--- title: "How to prove someone signed a document electronically · Attest" description: "The evidence that proves an electronic signature: intent, identity, integrity and timing. How most services record it, and how Attest makes it checkable." url: https://attest.datahubz.com/guides/prove-someone-signed-electronically updated: 2026-10-12 --- [Attest](https://attest.datahubz.com/)/[Guides](https://attest.datahubz.com/guides) # How to prove someone signed a document electronically To prove someone signed electronically, you need evidence that they meant to sign, that the signature is theirs, that the document hasn't changed since, and when it happened. Attest builds that evidence into every signed copy: each signer's own passkey signature over the document's fingerprint and their entries, an audit trail inside the sealed copy, and a public blockchain anchor that anyone can check for free. By DataHubz · Updated October 12, 2026 · 8 min read ## What you need to prove Proving an electronic signature is not about whether electronic signatures count. In the United States, the ESIGN Act already says a signature or contract "may not be denied legal effect, validity, or enforceability solely because it is in electronic form". What you have to show is that a particular person signed a particular document. US law has no official list of approved signature technologies, so that comes down to evidence. | What you need to show | What it means | Evidence that shows it | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------ | | **Intent** | The person meant to sign. US law defines an electronic signature as a sound, symbol or process "executed or adopted by a person with the intent to sign the record" | A deliberate signing step, after the person was shown the document | | **Attribution** | The signature is the act of that person. Under the Uniform Electronic Transactions Act (UETA), the model law most US states have enacted, this "may be shown in any manner, including a showing of the efficacy of any security procedure" | How the signer was reached, and what only they could have done | | **Integrity** | The document is exactly what they signed | A fingerprint of the document taken at signing, and a check that it still matches | | **Timing** | When each person signed | Times recorded at signing, and a record outside the signing service | | **A copy you can produce** | You can show the signed document later | Under ESIGN, a contract that must be in writing can be denied effect if it can't be "retained and accurately reproduced" | ## How most e-signature services record a signature As DocuSign and Dropbox Sign describe it on their own pages (as published on October 11, 2026), the common model is an emailed link plus the service's own records. At DocuSign, email delivery is the default, with email access codes on every plan, and SMS or ID verification on higher plans or as paid add-ons. Every signed DocuSign document "comes with a certificate of completion", and documents are "digitally sealed with the industry-standard technology, Public Key Infrastructure (PKI)". Dropbox Sign's legal page says a signer "must either have login information for Dropbox Sign, or have received in their email account a request for signature", and its audit trail carries an identifier "that can be used to look up a record in our database". This model is widely used, and its audit trails record each step ([is an audit trail enough proof?](https://attest.datahubz.com/guides/is-audit-trail-enough-proof)). Two limits are worth knowing. The cryptographic seal belongs to the service, not to the signer: DocuSign describes it as a tamper seal showing that the document "has not been tampered with after it was downloaded from DocuSign eSignature". And part of the evidence stays with the service: to prove there was no tampering, Dropbox Sign says it "can provide you with the two unique document records". ## What Attest records for each signer Attest adds evidence the email model doesn't record: each signer makes their own cryptographic signature over the document's **fingerprint** (a SHA-256 hash), a short code calculated from a file's contents. Change one character and the fingerprint changes completely. 1. Each signer receives their own private link by email, which acts on that one agreement only. 2. They set up a **passkey**: a cryptographic key only the signer controls, unlocked with Face ID, Touch ID, Windows Hello or the device PIN. There is no account to create and no password. 3. They review the document, decrypted in their browser, and are guided to each of their fields. 4. They approve with their passkey. The passkey must confirm the signer is present and verified, and it signs this exact statement, together with the agreement ID, the signer's name, the time and a random nonce: > I have reviewed and I sign "\[title\]", the document with SHA-256 fingerprint \[hash\], with the entries I made on it (SHA-256 fingerprint \[hash\]) The statement carries the signer's name, and in place of their email address a salted commitment to it (a fingerprint of the address and a secret value Attest gives only to the parties), and the passkey also signs where their entries sit on the page and a commitment to their own encryption key. 5. Attest checks the signature against the passkey's public key before recording it. The signature becomes a receipt in the signer's own account, anchored on the Horizen public blockchain from the signer's own wallet, a blockchain account Attest creates and runs for each user. 6. When the last signer signs, the signed state (the document's fingerprint and, for each signer, who signed, when, and the fingerprint of their entries) is fingerprinted, signed with Attest's platform key and anchored on Horizen. The pages of the sealed copy are anchored too. Because each signer's statement names the fingerprint of the document and of everything they entered, their signature fits that document and no other, and an edit by anyone afterward makes verification fail. The drawn or typed signature you see on the page is how the signature looks. The passkey is what makes it binding. ## Evidence anyone can check When everyone has signed, every party downloads the same sealed PDF. It contains: - the signed pages, with every signer's entries and a "Signed with Attest" stamp around each signature field - a seal line at the foot of every page of the document: "Sealed by DataHubz Attest", the verification code and the link to verify it - a certificate of completion with the title, the completion time, the number of parties, the verification code, the fingerprints of the document and of the signed state, the blockchain anchor transaction, and each signer's signature in a stamp with their name and signing time - an audit trail listing every step up to completion in UTC, such as created, sent, opened, key set up, released, signed and completed - a "Verify it yourself, without us" page, which explains how to check each step without Attest - three attachments: the full evidence file, the original document exactly as signed, and a standalone verifier Anyone can check it, free and with no account. Drop the PDF on [attest.datahubz.com/verify](https://attest.datahubz.com/verify), which fingerprints it in the browser and confirms it is the exact file that was recorded and anchored, or open the verifier attached inside the file. The verifier is open source under the MIT license, and it runs in any browser with no Attest service, reading only a public blockchain node. It checks the original document inside the signed copy against what every signer signed, each signer's passkey signature and entries, Attest's anchored record of the agreement on Horizen, and that nothing was added to the PDF after it was sealed. It also re-makes every page you see from what was signed and compares the result with the copy byte for byte, so pages drawn with anything else fail. It pins its trust root (the chain, Attest's registry and the keys it checks against are built into the verifier, never read from the file being checked) and accepts only anchors from Attest's registered wallets. An expert can also re-run each cryptographic check with standard tools: any SHA-256 tool, any WebAuthn library and any Ethereum JSON-RPC node. That matters when a signature is questioned. In US federal courts, one accepted way to authenticate a record is "evidence describing a process or system and showing that it produces an accurate result" (Federal Rule of Evidence 901(b)(9)). With Attest, that process can be shown and re-run by anyone, including the other side. ## Email link compared with a passkey signature | | Email-link signing (as DocuSign and Dropbox Sign describe it, October 11, 2026) | Attest | | ------------------------------------- | ------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | What the signer does | Opens a link from their inbox and signs; extra checks such as SMS or ID verification depend on the plan | Approves with a passkey only they control, using Face ID, a fingerprint or a PIN | | What ties the signature to the signer | The service's record of who used the link | The signer's own signature, made by a passkey registered to their email address | | What ties it to the document | The service's seal on the finished PDF | Each signature names the fingerprint of the document and of the signer's entries | | Where the proof lives | The service's records, and the sealed PDF it issues | Inside the signed copy every party holds | | How it's checked later | Through the service's records and its seal | By anyone, free, with an open-source verifier, against a public blockchain | ## How to collect strong evidence 1. **Send to the address the person uses with you.** Each signature is made by a passkey registered to the signer's email address, so use the address you already correspond with. Attest confirms control of that address and the passkey, not a government ID, and the passkey must confirm the signer was present and verified, with Face ID, a fingerprint or the device PIN. 2. **Give every signer a signature field.** When you place fields, each signer needs one, and everything a signer enters is covered by their own signature. 3. **Put every term in the document.** The passkey signature covers the document and the signer's entries, so anything that matters belongs in the PDF, not in an email around it. 4. **Keep your correspondence.** Attribution "may be shown in any manner", so emails, invoices and payments that refer to the agreement support it. 5. **Download the sealed copy when it completes,** and keep it with your records. 6. **Verify it once yourself** at , so you know it checks out before you ever need it. 7. **For people you sign with often, compare safety numbers.** Two people can compare a 60-digit safety number on the Security page to confirm that documents are encrypted to the right person's key. Electronic signatures are recognized for most agreements in the United States (the ESIGN Act and UETA) and the European Union (eIDAS). Some documents, such as wills or certain notarized deeds, have special rules in many places: check yours. This page is general information, not legal advice. Your first 2 documents on Attest are free, in total, and after that the Signing plan is $5 a month for 20 documents. ## Questions people ask Is an audit trail enough to prove someone signed? An audit trail is the signing service's record of what happened, and it helps. It is stronger alongside evidence the signer made themselves and a way to show the document hasn't changed. On Attest, the audit trail sits inside the sealed copy next to each signer's passkey signature and the blockchain anchor. Does a drawn signature prove anything on its own? A drawn or typed signature is an image, and an image can be copied. On Attest, the image is only how the signature looks: the passkey signature over the document's fingerprint is what binds the signer. A stamp leads to the record but doesn't prove a printed page is unaltered, so check the file itself on the verifier. Does a blockchain anchor prove who signed? No. An anchor proves that a fingerprint existed, unchanged, when it was written to the blockchain. Who signed is shown by each signer's passkey signature, which names that fingerprint. How does Attest know who the signer is? Each signature is made by a passkey registered to the signer's email address, and the passkey must confirm the signer was present and verified, with Face ID, a fingerprint or the device PIN. The evidence ties the signature to that address and that passkey. Can the other party check the evidence too? Yes. Anyone can verify a signed copy for free, with no account, at attest.datahubz.com/verify or with the verifier inside the PDF. The verifier is open source and works without Attest. ## Sources 1. [15 U.S.C. Chapter 96, Electronic Signatures in Global and National Commerce (United States Code, 2023 edition)](https://www.govinfo.gov/content/pkg/USCODE-2023-title15/html/USCODE-2023-title15-chap96.htm), U.S. Government Publishing Office, read October 11, 2026 2. [Uniform Electronic Transactions Act (1999), final text with comments](https://www.uniformlaws.org/HigherLogic/System/DownloadDocumentFile.ashx?DocumentFileKey=1b1ffc6b-9b6a-35a4-2a83-7b4d5c0f77a7&forceDialog=0), Uniform Law Commission, read October 11, 2026 3. [Federal Rules of Evidence](https://www.uscourts.gov/forms-rules/current-rules-practice-procedure/federal-rules-evidence), United States Courts, read October 11, 2026 4. [Regulation (EU) No 910/2014 (eIDAS), consolidated text](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02014R0910-20241018), EUR-Lex, Publications Office of the European Union, read October 11, 2026 5. [Docusign eSignature plans and pricing](https://ecom.docusign.com/plans-and-pricing/esignature), Docusign, read October 11, 2026 6. [Docusign eSignature features](https://www.docusign.com/products/electronic-signature/features), Docusign, read October 11, 2026 7. [Dropbox Sign legal](https://www.dropboxsign.com/about/legal), Dropbox, read October 11, 2026 ## Read next - ["I never signed that": proving an e-signature](https://attest.datahubz.com/guides/i-never-signed-that) When a counterparty denies signing: how e-signature disputes are argued, the evidence to gather, and how Attest's passkey signatures answer the claim. - [How to verify that a signed document is genuine](https://attest.datahubz.com/guides/verify-signed-document) Check who signed, that nothing changed and when. How e-signature services verify documents, and how to check an Attest document free, even without Attest. - [Are electronic signatures legally binding?](https://attest.datahubz.com/legal/are-electronic-signatures-legally-binding) Yes, for most agreements: ESIGN, UETA, eIDAS and similar laws say a signature can't be refused just for being electronic. The laws, exceptions and evidence. - [Document signing](https://attest.datahubz.com/sign) Electronic signatures with a passkey: no account or password for signers, documents encrypted in the browser, and a signed copy anyone can verify. --- Source: https://attest.datahubz.com/guides/prove-someone-signed-electronically