What is a digital signature?
A digital signature uses public-key cryptography to show who controlled a signing key and whether signed data changed.
A digital signature is a cryptographic value created from data and a private key. A verifier uses the matching public key to check whether the signature is valid and whether the data has changed. NIST's Digital Signature Standard specifies approved signature algorithms and describes digital signatures as a way to detect unauthorized changes and authenticate the claimed signatory.
A digital signature is not the same thing as an electronic signature. The first describes a cryptographic mechanism; the second describes an electronic act used with intent to sign. A digital signature can support an electronic-signature process, but cryptographic validity alone does not establish intent, authority, consent or document eligibility.
Digital signature vs electronic signature
| Question | Electronic signature | Digital signature |
|---|---|---|
| What is it? | An electronic sound, symbol or process used with intent to sign | A cryptographic value created with a private key and checked with a public key |
| What does it primarily show? | The signer's signing act when supported by the transaction record | That a key produced the signature and that the signed data has not changed |
| Does it require PKI? | No | Common certificate-based implementations use public-key infrastructure |
| Can it be a typed or drawn name? | Yes, when the legal and process requirements are met | No; the visible mark is separate from the cryptographic signature |
| Does it prove legal validity by itself? | No; applicable law and the transaction still matter | No; key control and file integrity are only part of the evidence |
How PKI works in five steps
- Create a key pair. The signer or a trusted system creates a private key and a mathematically related public key. The private key must remain protected.
- Bind the public key to an identity. In certificate-based PKI, a certificate authority issues a certificate after applying its identity-validation process. NIST notes that certificates are one method of associating an identity with a public key.
- Hash the document. A hash function produces a fixed-length fingerprint of the exact bytes being signed.
- Create the signature. The signing algorithm uses the private key and the document digest to produce the digital signature.
- Verify it. A verifier checks the signature with the public key, validates the certificate and trust path when applicable, and compares the document digest. A changed file or invalid signature fails verification.
The signature does not encrypt the document. NIST distinguishes signing for authenticity and integrity from encryption for confidentiality.
Examples
- A software publisher signs a release so customers can check that the package came from the holder of the signing key and was not modified in transit.
- A person applies a certificate-based signature to a PDF so a PDF reader can validate the certificate and report later changes.
- An e-signature service seals a completed agreement or evidence record so independent verification can detect alteration after completion.
Pactlyra's free signature generator produces an image, not a cryptographic digital signature. In Pactlyra's document flow, the visible signing act is recorded with consent and transaction events, while hashes and a tamper-evident evidence package protect the completed record. See how electronic signatures work for the whole process.
Legal status in the United States and European Union
In the United States, the ESIGN Act says a signature or contract cannot be denied legal effect solely because it is electronic. It preserves other requirements and does not force a person to accept electronic records. Read 15 U.S.C. §7001.
In the European Union, eIDAS Article 25 says an electronic signature cannot be denied legal effect or admissibility solely because it is electronic or is not qualified. A qualified electronic signature has the equivalent legal effect of a handwritten signature. That status depends on the eIDAS requirements; an ordinary digital signature is not automatically qualified.
Frequently asked questions
What is a digital signature in simple terms?
It is a mathematical check attached to data. The signer creates it with a private key; another person checks it with the matching public key to detect changes and confirm which key signed.
Is a digital signature the same as an electronic signature?
No. A digital signature is a cryptographic mechanism. An electronic signature is an electronic act performed with intent to sign. A signing process may use both.
Does a digital signature prove who signed?
It proves control of a private key at signing time. Connecting that key to a person depends on certificate issuance, identity checks, key protection and the surrounding evidence.
Can a digital signature be copied to another document?
Not as a valid signature. Because verification covers the signed data, copying the signature value to different data will fail verification.
Can I try Pactlyra's signing flow before paying?
Yes. Start a 7-day trial to send a document through the evidence-backed signing flow. Signers do not need an account.
Last reviewed 2026-10-15. Pactlyra produces a detailed evidence record for every completed document. Electronic signature validity depends on your jurisdiction, the document type, and how the transaction is carried out; nothing here is legal advice.