Electronic signature vs. digital signature

People use the two terms interchangeably. Statutes, auditors, and security teams do not. Getting the distinction wrong is one of the most common reasons a compliance review comes back with findings.

The short version

A digital signature is a specific cryptographic technique — a mathematical transformation of a document using a private key, verifiable with the corresponding public key. An electronic signature is a broad legal category covering any electronic mark adopted with intent to sign. Every digital signature is an electronic signature. Most electronic signatures are not digital signatures.

	Electronic signature	Digital signature
What it is	A legal category	A cryptographic method
Examples	Typed name, drawn mark, click-to-accept, recorded voice	PKI-based signature using an X.509 certificate
Proves intent to sign	Yes, if the flow is well built	Yes
Proves the document is unaltered	Only via the platform's audit trail	Yes — tamper is detectable by anyone with the certificate
Proves signer identity	Depends on authentication method	Depends on the certificate's issuance and identity proofing
Typical use	Contracts, offers, consent forms, onboarding	Regulated filings, software distribution, high-assurance documents

What a digital signature actually does

A digital signature relies on public key infrastructure. The signer holds a private key; the corresponding public key is published inside a certificate issued by a certificate authority. Signing hashes the document and encrypts that hash with the private key. Anyone with the public key can verify two things:

That the signature was produced by the holder of the private key.
That the document has not changed since it was signed.

That second property is the real difference. If someone alters a contract after a plain electronic signature, the alteration is invisible unless the platform's audit trail catches it. If someone alters a digitally signed document, verification fails immediately and visibly.

Where the law draws the line

The ESIGN Act and UETA both cover electronic signatures broadly and do not require cryptography. So for most commercial contracts, a well-executed electronic signature is entirely sufficient — and adding PKI complexity buys you little.

The EU's eIDAS framework is more structured. It defines three tiers — simple, advanced, and qualified electronic signatures — and gives the qualified tier a specific legal effect: a qualified electronic signature has the equivalent legal effect of a handwritten signature across the EU. Only qualified signatures carry that automatic cross-border equivalence.

How to choose

Ask what you are actually trying to prove.

That the parties agreed to terms. A standard electronic signature with a solid audit trail is sufficient and cheaper.
That a specific identified person signed, verifiable by a third party later. You want an advanced or qualified digital signature, and the quality of the identity proofing at certificate issuance matters more than the cryptography.
That the document is provably unaltered. You want digital signing — typically PDF-based with an embedded certificate — regardless of what the signature workflow looks like on screen.
Regulatory filing with a specific mandate. Follow the mandate. Some jurisdictions and agencies require qualified signatures explicitly.

In practice, most organisations need both

A typical deployment uses plain electronic signatures for the bulk of commercial paper and reserves certificate-based digital signing for a smaller set of documents — regulated filings, financial statements, engineering records, or anything where proving non-alteration is a requirement. The two are not competing choices; they are different tools with different guarantees.