Electronic signature or digital signature? The difference that decides whether it holds up

Three different things called signing

• A mark placed on the page. A drawn signature, a scan of one, or a typed name, positioned onto the PDF as an image or a line of text. The output is a normal PDF with a picture of a signature on it.
• A captured intent to sign. The signer clicks a button in a hosted service, enters a name, and the service records the event along with a timestamp, an email address and an IP address. The visible result may be identical to the first case; the difference is entirely in what was recorded alongside it.
• A cryptographic signature. A mathematical value computed from the document and a private key, embedded in the file. Anyone with the matching public key can verify that the document has not changed since it was signed, and, if the certificate identifies a person, by whom.

What each one actually proves

Why the drawn mark is weak, and when it is still fine

A drawn signature proves nothing on its own, and pretending otherwise would be dishonest. It is an image. Anyone who receives a copy of a signed file can lift the mark and place it on another document, and the result is indistinguishable from the original.

What makes it acceptable anyway is that most signing is not adversarial. Signing a quote, returning a consent form or approving an internal purchase order are acts between parties who already trust each other, where the mark is a formality recorded in a document that also travels with an email thread, an invoice number and a delivery record. The context carries the weight, not the mark.

What improves a drawn signature, if that is the route you take: flatten it so it can no longer be dragged off the page, sign the page that actually carries the signature clause, keep the unsigned original, and keep the surrounding correspondence. None of that makes it evidence of identity. It does make the file harder to misrepresent.

What a digital signature is, technically

A cryptographic signature in a PDF binds three things: the document content, a hash of that content, and a private key. The signer computes the hash, encrypts it with their private key, and stores the result in the file along with their certificate. A reader can recompute the hash and check the result against the public key in the certificate.

Two properties follow. The signature is tamper-evident — change one byte of the document and the verification fails, which is what a drawn mark cannot offer. And the signature is attributable only as far as the certificate goes: a self-issued certificate proves that the file has not changed and nothing more, while a certificate issued by a certificate authority after checking identity ties the signature to a checked person.

There is a third layer most people never encounter: the certificate itself expires, and the technical evidence needed to prove a signature was valid at the time it was made has to be preserved. That is what timestamping and long-term validation profiles exist for, and it is why archives that must verify signatures decades later specify these things explicitly.

The legal layer and the technical layer are separate

This is the part that catches people out. In most legal systems, an electronic signature is defined broadly — broadly enough to include a typed name or a click, in some cases even an email exchange — and the law does not generally require it to be cryptographic. That means a click-to-agree can be a perfectly binding signature while being technically nothing at all.

The European framework layers assurance levels on top of that idea: a simple electronic signature, an advanced one, and a qualified one created with a device issued under an accredited scheme, with only the qualified tier carrying a presumption equivalent to a handwritten signature. In the United States the picture is split between a federal act and state law, with the same broad definition at the core.

The important caveat is that these frameworks exclude categories of documents — wills, certain family matters, some land transactions and court filings appear repeatedly. The exclusions differ between jurisdictions, so the answer is local and, for anything consequential, is a question for a lawyer rather than a PDF tool.

The practical translation: "is it legally binding" usually turns out to be "can I show that this person intended to be bound". Cryptography answers a different question, which is "has this document changed since then".

What actually gets disputed

When signing goes wrong it is rarely the cryptography that is argued about. The disputes are about intent, authority and control: whether the person whose name appears actually agreed, whether they were entitled to sign, and whether the copy in the bundle is the copy that was signed.

That is why e-signature services invest in audit trails rather than in bigger keys. An identity check, a recorded timestamp, an address, and a tamper-evident log of the signing event answer the questions that actually arise. A cryptographic signature with an anonymous certificate answers a question nobody asked.

For a file that only passes between two people who already know each other, the drawn mark plus a kept original plus the email it arrived in is usually the whole record. For anything where the answer to "what would I have if they denied it" is "nothing but the file", the drawn mark is the wrong instrument.

What this site's signing tool does and does not do

Being precise about this matters, because a page that says "sign your PDF" without qualification invites exactly the misunderstanding this article exists to clear up.

The signing tool here does one thing: it captures a drawn mark and places it on the pages you choose as a transparent image object, with the size and position you set. That is it. There is no certificate, no private key, no identity verification, no audit trail, and no log of the signing event. The result is a PDF that carries a mark.

It is suitable for the ordinary case — returning a signed form, approving a document internally, sending back a quote — and unsuitable for the certificate-based case, where the whole point is evidence that survives a challenge. Nothing about the tool's local processing changes that; running it entirely in your browser is a privacy property, not an assurance property.

Choosing, in one question

• Does anyone need to be able to show, later, that this exact file was signed by a specific person? If yes, you need a certificate-based or qualified signature, and no amount of drawing will substitute.
• Does a counterparty name a specific platform, or does the contract specify how it must be signed? If yes, use what is prescribed. A tool cannot argue its way past a contractual requirement.
• Is the document excluded from the ordinary electronic-signature rules where you are? Wills, some family matters, some property transactions. Check locally before assuming anything works.
• Is it an ordinary document between people who already know each other? A properly placed drawn mark, saved into the file and kept alongside the surrounding correspondence, is the ordinary, adequate answer.

One habit worth keeping regardless of which route you choose: never delete the unsigned original. Whatever was added, the file you started from is the simplest evidence that nothing else changed.