Electronic signature: a legal concept
Laws define an electronic signature by its purpose and leave the method open. In the EU, Article 3(10) of eIDAS calls it data in electronic form that is attached to or logically associated with other electronic data and used by the signatory to sign. In the US, the ESIGN Act (2000) and UETA give electronic signatures legal effect for most transactions, with exceptions such as wills and some family law and court documents.
A typed name, a signature drawn with a finger, a click on a Sign button and a digital signature can all be electronic signatures. In a dispute, what matters is whether you can show who signed and what exactly they signed.
Digital signature: a cryptographic technique
A digital signature uses a key pair. The private key signs a hash of the document, a short fingerprint computed from its bytes. Anyone can check the signature with the matching public key. If a single byte of the signed content changes, the check fails.
The public key alone does not say whose it is. A certificate does that: a certificate authority (CA) signs a statement that this key belongs to a given name or email address. How much that statement is worth depends on how the CA checked the person before issuing it. For PDF files, the standard format is PAdES, which Adobe Acrobat and Reader can check.
| Electronic signature | Digital signature | |
|---|---|---|
| What it is | A legal category | A cryptographic method |
| Defined by | Laws such as eIDAS, ESIGN and UETA | Technical standards, such as PAdES for PDF |
| Example | A drawn signature with an event log | A key and a certificate embedded in the PDF |
| Shows later changes to the file | Not by itself | Yes, any change to the signed content breaks the check |
| Identifies the signer | Depends on the evidence around it | As far as the CA checked the signer's identity |
Why a picture of a signature proves little
An image of a handwritten signature placed in a PDF can count as an electronic signature, but on its own it carries almost no evidence. Anyone can copy it from one file to another, and nothing in the file records who placed it, when, or whether the text around it changed afterwards.
The signature generator on this site makes exactly this kind of image. It is useful for an email footer or a document you print and sign by hand, but it does not sign anything. To become evidence, a signature needs a record of how it was made and, ideally, a digital signature over the file.
What a SignClearly PDF carries
A PDF signed with SignClearly combines a visible signature with cryptographic protection.
The drawn signature
The signer draws their signature in the browser, after agreeing to sign electronically and reviewing the final PDF exactly as it will be signed. SignClearly places the signature, the date and the full name on the original pages and adds a certificate page at the end with the SHA-256 of the original file and the event log. This is the electronic signature in the legal sense. Without an ID check, its level is a simple electronic signature (SES); the guide on SES, AES and QES explains the levels.
The signer's digital signature
The signer also signs the file with a one-time key (ECDSA P-256) created in their browser. SignClearly's own certificate authority issues a certificate for that key, valid for 24 hours and for this one signature. The certificate carries the signer's email address. The format is PAdES; with a timestamp from an RFC 3161 time-stamping authority (DigiCert), the level is PAdES-B-T.
When the sender requires an ID check, the certificate also carries the name from the signer's ID.
The platform seal
After signing, SignClearly adds a platform seal: a digital signature over the final file, certificate page included, with a certificate from SignClearly's CA. It shows that the file has not changed since SignClearly sealed it. It is the signature of the platform, not of a person.
Adobe Acrobat and Reader check the digital signatures in the file and show whether it changed after signing. SignClearly's CA is not on the Adobe Approved Trust List (AATL) or the EU trusted lists, so Adobe shows the identity as unknown until the reader trusts the SignClearly root once on their computer. The guide to that warning and the verification page show how.
Which one you need
- For many everyday documents, such as a photo release or a quote acceptance, the law sets no specific form, and a drawn signature with a solid event log is a common choice.
- If the other party will open the file in Adobe or wants proof that nothing changed after signing, a digital signature in the PDF gives them a check they can run themselves.
- If the law requires a qualified electronic signature (QES), neither a drawn signature nor a digital signature from a non-qualified CA is enough. SignClearly does not offer QES.