A digital signature is a cryptographic value used to verify that a digital document, message, or file came from the holder of a particular private key and has not been altered since it was signed.
Unlike an image of a handwritten signature, a digital signature is generated mathematically. It connects the signed content to a cryptographic key and allows software to test the content for unauthorized changes. In document workflows, digital signatures often work alongside identity verification, consent records, timestamps, and audit trails.
A digital signature can support an electronic signature, but the two terms are not interchangeable. Digital signature describes a security technique. Electronic signature is the broader legal and practical category for electronic actions taken with the intent to sign.
How a digital signature works
A digital signature process generally involves four operations:
- The document is hashed. A cryptographic hash function processes the document and creates a fixed-length value called a hash or message digest. Even a small change to the document should produce a different digest.
- The private key creates the signature. A signature algorithm uses the signer’s private key and the document digest to generate a unique digital signature. The private key must remain under the signer’s control.
- The signature travels with the document. The resulting signature data is attached to or stored with the document. In formats such as PDF, it may also include certificate information and validation data.
- The recipient verifies the signature. Verification software uses the corresponding public key and calculates a new digest from the received document. It then checks whether the signature is mathematically valid for that digest.
If the signed content has changed, the newly calculated digest will no longer match the signature. This provides a strong document integrity check.
The process does not normally encrypt the entire document. A signed file can still be readable by anyone who has access to it unless separate encryption or access controls are applied.
Private keys, public keys, and digital certificates
Digital signatures use asymmetric cryptography, which relies on a related pair of keys:
- The private key is kept secret and is used to create signatures.
- The public key can be shared and is used to verify signatures created with the corresponding private key.
A public key alone does not reliably tell a recipient who owns it. A digital certificate addresses this problem by associating a public key with information about a person, organization, or device.
Certificates are commonly issued by certificate authorities after an identity validation process. The amount of trust a certificate provides depends on how the issuer verified the certificate holder, whether the issuer is trusted, and whether the certificate remains valid.
A self-signed certificate can still support cryptographic verification, but it does not provide the same independent identity assurance as a certificate issued through a trusted public key infrastructure.
What signature verification can establish
A successful verification can establish that:
- The signature corresponds to the public key being checked.
- The document’s signed content has not changed since the signature was generated.
- The corresponding private key was used to create the signature.
- A certificate, if present and trusted, associates the public key with a stated identity.
Verification does not automatically prove that a particular person personally performed the signing action. A private key could be shared, stolen, or used by an automated system. Reliable attribution also depends on key protection, certificate validation, and appropriate signer authentication.
Validation software may also examine the certificate’s issuer, expiration period, permitted uses, trust chain, revocation status, and any trusted timestamp included with the signature.
Digital signature vs. electronic signature
| Aspect | Digital signature | Electronic signature |
|---|---|---|
| Core meaning | A cryptographic technique for authenticating data and detecting changes | An electronic sound, symbol, or process used with the intent to sign |
| Main focus | Integrity, key-based authenticity, and tamper detection | Consent, approval, or intent to sign |
| Common forms | Certificate-based PDF signatures, signed software, signed email | Typed names, drawn signatures, approval clicks, signature images, or digital signatures |
| Cryptography required | Yes | Not always |
| Relationship | Can secure or support an electronic signature | May use a digital signature, but does not have to |
A signature box showing someone’s name may be an electronic signature without being a digital signature. Conversely, a digital signature used to authenticate software code may not represent anyone’s intent to enter a legal agreement.
Contracts, invoices, and software use signatures differently
Consider a contract signed through an online workflow. The signer selects an approval action, which may serve as the electronic signature and record intent. The system can then apply a digital signature to the finalized document, making later changes detectable.
A company may also digitally sign an invoice before sending it. The recipient can verify that the invoice matches the version signed by the certificate holder. This does not independently prove that the recipient accepted the invoice or agreed to its terms.
Digital signatures are also used for software releases, government filings, email, and internal approvals. In these cases, the primary purpose may be authentication and integrity rather than agreement formation.
A valid signature does not mean every statement inside the document is true. It means the signature is cryptographically consistent with the signed content and the key used. Similarly, an invalid result does not always prove fraud. It can result from an altered file, an untrusted certificate, missing validation information, unsupported software, or a damaged signature.
Some document formats also allow specific changes after signing. Whether those changes invalidate the signature depends on what was signed, how the format records revisions, and which modifications the signer permitted.
Legal effect depends on more than cryptography
Digital signatures can provide strong evidence of authenticity and integrity, but legal enforceability depends on the complete transaction.
In the United States, federal and state electronic signature frameworks are generally technology-neutral. They focus on matters such as intent, consent, attribution, and record retention rather than requiring one specific cryptographic method.
In the European Union, eIDAS distinguishes among electronic signatures, advanced electronic signatures, and qualified electronic signatures. Digital signature technology often supports the higher-assurance categories, but using cryptography alone does not automatically make a signature advanced or qualified.
Requirements vary by jurisdiction, document type, industry, and transaction. This information is educational and is not legal advice.
FAQ
Is a digital signature the same as a scanned signature?
No. A scanned signature is an image and can be copied without built-in cryptographic protection. A digital signature is generated with a private key and can be verified with the related public key.
Does a digital signature prevent someone from editing a document?
It does not necessarily block editing. Instead, it makes changes to signed content detectable during verification. Some formats may permit limited, clearly recorded changes.
Does a digital signature prove who signed?
It proves that the corresponding private key created the signature. Connecting that key to a person depends on the certificate, identity checks, key security, and surrounding signing records.
Can a digital signature be legally binding?
It can support a legally binding electronic signature, but cryptographic validity alone is not enough. Intent, consent, attribution, document requirements, and applicable law also matter.
Can a digital signature expire?
The signature data does not simply disappear, but the associated certificate has a validity period. Trusted timestamps and preserved validation information may help establish that the signature was created while the certificate was valid.