Electronic signatures vs digital signatures

Electronic signature: a legal idea

'Electronic signature' is a legal category, defined broadly so it does not depend on any technology. Under the US ESIGN Act (15 U.S.C. 7006) it is 'an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record'. The EU's eIDAS Regulation (Article 3(10)) defines it as data in electronic form attached to other data and used by the signatory to sign.

That covers a drawn signature in a box, your name typed at the bottom of an email, a click on 'I agree', or a PIN typed at a till. On its own, an electronic signature says nothing about whether the document was altered later or who really made it. Those questions are answered by the surrounding evidence.

Digital signature: a technology

A digital signature uses public key cryptography. The software calculates a hash, a fingerprint, of the document, and encrypts that hash with a private key. Anyone can check it using the matching public key, which comes in a certificate issued by a certificate authority. If a single byte of the document changes, the hash no longer matches and the signature shows as broken.

In PDFs, digital signatures follow standards such as PAdES (ETSI EN 319 142), which also allow a trusted timestamp from an independent timestamp authority, proving the file existed in that form at that moment. Open a digitally signed PDF in Adobe Acrobat Reader and the Signature panel shows who sealed it and whether it has been modified since.

SES, AES and QES under eIDAS

EU law (Regulation (EU) No 910/2014, as amended by Regulation (EU) 2024/1183) sets three levels. The UK kept the same structure after Brexit.

• Simple electronic signature (SES): any electronic signature. Article 25(1) says it cannot be denied legal effect or admissibility in court solely because it is electronic.
• Advanced electronic signature (AES): meets the four requirements in Article 26: uniquely linked to the signer, capable of identifying them, created with data the signer controls with a high level of confidence, and linked to the signed data so any later change is detectable.
• Qualified electronic signature (QES): an AES created by a qualified signature creation device and based on a qualified certificate from a trust service provider on an EU trusted list. Article 25(2) gives it the same legal effect as a handwritten signature, and it is recognised in every member state.

Where Sign PDF fits

Signers using Sign PDF create a simple electronic signature: they draw, type or upload it after confirming a code sent to their email. When everyone has signed, we seal the whole PDF with a digital signature in PAdES style and add an independent timestamp from DigiCert's timestamp authority. The seal protects the document and the certificate of completion; it is our seal, not a personal certificate for each signer.

That means we do not offer advanced or qualified electronic signatures in the eIDAS sense, and we do not verify ID documents. For most commercial contracts in the EU and UK an SES with a strong audit trail is what is used in practice. Where a law or a counterparty requires a QES, use a qualified trust service provider instead.

Which one do you need?

For ordinary contracts, NDAs, leases, offer letters and consent forms, an electronic signature with good evidence and a tamper-evident seal is normally enough. A QES is worth the extra cost and identity checks where a statute or regulator demands it, for some public procurement, certain company filings in parts of the EU, or when the other side insists. Requirements differ by country and document; this is general information, not legal advice.