securetools.live • November 2026What Is an Electronic Signature? Meaning, Types, and How They Work
An electronic signature is any electronic method of indicating intent to agree to a document. Three legally recognized types exist — Simple (SES), Advanced (AES), and Qualified (QES) — each offering progressively stronger identity binding and tamper evidence. Under the US ESIGN Act, EU eIDAS Regulation, and UK law, electronic signatures are legally valid for most commercial contracts. Certain documents — including wills and some real estate instruments — still require wet signatures in many jurisdictions.
What Is an Electronic Signature?
An electronic signature is any electronic data attached to or logically associated with a document that a person uses to indicate their intent to sign or agree to the document's contents. The definition is intentionally broad. It covers a typed name at the bottom of an email, a drawn signature on a touchscreen, a checkbox confirming acceptance of terms, a click on an "I agree" button, and a cryptographic digital signature embedded in a PDF — all qualify as electronic signatures in law.
The key element is intent. A handwritten signature has no inherent legal force — it gains force because the signer intends it to mean something. Electronic signatures work the same way. Courts and legislators across the world have recognized that the medium of signing is irrelevant: what matters is whether the signing event establishes that a specific person made a deliberate decision to agree.
This is a departure from historical intuition. For centuries, a handwritten signature was synonymous with a "real" signature. The rise of fax, then email, then dedicated signing platforms forced legal systems to separate the concept of intent from the medium through which it is expressed. Today's e-signature laws encode that separation explicitly.
It is important to note that "electronic signature" is not the same as "digital signature," although the terms are frequently used interchangeably in everyday language. A digital signature is a specific cryptographic mechanism — a subset of electronic signatures with particular technical properties. That distinction has meaningful practical consequences, which are covered in the guide on electronic signatures vs digital signatures.
The Three Main Types: SES, AES, and QES
The EU's eIDAS Regulation (Electronic Identification, Authentication and Trust Services) established the most influential formal classification of electronic signatures. It defines three levels that differ in the strength of identity binding and tamper evidence they provide.
| Type | Definition | Identity binding | Tamper evidence | Certificate required |
|---|---|---|---|---|
| SES | Any electronic data used to sign | Weak — contextual only | None required | No |
| AES | Uniquely linked to signer; detects changes | Strong — cryptographically linked | Yes — detects post-sign changes | Typically yes |
| QES | AES + qualified certificate + QSCD device | Highest — government-recognized CA | Full — cryptographic chain | Yes — qualified certificate |
Simple Electronic Signature (SES)
A Simple Electronic Signature is the broadest category. It includes any electronic data logically associated with a document and used by a person to sign. A typed name in an email, a scanned signature image inserted into a Word document, or a click on a confirmation button are all SES. There is no cryptographic binding — the identity of the signer is inferred from context (the email address used, the account logged in, the IP address of the device) rather than verified through cryptography.
SES is suitable for everyday commercial agreements where risk is low, the parties know each other, and a dispute is unlikely. Client onboarding documents, standard NDAs between known parties, and routine service renewals are examples where SES is adequate.
Advanced Electronic Signature (AES)
An Advanced Electronic Signature meets four specific requirements under eIDAS Article 26: it is uniquely linked to the signatory; it is capable of identifying the signatory; it is created using electronic signature creation data under the signatory's sole control; and it is linked to the signed data in a way that detects any subsequent changes. In practice, AES typically uses public-key cryptography, where the signer's private key produces a digital signature that can be verified with their public key.
AES is appropriate for higher-value contracts, regulated transactions, and situations where a stronger identity link is needed. Most enterprise e-signature platforms that offer PDF-level digital signatures provide AES functionality.
Qualified Electronic Signature (QES)
A Qualified Electronic Signature adds two requirements to AES: it must be created with a Qualified Electronic Signature Creation Device (QSCD) — a secure hardware or software environment that protects the private key — and it must be based on a qualified certificate for electronic signatures issued by a Trust Service Provider (TSP) listed on an EU member state's trusted list. QES carries the highest legal presumption of validity under eIDAS and is explicitly equivalent to a handwritten signature across all EU member states. For documents that specifically require QES — certain regulated filings, notary-equivalent processes in some jurisdictions — no lesser form of electronic signature will suffice.
How Electronic Signatures Work Technically
How SES Captures Intent
For Simple Electronic Signatures, the technical mechanism is straightforward: the signing platform records that a specific account (identified by email or login) performed a signing action at a specific time from a specific IP address. The platform generates an audit log of these events and embeds them in or attaches them to the signed document. There is no cryptographic binding between the signer and the document content — the record is behavioral and contextual rather than mathematical.
How AES and QES Work: Hash Functions and Asymmetric Cryptography
Advanced and Qualified Electronic Signatures rely on asymmetric cryptography — also called public-key cryptography. The mechanism works as follows:
- Hash generation: When the signer initiates signing, the platform computes a cryptographic hash — a fixed-length fingerprint — of the document's current content. SHA-256 is the most commonly used algorithm. Any change to the document after signing will produce a completely different hash.
- Encryption with private key: The signer's private key encrypts the hash. This encrypted hash is the digital signature. Because only the signer holds the private key, only they could have produced it.
- Verification with public key: Any recipient can use the signer's public key to decrypt the digital signature and recover the original hash. They then independently hash the received document. If the two hashes match, the document is unmodified and the signature is verified.
- Certificate authority (CA): For the public key to be trusted, it must be certified by a trusted Certificate Authority. The CA vouches that the public key belongs to the named individual. QES requires a CA on an EU trusted list; AES typically uses a commercial CA.
This cryptographic structure provides two guarantees that SES cannot: authentication (the signature could only have been created by the holder of the private key) and integrity (any change to the document after signing invalidates the signature). For a deeper comparison of these mechanisms, see the guide on electronic signatures vs digital signatures.
Legal Recognition: ESIGN, UETA, eIDAS, and UK Law
United States: ESIGN Act and UETA
The federal Electronic Signatures in Global and National Commerce Act (ESIGN Act, 2000) established that electronic signatures, electronic contracts, and electronic records have the same legal effect as paper equivalents. Its core principle: a signature cannot be denied legal effect solely because it is in electronic form. The Act requires demonstrated intent to sign, prior consent to electronic contracting, and a method capable of identifying and attributing the signature.
The Uniform Electronic Transactions Act (UETA) operates at the state level and has been adopted by 49 states. It provides similar protections and fills gaps for intrastate transactions not covered by the federal ESIGN Act. Together, ESIGN and UETA create a comprehensive framework ensuring electronic agreements are enforceable across the United States.
European Union: eIDAS Regulation
The eIDAS Regulation (EU No 910/2014) created a unified framework for electronic identification and trust services across all EU member states. Unlike the US approach, which is technology-neutral and form-agnostic, eIDAS creates formal tiers (SES, AES, QES) with specific legal consequences for each. A QES is deemed equivalent to a handwritten signature in all member states. AES carries strong legal presumption of validity for most commercial documents. SES is valid but may face more scrutiny in disputes. The eIDAS2 revision (2024) strengthens digital identity provisions through the EU Digital Identity Wallet initiative.
United Kingdom Post-Brexit
The UK retained eIDAS principles as "UK eIDAS" after Brexit. The Electronic Communications Act 2000 and the Law Commission's 2019 guidance confirm that electronic signatures are valid for most contracts under English law. The UK's approach is broadly technology-neutral — any method capable of authenticating the intention to be bound is sufficient — with QES providing the strongest evidentiary position.
For a deeper analysis of enforceability requirements and jurisdiction-specific exceptions, see the guide on whether electronic signatures are legally binding.
Common Use Cases
Electronic signatures are used across virtually every sector where documents require agreement. The following represent the highest-volume use cases:
- Employment agreements: Offer letters, employment contracts, non-compete agreements, and benefits enrollment documents. HR departments routinely process hundreds of signatures per month electronically.
- NDAs and confidentiality agreements: Standard bilateral NDAs signed before sharing sensitive business information. For NDA workflows that include secure document sharing afterward, see the guide on how to create, send, and sign an NDA online.
- Client and vendor contracts: Master service agreements, statements of work, supplier terms, and partnership agreements. Remote and international contracting has made electronic signing the default for most B2B transactions.
- Multi-party documents: Board resolutions, partnership agreements, and lease agreements requiring multiple signers. See the guide on collecting multiple signatures on a single document.
- Due diligence and investor documents: NDAs and access agreements gating entry to virtual data rooms. For this workflow, see the guide on electronic signatures in due diligence.
For the mechanics of signing a PDF specifically, see the guide on how to sign a PDF electronically. For sector-specific rules, note that healthcare organizations subject to HIPAA need to ensure their electronic signature workflows comply with applicable access-control and audit-trail requirements; real estate transactions in some US states still require wet signatures for deed transfers; and mortgage instruments have specific regulatory requirements that vary by state.
What Electronic Signatures Do Not Do
Electronic signatures are frequently overloaded with expectations they cannot fulfill. Understanding their limitations prevents operational and legal mistakes.
A Simple Electronic Signature does not verify the signer's identity beyond what the signing platform can observe (email, IP address, account login). It confirms that someone with access to the signer's account performed a signing action — not that the account owner was present or consenting at that moment.
- Not a guarantee of identity: Unless the signing process includes independent identity verification (e.g., government ID check, SMS OTP, facial recognition), the signature proves only that the registered account performed the signing action. Someone with access to the signer's email could sign on their behalf.
- Not tamper-proof for SES: A Simple Electronic Signature does not mathematically seal the document content. The document could theoretically be altered after signing, and the signature image would remain visually present. AES and QES prevent this through cryptographic hashing — any change invalidates the signature.
- Not a substitute for legal review: An electronically signed contract is as binding (or as unenforceable) as its terms. A poorly drafted NDA signed electronically is still a poorly drafted NDA. Electronic signature adds evidentiary value to agreement; it does not add legal validity to problematic terms.
- Not valid for all document types: Wills, certain deeds, and specific regulated instruments require wet signatures in many jurisdictions regardless of technology.
For a comprehensive analysis of what the signing record captures and how it is used as evidence, see the guide on electronic signature audit trails.
Choosing the Right Signature Type
The right signature type depends on three factors: the risk level of the document, the document type and applicable law, and the jurisdiction of the parties involved.
| Scenario | Recommended type | Rationale |
|---|---|---|
| Standard NDA between known business parties | SES | Low risk; parties identified by business email; platform audit trail sufficient |
| High-value software license or MSA | AES | Tamper evidence and stronger identity binding reduce dispute risk |
| EU regulated financial document or notarial equivalent | QES | Legal requirement under eIDAS; equivalent to handwritten signature |
| Employment contract (US, standard commercial) | SES | ESIGN/UETA cover this; SES with platform audit log is standard practice |
| Will or deed of transfer (most jurisdictions) | Wet signature | Electronic execution may not be legally valid; consult local law |
For businesses starting with electronic signatures, the practical starting point is to identify your three most common document types, assess the risk level of each, and choose a signing platform that supports the appropriate tier. Most small and medium businesses will find that SES with a reputable platform (DocuSign, HelloSign/Dropbox Sign, Adobe Sign) meets their needs for routine commercial agreements. See the guides on signing business contracts online and electronic signatures for small businesses for implementation guidance.
Frequently Asked Questions
No. An electronic signature is a broad legal concept covering any electronic method of indicating intent to sign — a typed name, a drawn signature, a click, or a checkbox. A digital signature is a specific cryptographic mechanism that uses public-key infrastructure to bind a signer's identity to a document mathematically. All digital signatures are electronic signatures, but not all electronic signatures are digital signatures. See the companion guide on electronic signatures vs digital signatures for a full technical comparison.
About the Author: Mohamed Siraj
Mohamed Siraj is a security researcher and technical writer focused on document security, file-sharing workflows, and compliance tooling for distributed teams.