For everyday paperwork, drawing or uploading your signature and placing it on the page is usually enough, and it takes a minute. For anything where someone may later dispute who signed or whether the text changed, you want a certificate-based digital signature or a dedicated e-signature service, because a picture of your signature proves very little on its own.
The terms get mixed up constantly, so let us separate them first. This is general information about how these things work, not legal advice. If a signature carries real legal or financial weight, check with a lawyer in your jurisdiction.
Electronic signature versus digital signature
Electronic signature is the broad, legal category. US federal law (the ESIGN Act) defines it as “an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.” A typed name, a ticked box or a pasted image can all qualify. The key word in that definition is intent.
Digital signature is a specific technology. Software calculates a cryptographic hash of the document, and signs it with a private key tied to a certificate. Anyone can then verify, using the matching public key, that the file has not changed and that the signature came from that certificate’s holder.
So one is about what the law recognises, and the other is about what mathematics can verify. A digital signature is usually also an electronic signature. Most electronic signatures are not digital signatures.
| Image placed on the page | Certificate-based digital signature | |
|---|---|---|
| Shows your name or mark | Yes | Optional visible stamp |
| Detects later changes | No | Yes |
| Identifies the signer | Only by appearance | By certificate, as far as the issuer checked identity |
| Needs setup | None | A certificate, and software that uses it |
| Validated by readers | Nothing to validate | Signature panel reports its status |
What an image signature really is
We ran our Sign PDF tool’s function on a test file with a PNG signature and inspected the output. The file grew from 51,849 to 52,240 bytes. What changed was one new image object, drawn on the page. There was no signature field, no form, no /Sig dictionary and no /ByteRange entry, which is what a cryptographic signature would need.
That tells you what it does and does not do.
What it does: it records a visible mark on the page, which you can use to show intent to sign. Many day-to-day recipients accept nothing more, and in many legal systems that intent is what counts.
What it does not do:
- It does not identify you. Anyone holding a picture of your signature can paste it, and signatures are easy to lift from old documents.
- It does not protect the document. Text can be edited after signing, and nothing will warn the next reader.
- It does not record when you signed, or from where. Any date on the page is only more page content.
- It cannot be validated. A reader has no way to check it, because to the file format it is just a picture.
To reduce those risks, keep your own copy of what you sent, send it from an account clearly linked to you, and write the agreement in the email too (“Signed copy attached, I agree to these terms”). That surrounding evidence often matters more than the image.
How a digital signature works inside a PDF
When you certify a PDF, the signing software reserves a gap in the file for the signature value. A /ByteRange entry lists the bytes covered: everything except that gap. The software hashes those bytes, signs the hash with your private key, and writes the result into the gap together with your certificate.
Later, a reader hashes the same byte ranges and compares. Change one byte and verification fails, so the reader flags the signature.
PDFs can still be changed after signing by appending an incremental update (this is how a second person can sign, or how a form can be filled in afterwards). The original signed version stays intact inside the file, and readers can report that changes were made after signing.
Trust is a separate question from integrity. A reader may say “the document has not been modified” and also “the signer’s identity is unknown”, if the certificate is self-signed. For the identity to be trusted, the certificate has to chain up to an authority the reader trusts, which in Adobe’s case includes its Approved Trust List. Self-signed certificates prove the file has not changed, and little else.
The legal context, in general terms
Rules differ by country and by document type, but a few general features are common.
United States. ESIGN says a signature or contract in interstate or foreign commerce “may not be denied legal effect, validity, or enforceability solely because it is in electronic form”. Most states have also adopted the Uniform Electronic Transactions Act. That does not mean every electronic signature is automatically valid, only that being electronic is not by itself a reason to reject it. There are exceptions: among others, wills, many family law matters, court documents, and certain notices such as utility cancellations.
European Union. The eIDAS Regulation defines three levels: simple, advanced and qualified. Article 25 says an electronic signature cannot be denied legal effect solely for being electronic, and that a qualified electronic signature has the equivalent effect of a handwritten one. A qualified signature needs a qualified certificate and a qualified signature creation device, typically through an accredited provider.
Everywhere. In a dispute, the questions are practical. Did this person sign? Did they intend to? Has the document changed since? An image answers the first only weakly and the third not at all, whereas an audit trail, or a certificate, helps with both.
Some recipients set their own rules as well. Banks, government agencies, universities and notaries may insist on wet ink or a specific method, regardless of what the law would allow. Check their requirements first, because it costs nothing and avoids a rejected form.
Which method for which document
| Situation | A sensible choice |
|---|---|
| Internal approval, permission slip, routine form | Image signature |
| Freelance contract or NDA with a known counterparty | E-signature service with an audit trail |
| Lease, or a larger commercial agreement | E-signature service, or wet ink if requested |
| Engineering sign-off, regulated industries, tenders | Certificate-based digital signature |
| EU document that requires handwritten equivalence | Qualified electronic signature |
| Will, deed, or anything needing a witness or notary | Follow local formalities, usually on paper |
Signing with an image, step by step
- Finish the document. Read it fully and confirm this is the final version, since edits after signing will go unnoticed.
- Open it in Sign PDF. Draw, type or upload a signature. Everything stays in your browser, which is reasonable for a signature image you would not want sitting on a stranger’s server.
- Place it on the right page. It can go on one page or several.
- Download a copy, open it, and check it. Look at the position, the page and the size.
- Keep a record. Save the signed file and the message you sent it with.
If you upload a scan of your handwritten signature, use a PNG with a transparent background so it does not paint a white box over any text beneath it.
Getting a real digital signature
Adobe Acrobat lets you sign with a digital ID, and can create a self-signed one for you. It is fine for showing integrity within a group that already trusts you. Trusted certificates come from certificate authorities or, in some countries, national eID cards. E-signature services arrange the signing, the audit trail and the certificate as a package, which is usually the least-effort route for agreements with outside parties.
Our tool does not apply cryptographic signatures. Adding a password with Password Protect PDF does not turn an image signature into one either, since PDF permissions are not tamper protection. Do not describe a PDF as “digitally signed” if it only has a signature image on it, because the person relying on it may assume protections that are not there.