Xiliux“Sign it electronically” and “sign it digitally” sound the same and aren't. The confusion is comfortable until the day someone denies having signed and you have to prove otherwise. That's when the difference stops being terminological and decides whether the document holds.
Two things at different levels
An electronic signature is a broad concept: any data in electronic form a person uses with the intent to sign. A name typed at the foot of an email, an “I agree” checkbox, an image of a handwritten signature, a stroke on a tablet. It's a legal and functional category; it says there was intent to sign, not how it's guaranteed.
A digital signature is something far more concrete: a cryptographic technique. It's not a kind of drawing or a button; it's public-key math applied to the document. So the correct relationship is one of sets: every digital signature is an electronic signature, but not the other way round. The digital signature is one way of signing electronically —the one that adds verifiable technical guarantees.
How a digital signature works
The signer holds a key pair: a private one, kept and never shared, and a public one anyone can have. The process is:
- The hash of the document —its fingerprint— is computed.
- That hash is signed with the private key. The result is the signature.
- Anyone verifies with the public key that the signature could only come from the matching private key, and that the hash matches the current document.
Two guarantees fall out at once: integrity (alter a byte and the hash changes and the signature stops verifying) and origin (only the holder of the private key could produce it). Together they give non-repudiation: it's hard for the signer to later deny it was them.
What each one proves
A simple electronic signature —a typed name, an image— shows intent, and that has value. But it doesn't prove integrity: the document can be changed afterwards and the signature image stays there, identical. And it doesn't prove origin: an image is copied from another PDF. It's a signature, but weak against someone who disputes it.
A digital signature, by contrast, breaks on its own if the document is touched, and binds the act to a specific key. That's the practical difference: it's not that one is “valid” and the other isn't —many legal systems recognise effects for electronic signatures in general, and reserve stronger effects for those meeting certain technical requirements— it's that they prove different things.
The trust link
Here's the nuance almost everyone skips: a digital signature proves the document corresponds to a private key. That the key belongs to a person —and not an impostor who generated their own pair— is a separate, trust problem. Infrastructure solves it: a PKI, a certificate issued by an authority that verified the identity, or the process by which you validated the signer. The math binds the document to the key; trust binds the key to the person. Without the second link, a perfect digital signature could be anyone's.
Which to use
It depends on what the document has to withstand. For a low-risk internal acceptance, a simple electronic signature is plenty and the friction isn't worth it. When the document may end up before a third party who denies it —a contract of weight, evidence, a critical authorisation— the digital signature, with its trust properly set up, is the one that gives verifiable reasons instead of your word. The practical rule: pick the level of proof by the level of dispute you expect, not by habit.