What are digital signatures & how do they work?

Digital signature vs electronic signature

Electronic signatures, commonly referred to as e-signatures, are a broad set of solutions that use an electronic process for accepting a document or transaction with a signature. As documents and communication are increasingly paperless, businesses and consumers worldwide have embraced the speed and convenience of these types of signatures. But there are many different types of electronic signatures, each allowing users to sign documents digitally and offering some degree of identity authentication.

Digital signatures are a specific type of electronic signature and are the most secure type available. Digital signatures rely on PKI certificates issued by a Certificate Authority (CA). Before issuing a document signing certificate, the CA verifies the signer’s identity through a verification process. This process may involve documentation checks, organizational verification, or other procedures depending on the certificate type, organization validation (OV) or extended validation (EV). Other, less secure e-signature types may use common electronic authentication methods to verify the identity of the signer, such as an email address, a corporate username/ID, or a phone number/PIN.

As a result of different technical and security requirements, electronic signatures vary in industry, geographic, and legal acceptance. Digital signatures comply with the most demanding regulatory requirements, including the United States Federal ESIGN Act and other applicable international laws.

How do digital signatures work?

Digital signatures use PKI, which is considered the gold standard for digital identity authentication and encryption. PKI relies upon the use of two related keys, a public key and a private key, to encrypt and decrypt a message using strong public key cryptography algorithms. The signature is generated using the signer’s private key, which securely binds their identity to the document. A timestamp may also be applied to record when the document was signed and help preserve its validity over time.

Here is how sending a digital signature works:

1. The sender selects the file to be digitally signed in the document platform or application.
2. The sender’s computer calculates the unique hash value of the file content.
3. This hash value is encrypted with the sender’s private key to create the digital signature.
4. The original file, along with its digital signature, is sent to the receiver.
5. The receiver opens the file in a compatible application, which recognizes that the file has been digitally signed.
6. The receiver’s computer then decrypts the digital signature using the sender’s public key.
7. The receiver’s computer then calculates the hash of the original file and compares the hash it has computed with the now decrypted hash of the sender’s file to confirm the file has not been altered.

What security protections do they provide?

Digital signatures provide three critical security assurances:

• Authentication of the signer’s identity,
• Data integrity to confirm the document has not been altered
• Non-repudiation, meaning the signer cannot later deny approving the document

Together, these protections help organizations reduce fraud, meet compliance requirements, and conduct secure digital transactions with confidence.

How do organizations obtain a digital signature certificate?

The process to create a digital signature is easy and straightforward for both independent professionals and enterprises to adopt. You first need a digital signing certificate, which can be acquired through a trusted Certificate Authority, like Sectigo. After completing the purchase and issuance process, you can then download and install the certificate. Next, you simply use the digital signing function of the appropriate document platform or application. 

For example, most email applications provide a “Digitally Sign” button, while Microsoft Word documents may show a signature button once a signature line has been added.

How recipients verify a digitally signed document?

When sending out a document signed using a private key, the receiving party obtains the signer’s public key to verify the digital signature. Once the document is decrypted, the receiving party can view the unaltered document as the user intended. If the receiving party cannot verify the document using the public key, then it signifies that the document has been altered, or even that the signature doesn’t even belong to the original signer.

Why protecting the private key is critical?

Digital signature technology requires all involved parties to trust that the individual creating the signature has been able to keep their own private key secret. If someone else has access to the signer's private key, that party could create fraudulent digital signatures in the name of the private key holder.

What happens if a signed document is changed?

If either the sender or receiver alters the file after it has been digitally signed, the document’s hash value changes. When the recipient’s system compares the newly updated hash with the original signed hash, any mismatch reveals that the document has been modified. In this case, the digital signature is marked as invalid, alerting users to potential tampering.

What does a digital signature look like?

Since the heart of a digital signature is the PKI certificate, which is software code, the digital signature itself is not inherently visible. However, document platforms may provide easily recognizable proof that a document has been digitally signed. This representation and the certificate details shown varies by document type and processing platform. For example, an Adobe PDF displays a visual indicator such as a seal icon or blue ribbon at the top of the document, showing the signer’s name and the certificate issuer.

Additionally, it can appear on a document in the same way as signatures are applied on a physical document and can include an image of your physical signature, date, location, and official seal.

Digital signatures can also be invisible, though the digital certificate remains valid. Invisible signatures are useful when the type of document typically does not display the image of a physical signature, like a photograph. The document’s properties may disclose the information about the digital certificate, the issuing CA, and an indication of the document’s authenticity and integrity.

If a digital signature is invalid for any reason, documents display a warning that it is not to be trusted.

Why are they important?

As more business is conducted online, agreements and transactions that were once signed on paper are now handled through fully digital workflows. This shift increases the need to verify identity and ensure documents have not been altered. Digital signatures provide that trust by authenticating the signer and protecting documents from tampering or fraud.

They also support faster, more efficient workflows. Documents can be signed securely from any device, shared instantly, and tracked through completion with clear audit trails. Because the signature is embedded within the file, it remains intact and verifiable wherever the document is sent.

Beyond large organizations, digital signatures are equally valuable for independent professionals, consultants, and small businesses who need a simple, trusted way to sign contracts, agreements, and client documents without complex infrastructure. Solutions designed for individuals make it easy to establish credibility and maintain secure, compliant workflows.

It is vital these digitally signed agreements are recognized from a legal standpoint. Digital signatures support compliance with important standards like the United States Federal ESIGN Act, GLBA, HIPAA/HITECH, PCI DSS, and US-EU Safe Harbor.

Common digital signature use cases

Today, digital signatures are commonly used across a wide range of business processes to improve the security, integrity, and efficiency of critical transactions that are now handled digitally, including:

• Contracts and legal documents: Digital signatures are legally binding. Thus, they are ideal for any legal document requiring an authenticated signature by one or more parties and assurance that the document has not been modified.
• Sales agreements: By digitally signing contracts and sales agreements, both the seller and the buyer identities are authenticated, and both parties have peace of mind that the signatures are legally binding and that the terms and conditions of the agreement have not been altered.
• Financial documents: Financial departments digitally sign invoices so that customers trust the payment request is coming from the proper seller, not a bad actor trying to scam the buyer into sending payment to a fraudulent account.
• Healthcare data: In the healthcare industry, data privacy is paramount for both patient records and research data. Digital signatures ensure that this sensitive information has not been altered when shared between consenting parties.
• Government forms: Government agencies at the federal, state, and local level have stricter guidelines and regulations compared to many private sector businesses. From approving permits to clocking in on a timesheet, the signatures can streamline productivity by ensuring that the right employee is involved for the appropriate approvals.
• Shipping documents: For manufacturers, ensuring cargo manifests or bills of lading are always accurate helps reduce costly shipping errors. Yet, physical paperwork is cumbersome, isn’t always easily accessed in transit, and can be lost. By digitally signing shipping documents, shippers and receivers can access a file quickly, verify that the signature is up to date, and confirm that no tampering has occurred.

Secure your documents with Sectigo

Sectigo document signing certificates verify the signer’s identity and confirm that a document has not been altered after signing. Each signature is cryptographically bound to the file, allowing recipients to independently validate authenticity and integrity.

Sectigo offers solutions for both organizations and individuals. Document Signing Certificates support enterprise use cases with scalable, policy-driven signing, while Document Signing Professional is designed for independent professionals and small businesses that need a simple, trusted way to sign documents. In both cases, verified identity is embedded directly into each file, creating tamper-evident documents recognized by platforms like Adobe Acrobat and Microsoft Office.

Learn more about Sectigo's document signing solutions to protect contracts, reports, and other business-critical documents.