How electronic signatures work

The mechanics, end to end, with the parts that are cryptography separated from the parts that are just process.

"Electronic signature" describes an outcome, not a mechanism. Two products can both produce one and share almost no machinery. Here is what happens in a system built around evidence.

The sequence

1. The document is uploaded and its shape is read once. Page count and page sizes are recorded at upload, so everything afterwards compares numbers instead of re-parsing a file somebody else supplied.
2. Fields are placed. A signature block, a date, a text field — each one belongs to exactly one recipient, on one page, at one position.
3. Recipients are added, with an order and an assurance level. Order decides who is asked when. Assurance decides how hard it is to prove you are the person named.
4. The document is frozen and the envelope is sent. From this point the bytes cannot change. A version that could be edited after sending would make every signature on it meaningless.
5. Each recipient is invited with a link that is a credential. No account, no password. The link identifies one person, for one envelope, and a resend replaces it rather than adding a second live key.
6. They authenticate to the level required. That might be nothing beyond holding the link, or a one-time passcode, or a third-party identity check.
7. They consent, fill their fields, and complete. Consent to transact electronically is recorded as its own event, because several regimes require it.
8. When the last required person finishes, the envelope is sealed. The completed state is hashed, and that hash is what the certificate carries.
9. The executed copy is produced and distributed. Signature blocks are stamped into the document, and everyone who took part gets a copy.

Where the cryptography actually is

Less of this is cryptographic than the marketing suggests, and being clear about which parts are is the difference between a defensible claim and an overreach.

• Hashing is used throughout: the uploaded bytes, each event in the trail, the completed state. A hash proves two files are the same file. It proves nothing about who made them.
• Chaining makes the trail tamper-evident: each event covers the one before it, so a removed or edited event breaks everything after it.
• A digital signature — public-key cryptography binding a document to a certificate issued to an identity — is a distinct thing, and most e-signature products do not apply one to the document by default. See digital signature for why the two terms get conflated.

What makes a signature defensible in practice is usually not cryptography at all. It is the completeness of the record: who was asked, what they were shown, what they did, when, and how they were identified.

Stamping is not sealing

A subtle point worth stating, because it is a real failure mode. Drawing the signature onto the PDF page and recording that the signature happened are two operations, and they must not depend on each other.

Reading an untrusted PDF is one of the more dangerous things a document system does. If stamping sits on the path that decides whether a signature counts, then a malformed file can invalidate a real agreement. Sealing should happen first, from the recorded facts; stamping is a rendering step afterwards, and a failed stamp must never unmake a signature.

What you should be able to do afterwards

• Download an evidence package and open it without the vendor's software.
• Re-compute the completion hash from the certificate and get the same value.
• Check the event chain for gaps or edits.
• Hand all of that to a third party who has no account with anyone.

Last reviewed 2026-09-18. Pactlyra produces a detailed evidence record for every completed document. Electronic signature validity depends on your jurisdiction, the document type, and how the transaction is carried out; nothing here is legal advice.