Three Questions Hiding in One
When people ask "is it safe to sign a document online?" they're usually asking three different things at once:
1. Is it legally valid? — Will this signature actually hold up? 2. Is it secure? — Can someone forge it, or alter the document after I sign? 3. Is it private? — What happens to my document when I sign it this way?
The answers are genuinely reassuring for the first, more nuanced for the second, and often overlooked for the third — which is a shame, because signing is one of the moments you're most exposed. Let's take them in order, but first clear up the distinction that causes most of the confusion.
Electronic vs Digital Signatures — Not the Same Thing
These two terms get used interchangeably, but they mean very different things, and the difference is the key to everything else.
An electronic signature is the broad legal concept: *any* electronic indication that you intend to agree. A typed name, a signature you draw with a mouse or finger, a scanned image of your handwritten signature, even clicking "I agree" — all are electronic signatures.
A digital signature is a specific, high-security technology. It uses cryptography (public-key infrastructure, or PKI) to do two things a basic electronic signature cannot: cryptographically verify who signed, and detect whether the document was changed after signing.
The relationship is one-directional: every digital signature is an electronic signature, but most electronic signatures are not digital signatures.
| Electronic signature | Digital signature | |
|---|---|---|
| What it is | Typed name, drawn mark, or image | Cryptographic seal (PKI) |
| Verifies signer identity? | No | Yes |
| Detects tampering after signing? | No | Yes |
| Legally valid? | Yes, in most cases | Yes, highest assurance |
| Example | Drawing your name on a touchscreen | A certificate-based signature in Adobe Acrobat |
Keep this distinction in mind — most "sign online" tools produce the basic electronic kind, which is fine for everyday agreements but is *not* tamper-evident.
Is It Legally Valid? Mostly Yes
For the legal question, the news is good. In the United States, the ESIGN Act (2000) and the UETA make electronic signatures legally equivalent to handwritten ones for most transactions. In the European Union, the eIDAS regulation does the same, defining three tiers of increasing assurance — Simple, Advanced, and Qualified — where a Qualified Electronic Signature carries the same legal weight as a handwritten one.
A standard electronic signature with a clear audit trail (who signed, when, from where) satisfies the legal requirement for the vast majority of business agreements: contracts, proposals, vendor and employment documents.
There are exceptions. Things like wills, certain trusts, and some family-law matters are often excluded and may still require ink on paper. Rules also vary by country and by document type, so for anything high-stakes it's worth confirming the requirement for your specific situation. *(This is general information, not legal advice.)*
Is It Secure? It Depends What "Signature" Means
Here's where the electronic-vs-digital distinction bites. Legal validity and security are not the same thing.
A drawn or typed signature is just a picture or text placed on the page. It carries no proof of who added it and no protection against changes. Two consequences follow:
- It can be copied. A signature image sitting in a PDF can be lifted out and pasted onto another document. If you've emailed a signed PDF, you've effectively shared a reusable image of your signature.
- The document can be altered after signing. Because nothing binds the signature to the document's contents, someone could change a number or a clause and the signature would still sit there looking valid.
A digital signature closes both gaps. It creates a cryptographic fingerprint (a hash) of the document at the moment of signing and seals it with your private key. Any later change to the document — even a single character — breaks the fingerprint, and any reader verifying the signature will see it's no longer valid. It also ties the signature to a certificate that identifies you. This is tamper-evidence, and it's the reason high-stakes agreements increasingly call for digital, not just electronic, signatures.
It's worth noting this is different from password-protecting a PDF. Encryption controls *who can open* a file; a digital signature proves *who signed it and whether it changed*. They solve different problems, as we cover in PDF encryption explained.
Is It Private? The Question Nobody Asks
This is the dimension that gets the least attention and deserves the most — because of *what* you're signing.
The documents you sign are, almost by definition, your most sensitive: contracts, financial agreements, NDAs, offer letters, legal filings. And the standard way to sign online is to upload that document to a third-party service, where it sits on someone else's server while you add your signature.
Think about what that means. To protect an agreement with your signature, you first hand the entire un-signed, confidential document to a company you may know nothing about. Their security, their retention policy, their employees, and any legal requests they receive now all touch your document. For a routine form, fine. For a genuinely confidential agreement, you've created exactly the exposure we describe in the hidden risks of uploading PDFs to free online tools — at the worst possible moment, with the worst possible document.
The alternative is to keep signing local: add your signature in a tool that works on your own device, so the document is never uploaded anywhere. You still get a legally valid electronic signature; you just don't broadcast the contents to a third party to get it.
Matching the Method to the Stakes
There's no single right answer — the sensible approach scales with what's at risk:
- Everyday, low-stakes agreements (an internal form, a low-value approval): a drawn or typed electronic signature is legally fine and perfectly reasonable. Don't overthink it.
- Confidential documents (anything you wouldn't want a stranger reading): prioritize keeping the file off third-party servers — sign locally, and share the signed result directly.
- High-value or disputable agreements (large contracts, anything a counterparty might later challenge): use a tamper-evident digital signature so the document's integrity can be proven, not just asserted.
- Documents you receive signed: if it matters, verify the signature. A digital signature can be checked in your PDF reader; a drawn image can't be verified at all — treat it as a claim, not proof.
Common Misconceptions
"Electronic signatures aren't legally binding." They are, for most transactions, under ESIGN/UETA and eIDAS. The handwritten-only cases are the exception, not the rule.
"A drawn signature is secure." It's a picture. It proves nothing about who added it and doesn't protect the document from changes.
"Signing and password-protecting are the same." No — one proves integrity and authorship, the other controls access. You might use both, for different reasons.
"Digital and electronic signatures are interchangeable terms." They're not. The digital kind is the cryptographic subset that adds tamper-evidence and identity verification.
The Bottom Line
Signing documents online is legal and, for everyday use, perfectly safe. But "signed" and "secure" aren't the same: a drawn or typed signature is legally valid yet is just an image that can be copied and doesn't protect the document from being altered, while a cryptographic digital signature adds real tamper-evidence. And whichever you use, remember that online signing usually means uploading your most sensitive document to a third party — so for anything confidential, the safest signature is one you add on your own device, without the file ever leaving your hands.