaltered years later. That needs a certificate from a recognised authority, and it is not something a web page can issue you.

What a signing tool actually does

Placing a signature on a PDF means adding drawing instructions to a page: this image, or these vector strokes, at this position, at this size.

Where implementations differ is what happens to the rest of the file.

The careful approach is an incremental update: the original bytes are left exactly as they are and the changes are appended to the end. The old version remains inside the file, which is what makes a chain of signatures verifiable each one covers a known state of the document.

The ordinary approach (and ours) is to load the document, add the signature, and write a new file. The visible result is identical and the pages are copied rather than re-rendered, so nothing is flattened and text stays text. But it is a new file rather than the original plus an appendix, and it is worth knowing which you are getting if you are signing something that will later be checked against its own history.

Why "just print it and scan it back" is worse

The common workaround is: print, sign, photograph, send. It produces a document that is strictly worse in every way.

• Every page becomes a photograph. Nothing is searchable or selectable.
• The file is larger, often by a lot.
• It is skewed, off-colour, and sometimes unreadable in the margins.
• The paper trail runs through a printer that may not be yours.

Placing a signature on the page directly keeps the document a document.

Keeping the signature yours

A signature image is a piece of personal data with an obvious misuse. A drawn or typed one placed by your own browser stays on your machine; one uploaded to a signing service is on their disk, attached to the document it signed and to you.

If you keep a signature image file for reuse, it is worth treating it the way you would a scan of your passport: not in a shared folder, not in an email thread, and not uploaded anywhere that does not need it.