What is a digital signature?
Definition
A digital signature is a code made from a document and the signer's private key. Anyone with the matching public key can use it to check who signed the document and that nobody changed it afterwards.
- Category
- Security
- Also called
- electronic signature (related, not identical), cryptographic signature
- Last updated
A digital signature is not a picture of your handwriting. It is a block of data produced by a cryptographic operation. NIST's glossary describes it as the output of a digital signature algorithm run on the data being signed, and says a correctly implemented signature lets a recipient verify where the data came from, check that it wasn't altered, and stops the signer from later denying they signed it.
How it works
Your software turns the document into a short fingerprint (a hash), then uses your private key to lock that fingerprint. The result travels with the document. The recipient uses your public key to unlock it and compares the fingerprint with one they calculate themselves. If the two match, the document is unchanged and the key holder signed it. Change one character and they no longer match.
A typical case: a bank emails you a PDF statement with a digital signature. Your PDF reader shows a banner saying the signature is valid. If someone tampers with the file in transit, the banner changes to a warning.
Digital signature vs. electronic signature
People use the two terms as if they mean the same thing. They don't. An electronic signature is any mark that shows intent to sign: a typed name, a tick box, a drawn squiggle on a phone. A digital signature is the cryptographic kind, tied to a key. Many e-signing services use digital signatures behind the scenes, but a typed name alone is not one.
Why it matters to you
Software updates, signed emails and secure websites all depend on digital signatures. They are how your phone knows an app update really came from the developer. They also depend on you keeping the private key private: anyone who steals it can sign as you, so treat it like a password.
How to protect yourself
- 1
Check the signature before you trust a file
When a PDF or app shows a signature warning, don't ignore it. A broken or unknown signature means the file changed or the sender isn't who they claim to be.
- 2
Install updates only from official sources
Phones and computers verify signatures on updates from their own stores. Files from links in emails or texts skip that protection.
- 3
Protect any signing key or certificate
If you use a signing key, keep it in a password-protected store or hardware token and never email it. Use two-step verification on accounts that hold it.
- 4
Be wary of requests to sign things quickly
Scammers send fake e-signature requests to harvest your name, email and sometimes ID. Open the signing service directly instead of clicking the link in the message.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a digital signature the same as an electronic signature?
No. An electronic signature is any way of showing you agree, such as a typed name. A digital signature uses cryptography to prove who signed and that the content didn't change.
Is a digital signature legally binding?
Often yes, but the rules depend on the country and the type of document. Check the law where you are or ask a lawyer for anything important.
Can a digital signature be forged?
Not without the signer's private key. The weak point is usually the key: if it's stolen, the thief can sign as you.
What is the difference between a digital signature and a digital certificate?
The signature proves who signed a specific file. The certificate is the credential that ties the public key to a person or organization.
Sources
Something wrong or out of date? Tell us and we'll re-check it.