Digital signature vs electronic signature: the difference

An electronic signature is a legal concept: any data in electronic form that a person uses to sign. A digital signature, in everyday English, is a technique: a cryptographic code attached to a file, created with a private key and checked with a certificate. Every digital signature used to sign is an electronic signature, but most electronic signatures are not digital signatures. Here is how the two terms relate, how they fit the eIDAS levels and what each one looks like in practice.

Electronic signature: the legal term

In the EU the term is defined by Regulation (EU) No 910/2014, known as eIDAS. Article 3(10) calls an electronic signature "data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign". The definition says nothing about technology. A typed name at the end of an email, a ticked box, a signature drawn with a finger and a click confirmed with a one-time code can all qualify. Under Article 25(1), none of them can be denied legal effect or admissibility as evidence just because it is electronic.

Digital signature: the technique

A digital signature is built with public-key cryptography. In outline:

1. The software calculates a fingerprint (a hash) of the document: a short value that changes completely if a single character of the file changes.
2. The fingerprint is signed with a private key held only by the signer, or by a device or service acting under their control.
3. A certificate, issued by a certification authority, links the matching public key to a name.
4. Anyone can then check, with the public key, that the signature matches the document and that the certificate was valid when the document was signed.

What this proves is technical: the file has not changed since it was signed, and it was signed with the key named in the certificate. Who held the key, and whether they meant to sign, are questions of law and evidence. The European Commission notes that public-key infrastructure, with certificates and cryptographic keys, is the most commonly used technology for meeting the requirements of an advanced electronic signature.

How the two terms map onto the eIDAS levels

• Simple electronic signature (SES). It may or may not involve a digital signature. Many online signing platforms record a click or a one-time code and then protect the finished file with a cryptographic signature or seal of their own.
• Advanced electronic signature (AES). It must be uniquely linked to the signer, capable of identifying them, created with data under their sole control and linked to the signed data so that any later change is detectable (Article 26). Digital signatures are the usual way to meet the last requirement.
• Qualified electronic signature (QES). An advanced signature created by a qualified signature creation device and based on a qualified certificate (Article 3(12)). Because it always rests on a certificate, every QES is a digital signature in the technical sense.

The reverse does not hold: a digital signature is not automatically advanced or qualified. If you create a self-signed certificate in a PDF reader, the result is a digital signature that shows whether the file changed, but no one has verified the name inside the certificate.

Is a digital signature the same as an electronic signature?

Not quite. A digital signature used by a person to sign is one kind of electronic signature: the cryptographic kind. The electronic signature is the wider legal category, which also covers signatures with no cryptography at all. In everyday use, "digital signature" often means a certificate-based signature and "e-signature" everything else: a useful shorthand, as long as you remember that eIDAS itself only knows the three levels of electronic signature.

Where "digital signature" is a legal term

Some national laws use the words for a specific legal object. In Italy, the Digital Administration Code defines the firma digitale as a particular type of qualified signature based on a pair of cryptographic keys, one public and one private (Article 1(1)(s)), and requires a qualified certificate that is not expired, revoked or suspended at the time of signing (Article 24(3)). An Italian counterparty who asks for a firma digitale is therefore asking for a qualified signature, created on a smart card, a USB token or through a remote signing service. Check what is meant before you choose a tool.

Seals: digital signatures from organisations

A platform may apply its own digital signature to the finished PDF. When it is created by a legal person to ensure the origin and integrity of data, eIDAS calls it an electronic seal (Article 3(24) and (25)), and a qualified electronic seal enjoys a presumption of the integrity of the data and of the correctness of its origin (Article 35(2)). A PDF reader lists a seal in its signature panel much like a signature, which is why the two are often confused. The seal protects the document; it does not turn the signer's signature into a qualified one.

Examples of each

• A typed name at the end of an email. An electronic signature, not a digital signature.
• Signing on a platform with a one-time code, with the platform's qualified seal on the PDF. A simple electronic signature, or an advanced one if the process meets Article 26. The seal is a digital signature of the platform, not of the signer.
• Signing with a qualified certificate on an identity card or through a remote qualified signature service. A qualified electronic signature, and a digital signature too.
• A self-signed certificate created in a PDF reader. A digital signature. Whether it is more than a simple electronic signature depends on Article 26, which is hard to show when nobody verified the name in the certificate.

Which one do you need?

Ask the legal question first: does a law require a particular form for this document? Most agreements have none, and a simple or advanced electronic signature backed by good evidence is usually proportionate. Where the law requires a qualified signature, you need one, and it will be a digital signature by nature. Our guide to the three eIDAS signature levels sets out the requirements of each, and our introduction to electronic signatures explains what happens when you sign online.

Where DOCUJET fits

DOCUJET offers the simple electronic signature on every plan and, from Business, the advanced electronic signature (AES) with identity verification. From Starter upwards the signed PDF also carries a qualified electronic seal and a qualified time stamp from Namirial, in PAdES format, so you can check them in a PDF reader or with the European Commission's DSS validation demo. DOCUJET does not offer qualified electronic signatures, and therefore not the Italian firma digitale either. The pricing page shows what each plan includes.

Sources: Regulation (EU) No 910/2014 (eIDAS), Articles 3, 25, 26 and 35; European Commission, What is eSignature; Digital Administration Code, Article 1, Article 24; European Commission, DSS validation demo.

Ready to try it?Open a free account: 3 documents a month, forever, with a complete audit trail.Start for free →