The two terms get used interchangeably and mean genuinely different things. The confusion is harmless right up until the moment a counterparty says "we need a digital signature" and you send them a picture of your name — at which point it costs you a day.
The short version: electronic signature is a legal category covering any mark showing intent to sign. Digital signature is a specific cryptographic technology. Every digital signature is an electronic signature; almost no electronic signatures are digital signatures.
Electronic signatures
An electronic signature is any electronic mark or process indicating agreement. That includes typing your name into a field, drawing it with a mouse or finger, placing an image of your handwritten signature, clicking "I agree", and in some contexts replying "yes, agreed" to an email.
The law defines these functionally rather than technically. What matters is intent to sign, consent to transact electronically, attribution to a person, and a retainable record — not what the mark looks like or how it was made. Under the US ESIGN Act, EU eIDAS, and equivalents worldwide, electronic signatures cannot be denied legal effect merely for being electronic. See is it legal to sign documents electronically?.
What an electronic signature does not do is prove anything cryptographically. A signature image is a picture. It does not verify who applied it, and it does not detect changes made to the document afterwards. Its evidential weight comes from the circumstances around it — the email trail, the timestamps, the parties' subsequent conduct.
In practice that context is usually abundant, disputes are rare, and this is what the overwhelming majority of business signing runs on.
Digital signatures
A digital signature uses public key cryptography. The mechanism:
- The signing software computes a hash — a fixed-length fingerprint — of the document.
- It encrypts that hash with the signer's private key, held on their device or a secure token.
- The encrypted hash and the signer's certificate are embedded in the PDF.
When someone opens the file, their reader decrypts the hash using the public key from the certificate, independently recomputes the document's hash, and compares. If they match, the document is unchanged since signing and the signature belongs to the certificate holder. If a single byte has changed, they do not match and the reader reports the signature as invalid.
The certificate comes from a Certificate Authority that verified the signer's identity before issuing it, which is what connects the mathematics to a real person. Readers display a validity indicator and the verified signer name.
Two properties follow that electronic signatures cannot provide: tamper evidence, because any modification breaks the signature, and cryptographic identity, because the certificate is bound to a verified individual.
At a glance
| | Electronic signature | Digital signature | |---|---|---| | What it is | A legal category | A specific technology | | Mechanism | Any mark showing intent | PKI and certificates | | Identity | Inferred from context | Verified by a CA | | Tamper detection | None | Yes, cryptographic | | Cost | Free | Certificate, often paid | | Setup | None | Obtain and install a certificate | | Typical use | Everyday agreements | Regulated and high-value |
Which you need
An electronic signature is right for NDAs, service agreements, freelance contracts, rental agreements, consent forms, internal approvals, onboarding paperwork, and the vast majority of documents anyone signs in a given year. It is legally valid, immediate, and free.
Docento.app produces electronic signatures: draw, type, or upload, place it on the page, export. No account, and the document is processed on your own machine. See how to sign a PDF online.
A digital signature is required when a counterparty or authority specifies one, for many government filings and tax submissions, for certain court documents, in regulated contexts such as 21 CFR Part 11 for pharmaceutical and medical records, and where EU qualified electronic signature status is needed — the eIDAS tier that carries automatic legal equivalence to handwriting across member states.
A middle option exists and is what most businesses actually use for important agreements: an e-signature platform such as DocuSign or Dropbox Sign. These apply an electronic signature but wrap it in an audit trail — email verification, timestamps, IP addresses, a record of who opened what and when — and typically seal the completed document with a certificate. You get most of the evidential strength without each signer needing their own certificate.
Getting a certificate
If you do need a digital signature, you need a certificate. Options run from free self-signed certificates, which provide tamper evidence but no verified identity and will show as untrusted in most readers, through commercial certificates from a CA, to qualified certificates from an EU trust service provider for QES. Many governments also issue citizen certificates via national ID cards, which is the normal route in much of Europe.
The practical friction is real: certificates cost money, expire, must be installed, and can be lost. That friction is precisely why electronic signatures dominate everyday use, and why they should — using a qualified signature for an NDA is like notarising a shopping list.
The practical rule
Ask what the receiving party requires. If they have not specified, an electronic signature on a PDF is almost certainly sufficient and is what they expect. Keep the email trail, keep your copy, flatten it before sending so nothing can be altered afterwards, and get on with your day.
