What is an electronic signature?

An electronic signature is data in digital form that a person attaches to a document to show they accept its content, with the intent to sign it. It isn't just a scanned drawing of a signature — it's a process that ties an identified person to a specific document at a specific moment, in a way that can be verified afterward.

What an electronic signature actually is

"Electronic signature" covers several ways of accepting a document without paper: drawing a signature with a finger or mouse, typing a name and clicking to accept terms, or using a digital certificate issued by a certificate authority. What makes any of these a valid electronic signature isn't how it looks — it's three elements that have to be present:

Signer identification: something that ties the signature to a specific person (a unique link sent to their email, an authenticated account, a certificate).
Intent to sign: an explicit, unambiguous action, such as clicking "Sign document" after reviewing the content.
Document integrity: a way to detect whether the document was altered after signing, typically via a cryptographic hash.

When these three elements are present and recorded, an electronic signature carries the same legal weight as a handwritten one for the large majority of documents, under the laws described below.

How the signing process works, step by step

The technical flow behind an electronic signature usually follows this sequence:

The document (typically a PDF) is uploaded to the signing platform.
Signers are defined, along with a signing order if one is needed.
Fields are placed for each signer to complete: the signature itself, initials on every page, a date, or text fields.
Each signer receives a unique link (usually by email) that takes them straight to the document — no account required.
The signer reviews the document and signs each field assigned to them.
The system computes a hash of the signed document and logs an audit event: who signed, when, from which IP address, and with which browser.
Once every required signer has completed their part, the final document is generated with the signatures embedded, along with a certificate of completion.

That certificate typically includes an audit trail with every relevant event — sent, viewed, signed — chained together with hashes, so that any later tampering with the record would be detectable. Many platforms, Esignapi included, also add an RFC 3161 timestamp to independently certify the exact date and time of signing.

What legal validity it has

Electronic signature validity isn't governed by a single worldwide law — it depends on regional rules that, broadly, agree on the same principle: a signature can't be denied legal effect just because it's electronic.

The ESIGN Act and UETA in the United States

In the United States, the ESIGN Act of 2000 (Electronic Signatures in Global and National Commerce Act) is the federal law establishing that electronic signatures and contracts carry the same validity as their paper equivalents, as long as the parties have consented to using electronic means. At the state level, most states have also adopted the UETA (Uniform Electronic Transactions Act), a model law built on the same general principle, meant to give a consistent framework across states. You can read more about this law in ESIGN Act vs UETA: what's the difference?

The eIDAS Regulation in the European Union

In the European Union, the reference framework is eIDAS Regulation (EU) No 910/2014, which governs electronic identification and trust services, including electronic signatures, across all member states. Unlike the ESIGN Act, eIDAS defines distinct tiers of electronic signature, each with its own technical requirements.

Types of electronic signature

The eIDAS Regulation itself distinguishes three tiers, and it's the clearest reference for understanding the differences:

Type	What it requires	Typical use cases
Simple	Basic signer identification (email link, click-to-accept)	Commercial contracts, internal agreements, forms
Advanced	Unique link to the signer, sole control over the signature-creation data, detection of later changes	Employment contracts, agreements that need stronger evidentiary weight
Qualified	All of the above, plus a qualified certificate from an accredited trust service provider and a qualified signature-creation device	Notarial acts, filings with public administrations

Most everyday commercial documents — service contracts, NDAs, onboarding forms — are handled perfectly well with simple or advanced signatures. You can dig deeper into these differences in eIDAS: simple, advanced and qualified signatures.

What makes an electronic signature secure and verifiable

Beyond the legal framework, how trustworthy an electronic signature is depends on how the document and the record of what happened are protected:

Encryption in transit and at rest: the document travels and is stored encrypted (for example, TLS 1.3 in transit and AES-256 at rest), so no one can intercept or read it without authorization.
Document hashing: a cryptographic hash of the signed file lets anyone check, at any point, whether the content changed after signing.
Chained audit trail: every event (sent, opened, signed) is logged with a timestamp, and the log entries are chained together with hashes, so altering one would break the chain.
RFC 3161 timestamp: independently certifies, outside the system itself, exactly when the signature happened.

If you're adding electronic signatures to your own product through an API, these same mechanisms should come built into the service, not be something you have to assemble yourself. See how this works in practice in Electronic signature API: a developer's guide.

When you can't use an electronic signature

Even though legal coverage is broad, some categories of documents fall outside standard electronic signature, or require an extra step, depending on the jurisdiction: wills and certain estate documents, some notarial acts, specific real estate transactions depending on the state, and documents that by law require a handwritten signature or in-person presence. If you're unsure about a specific document, the safest move is to check with a professional in that area before signing it electronically.

Start signing electronically

If you want to see what this process feels like end to end, Esignapi shows exactly how the flow works — secure signing links, multiple signers with a configurable signing order, and a completion certificate with a full audit trail.

Frequently asked questions

Does an electronic signature have the same validity as a signature on paper?

Yes, in the large majority of cases. Both the ESIGN Act and UETA in the United States and the eIDAS Regulation in the European Union establish that a signature can't be denied legal validity just for being electronic, as long as the identification, intent, and integrity requirements described in this article are met.

Do I need a digital certificate to sign electronically?

Not always. Simple and advanced electronic signatures — which cover most commercial documents — don't require a qualified certificate. Only a qualified electronic signature, reserved for filings with stricter legal requirements, needs a certificate issued by an accredited provider.

How do I know a signed document wasn't altered?

Through the cryptographic hash computed over the signed document and the chained audit trail. Any change made to the file after signing would change its hash, which makes the alteration detectable when comparing the document against the certificate issued at signing time.

Can I have multiple people sign the same document?

Yes. It's common to configure multiple signers for one document, with or without a specific signing order, so each one gets their own link and completes their assigned fields (signature, initials, date) independently.

What happens if one of the signers doesn't complete their part?

The document stays pending until every required signer completes their part. Most platforms let you resend reminders to signers who haven't finished yet and check each signer's status at any time.