Digital signature vs e-signature: choose by risk

People often use ‘digital signature’ to mean any signature on a screen. Technically, it is narrower: a digital signature uses cryptography and a certificate. An electronic signature is the wider legal and practical category, from a typed name to a tightly controlled signing process.

The short answer

An electronic signature is a broad method for showing intent to sign an electronic record. A digital signature is a cryptographic mechanism, usually based on public-key infrastructure, that can verify changes to a file and connect it to a certificate. Choose based on the legal requirement, risk and recipient expectation, not on whichever term sounds more secure in a sales page.

Before you start

Ask what the document needs to achieve. Is the main problem collecting a client’s agreement quickly, or is it satisfying a technical policy that requires certificate-based signing? Identify the jurisdiction and any sector rules. A commercial contract may need a clear audit trail and a low-friction recipient experience; a regulated filing may call for a named certificate or qualified trust service.

The practical rule is to separate the document from the evidence about the document. A visible name or squiggle is useful to a reader, but it is not the whole record. For an agreement that matters, keep the final PDF, the completed event log, the invitation address and the version that was sent. That small bit of housekeeping is much easier than rebuilding a timeline after a disagreement.

A reliable way to do it

For ordinary e-signing, prepare the PDF, assign fields, send recipient-specific links and retain the audit record. For a digital signature, obtain and manage the appropriate certificate, sign the file using compatible software and ensure recipients can validate it. The two can coexist: a service may use cryptographic controls internally while presenting a simple electronic signing experience to a customer.

• Use the final version of the document, not a draft with unresolved comments.
• Put signature, date and any required text fields beside the relevant clause.
• Send the link to the person whose email address you have already checked.
• Ask the signer to review the whole document before they complete the signature field.
• Save the completed PDF and its audit record together in the same matter or client folder.

That sequence is deliberately boring. Boring is good here. It makes it clear which version was offered, gives both sides the same finished copy and avoids the familiar mess of several attachments called ‘final final’. It also makes the process workable on a phone: the signer needs a browser and a clear link, not a new account or an app download.

What the options look like

A realistic example

A marketing agency sends a campaign agreement to a client and needs the client to sign from a phone. A browser e-signature flow is proportionate and easy to evidence. The agency later submits a technical document to a public body whose portal specifies a certificate-backed signature. It uses the required digital signing process instead. Trying to use one method for both jobs would either add needless friction or fail the portal’s rule.

The useful measure is not how polished the process appears in a demo. It is whether a busy person can complete it without a call, a printer or a password reset. A straightforward signing flow removes the tiny reasons people put a document aside. It also leaves the sender with evidence that is readable by a human, not locked in a proprietary dashboard.

The mistakes worth avoiding

Do not promise that a digital signature automatically makes every contract enforceable, or that a simple electronic signature is always enough. Enforceability also depends on the underlying agreement, authority, consent and applicable law. Equally, do not confuse a scanned signature image with a cryptographic digital signature; they are different things entirely.

Do not treat this as legal advice for a particular transaction. Some documents have special form, witnessing, identity or jurisdictional requirements. In the US, ESIGN and UETA make electronic records and signatures generally valid, but they do not erase statutory exceptions. In Europe and the UK, a simple electronic signature can be valid, while a regulated use case may need a different assurance level. Check the document type before promising a counterparty that any method will do.

A contract may not be denied legal effect solely because an electronic signature was used in its formation. — ESIGN Act, 15 U.S.C. §7001

How to make the right call

Use an e-signature platform for most commercial documents where clear intent and a practical audit trail are the goal. Use certificate-backed signing where a counterparty, regulator or security policy specifically requires it. If the stakes are high or cross-border, obtain advice on the assurance level rather than translating technical labels into legal conclusions yourself.

A good default is proportionate evidence. For an internal acknowledgement, a clear email and a saved PDF may be enough. For a client agreement, lease or confidentiality document, use a signing flow that records the email address, timestamps, IP address, user agent and a tamper-evident document hash. None of that makes a bad contract good; it does make a valid agreement easier to evidence.

Make the record useful next year

Once the document is complete, give it a name a colleague can understand without opening it. Include the party, document type and completion date, then store the signed PDF and certificate together with sensible access controls. Record where the unsigned source lives, but do not edit the completed copy. This is a small operational discipline, yet it is the difference between a settled record and a frantic search through old email when a renewal, invoice or dispute appears months later.

It is also worth telling the other party where their copy will arrive. People are more comfortable signing when they know they will be able to retrieve the final agreement afterwards. If an email is bounced, a signer says the details are wrong or a clause is under discussion, pause rather than trying to patch the live request. Void it, resolve the issue and send one clean final version. That preserves a record both sides can trust.

Finally, treat the signing request as part of the customer experience. Use the name people know you by, a specific subject line and a short explanation of why the document is arriving now. Check the request on both a laptop and a phone before a large send. If a recipient has accessibility needs, provide a workable alternative and make the document available in a form they can retain. Clear communication is not decorative: it helps establish informed action and stops a genuine request being mistaken for a phishing email.

Next step

If you have a PDF ready, try the workflow with one low-risk document first. Upload it, place the fields and send yourself a test link. You will see where the recipient hesitates before you ask a real customer, tenant or supplier to sign. InkRobin’s free plan covers five documents a month, so there is room to test the practical bits before changing a team process.