Digital signature

What does Digital signature mean?

A digital signature is a cryptographic mechanism that uses a pair of keys, one private and one public, to prove who signed a piece of data and that the data has not been altered since. People often use "digital signature" and "electronic signature" interchangeably, but in technical and legal writing the digital signature is a narrower, math-based subset of the broader category.

Here is how it works. The signer's software computes a hash of the document, a short fingerprint produced by a function such as SHA-256, and then transforms that hash with the signer's private key. Anyone holding the matching public key can reverse the transformation and compare the result with a fresh hash of the document. If they match, the document is unchanged and the signature was made with that private key.

The public key alone does not say whose key it is. That link comes from PKI, the system of certificate authorities that issue digital certificates binding a public key to a named person or organization. When a PDF reader shows a green tick and a signer's name, it has checked the signature against a certificate chain it trusts.

Picture a procurement team at a mid-sized manufacturer that receives signed supplier contracts from a government agency. The agency's PDFs carry certificate-based digital signatures, so the team's reader can confirm the file came from the agency's signing certificate and that nobody edited the pricing table in transit.

The biggest misconception is that a digital signature is automatically more legally valid than other electronic signatures. Under the ESIGN Act and UETA, US law is technology-neutral, so a typed name with good evidence can be just as enforceable. In the EU, digital signatures are the usual technical basis for advanced and qualified electronic signatures under eIDAS, but it is the qualified level, not the cryptography itself, that carries special legal presumptions. Another mix-up: digital signatures are not encryption. The document stays readable; the signature only proves origin and integrity.

Our take: digital signatures are excellent technology, and certificate-based signing makes sense in regulated or cross-border settings. For most contracts between small businesses and their customers, though, the practical question is evidence, and a clear audit trail plus a verifiable document hash covers most of what people actually need to prove.

At eSignSimple we do not issue certificate-based digital signatures today. We record a SHA-256 hash of each completed file and publish a /verify page where anyone can check that a copy matches the original, alongside an audit trail and certificate of completion. Certificate-backed signing sits on our roadmap rather than in the current product.

What is an example of digital signature?

An architecture firm receives a signed building permit decision from a city office as a PDF. When the project manager opens it in a PDF reader, a banner shows the city's signing certificate and confirms the file has not changed since it was signed. If a contractor later edited a date in that PDF, the reader would flag the signature as invalid. eSignSimple does not apply certificate-based signatures like this; it records a SHA-256 hash of the final file instead.

What happens when a PDF reader checks a digital signature?

A signed PDF stores the signature in a special field that covers a defined byte range of the file, meaning every byte except the space reserved for the signature itself. When you open the file, the reader recomputes the hash of that byte range, uses the public key in the signer's certificate to check the signature value, and confirms the two match. That proves the covered bytes have not changed since signing.

The reader then checks the certificate. It walks the chain from the signer's certificate up to a root it trusts, checks that none of the certificates were revoked (through an online revocation service or a downloaded revocation list), and looks for a trusted timestamp showing when the signature was made. Only if all of these pass does it show a clean, valid status. Each step can fail independently, which is why the same file can look valid on one computer and questionable on another.

Why does my PDF say the signature validity is unknown?

The most common reason is trust, not tampering. If the signer's certificate chains to an authority your reader does not trust, the reader can confirm the file is intact but cannot vouch for who signed it, so it reports the status as unknown. The fix is to check the certificate details and, if it comes from a legitimate provider, enable the relevant trust list in your reader rather than trusting the individual certificate blindly.

Other causes: the reader could not reach the revocation service because you were offline; the certificate has since expired and the signature carries no trusted timestamp proving it was made while the certificate was valid; or someone added content after signing. Filling in a form field or adding a comment can be allowed after signing, and readers usually list these as later changes rather than marking the signature invalid. If the reader says the document was altered in a way the signature does not permit, treat that as a real warning and ask for a fresh copy from the source.

Digital signature vs recorded hash: what does each prove?

Both rest on the same building block, a hash of the file. A digital signature wraps that hash in the signer's private key and certificate and stores the result inside the PDF, so the proof travels with the file and any reader can check it offline. A recorded hash, the approach eSignSimple uses, stores the fingerprint on the platform when the document is completed; anyone can check a copy against it on our /verify page, without special software or certificates.

The difference is about identity and independence. A certificate-based signature says this key, issued to this named person after some identity check, signed these bytes. A recorded hash says this exact file was completed on this platform, and the audit trail says who acted and when. For routine contracts the second is usually all a dispute needs. For documents where a law asks for certificate-backed identity, it is not a substitute. Our page on tamper-evident seals covers how platforms lock finished files.

Which terms are related?

• Electronic signature: An electronic signature is any electronic sound, symbol or process attached to a record and adopted by a person with the intent to sign it.
• Advanced electronic signature (AES): An advanced electronic signature is uniquely linked to and identifies the signer, is under their sole control and detects later changes to the data.
• Document hash: A document hash is a fixed-length fingerprint computed from a file's contents; any change to the file produces a different hash.
• SHA-256: SHA-256 is a cryptographic hash function from the SHA-2 family that turns any file into a unique 256-bit fingerprint used to detect tampering.
• Public key infrastructure (PKI): PKI (public key infrastructure) is the system of certificate authorities, digital certificates and key pairs that binds public keys to real identities.