Electronic vs digital signatures: the difference

Electronic signature: a legal idea

An electronic signature is whatever a person uses, in electronic form, to sign. The law defines it by purpose, not by technology:

• United States: "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record" (15 U.S.C. 7006(5)).
• European Union: "data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign" (eIDAS, Article 3(10)).

A typed name, a click on "I agree", a drawn signature and an approval with a passkey can all be electronic signatures. What makes each one a signature is the purpose: the person used it to sign. In the US, the EU, the UK and many other countries, an electronic signature can't be denied legal effect just because it is electronic. Are electronic signatures legally binding? covers those laws.

Digital signature: a cryptographic technique

A digital signature is made with a pair of keys:

1. The signer has a private key, which only they control, and a matching public key, which anyone can see.
2. Software calculates a fingerprint (hash) of the content: a short code computed from the file, such as a SHA-256 hash, that changes completely if a single byte changes. The private key signs that fingerprint.
3. Anyone with the public key can check the signature. If the content changed, or a different key signed, the check fails.

A digital signature proves two things well: that the holder of a particular private key signed, and that the content hasn't changed since. On its own, it doesn't prove who holds the key. That link comes from somewhere else, such as a certificate from a certification authority, or a record of how and for whom the key was set up.

It also doesn't prove intent by itself. The comments published with the US Uniform Electronic Transactions Act (UETA) put it this way: "One may use a digital signature with the requisite intention, or one may use the private key solely as an access device with no intention to sign".

How the two relate

Every digital signature made in order to sign is an electronic signature, but an electronic signature doesn't have to be a digital signature. The UETA comments say: "A digital signature using public key encryption technology would qualify as an electronic signature, as would the mere inclusion of one's name as a part of an e-mail message", so long as in each case "the signer executed or adopted the symbol with the intent to sign."

	Electronic signature	Digital signature
What it is	A legal concept: any electronic means a person uses to sign	A cryptographic method: a signature made with a private key and checked with the public key
Examples	Typed name, "I agree" click, drawn signature, passkey approval	Passkey (WebAuthn) signatures, certificate-based signatures
What it proves on its own	Little beyond what the surrounding records show	Which key signed, and that the content hasn't changed
Legal effect	Can't be denied effect just because it is electronic	The same, as one kind of electronic signature; more only where a law grants it, such as the EU's qualified tier

When "digital signature" is a legal term

In some countries, "digital signature" names a specific legal category: a certificate-based signature from a licensed authority.

• India: the Information Technology Act, 2000 makes a digital signature an authentication by an asymmetric crypto system and hash function (s 3), used with a Digital Signature Certificate issued by a licensed Certifying Authority. Where a law requires a signature, only certificate-backed methods (a Digital Signature Certificate or eSign) satisfy it, while a contract formed electronically is not unenforceable solely for that reason (s 10A).
• Argentina: under Ley 25.506, a "firma digital" is valid only with a certificate issued or recognized by a licensed certifier (art. 9), and it satisfies a legal signature requirement (art. 3). Any other electronic signature is a "firma electrónica": recognized, but if it is disowned, the party relying on it must prove it (art. 5).

So a signature can be digital in the technical sense without being a "digital signature" in the legal sense of these laws.

How the EU tiers fit

The EU's eIDAS Regulation sorts electronic signatures into three tiers:

• Simple: any electronic signature (Article 3(10)), digital or not.
• Advanced: uniquely linked to the signer, capable of identifying them, created with means the signer can use under their sole control with a high level of confidence, and linked to the signed data so any later change is detectable (Article 26). Change detection is what a digital signature does; the other three requirements depend on how the key is held and how the signer's identity is established. Article 26 itself doesn't require a certificate.
• Qualified: an advanced signature created with a qualified signature creation device and based on a qualified certificate for electronic signatures, which is issued by a qualified trust service provider (Articles 3(12) and 3(15)). It has "the equivalent legal effect of a handwritten signature" (Article 25(2)) and is recognized as qualified in every member state (Article 24a).

Put simply: a qualified signature is always a certificate-based digital signature; a digital signature is not automatically advanced or qualified; and an electronic signature doesn't have to be digital at all. No tier can be refused legal effect or admissibility as evidence just for being electronic or not qualified (Article 25(1)). The UK uses the same three tiers. The United States has none: ESIGN and UETA are technology neutral.

Which kind does an agreement need?

For most business agreements, the law asks only for an electronic signature. The US has no certificate requirement for private contracts, and in the EU most commercial contracts have no form requirement in most member states. A certificate-based or qualified signature matters where a specific law requires one: for example, where an EU member state's law requires handwritten form, or where Indian or Argentine law requires a signature.

In a dispute, what counts is evidence of who signed and what they signed. That is where a digital signature helps any electronic signature: it ties the signature to one key and to the exact content.

Where Attest fits

Attest signatures are electronic signatures, recognized for most agreements in the United States (the ESIGN Act and UETA) and the European Union (eIDAS). Each one is made with a digital signature:

1. Each signer has a passkey: a cryptographic key only the signer controls, unlocked with Face ID, Touch ID, Windows Hello or the device PIN. Attest never sees a passkey's secret.
2. When the signer approves, the passkey signs the SHA-256 of a statement: "I have reviewed and I sign" the titled document with its SHA-256 fingerprint, with the fingerprint of the entries they made, together with the agreement ID, their name, the time and a salted commitment to their email address (a fingerprint of the address and a secret value Attest gives only to the parties), so the evidence ties the signature to the signer's address without publishing it.
3. The passkey must confirm the signer is present and verified, and Attest checks the signature against the passkey's public key before recording it.
4. Anyone can re-check every signature from the evidence with any WebAuthn library (WebAuthn is the W3C standard behind passkeys), and the signed state is anchored on the Horizen public blockchain.

The signature typed or drawn on the page is what people see; the passkey signature is what makes it binding. The passkey is registered to the signer's email address, so each signature is tied to that address and its passkey, and to the exact document: change one byte and verification fails. Attest confirms control of the email address and the passkey, not a government ID.

Under eIDAS, Attest signatures are electronic signatures, the base tier (Article 3(10)) that is recognized for most agreements, not qualified electronic signatures, and each one carries evidence anyone can check: the signer's own passkey signature over the document's fingerprint and a public blockchain anchor. Trust in that evidence comes from the signer's own key, open standards (WebAuthn and SHA-256) and the public anchor, not from a certification authority. The evidence travels inside the signed PDF as attachments, and the open-source verifier included in every signed copy checks it in any browser, without Attest. See how to verify a signed PDF without Adobe.