How does an electronic signature work?

The general principle

An electronic signature is not an image. It is a cryptographic process that links four inseparable elements: the document, the identity of the signatory, the moment of signing and technical proof that nothing was modified afterwards.

This process rests on two pillars: the authentication of the signatory and the integrity of the document.

Step 1: authenticate the signatory

Authentication consists of establishing a link between the person signing and a verifiable identity. Several techniques exist, and they can be combined:

• Trusted email address: a unique link is sent. Only the mailbox owner can click and sign.
• OTP code (One-Time Password): a one-time code is sent by SMS. The signatory enters it to prove they hold the associated phone number.
• Personal certificate: for the qualified signature, a certificate issued by a qualified provider proves the signatory's identity.

The level of assurance required varies with the signature level you are aiming for — see the differences between levels.

Step 2: compute the cryptographic hash

Before signing, the platform computes a hash of the document. It is a unique string of characters that represents the file's contents. Any change, even to a single character, produces a completely different hash.

The hash is like a digital fingerprint of the file: it is small (a few dozen bytes) yet it guarantees integrity. If someone alters the document after signing, the hash no longer matches — the signature is invalidated.

Step 3: bind identity and hash

The platform encrypts the hash with a cryptographic key tied to the signatory's identity (through the PKI for QES, or through the platform for SES/AES). The result is the signature token: a digital object that contains all of:

• the hash of the document
• the signatory's identifier
• the precise timestamp
• the cryptographic signature itself

This token is embedded in the final PDF using the PAdES format (PDF Advanced Electronic Signatures), a European standard. In practice, when you open a signed PDF in Adobe Acrobat Reader, the reader automatically checks the token and shows "Signature valid" if everything matches.

Step 4: timestamp

The timestamp ties the signature to a precise, verifiable moment. A qualified timestamp issued by a trust service provider gives legal proof that the document existed on that date — a decisive argument in any dispute over the date of commitment.

See electronic timestamping to understand the role and the levels of timestamping.

Step 5: record in the audit trail

At every step of the signing cycle, the platform records a time-stamped event:

• envelope sent
• opened by the signatory (with IP and user agent)
• OTP entered
• signature completed
• refusal, if any
• expiry

Together these form the audit trail. It is the operational proof of the process. It is embedded in the final PDF and kept for 10 years. See electronic signature evidence.

What actually happens on the signatory's side

From the signatory's point of view, the experience is minimal:

1. They receive an email with a link.
2. They click and open the document in their browser.
3. They read it, then click "Sign".
4. For AES: they enter an SMS code received on their phone.
5. That is it. They receive a copy of the signed PDF.

No account to create, no app to install, no certificate to generate (except for QES). The whole thing takes 1 to 3 minutes.

What happens on the sender's side

The sender drives the process from their dashboard:

• uploading the document (PDF, automatic conversion from Word)
• adding recipients and placing the signature fields
• choosing the signature level and the order (parallel or sequential)
• configuring automatic reminders and the expiry date
• sending

In real time, they watch each envelope move from "sent" to "opened" to "signed". Webhooks or push notifications can forward these events to a CRM or an HRIS.

Why an electronic signature is hard to forge

• Cryptographic hash: any change invalidates the signature
• Strong authentication: without access to both the email AND the phone (for AES), impersonating the signatory is impossible
• Time-stamped audit trail: every step is traced with IP and user agent
• Cryptographic keys: the signatory's private key (QES) never leaves their hardware device
• 10-year archiving: the evidence remains usable long after signing

How Certyneo helps you

At Certyneo, the entire cryptographic pipeline runs on the backend on European servers (Germany, IONOS): PDF upload, SHA-256 hash computation, embedding of the PAdES token, timestamping, and storage of the audit trail in an encrypted PostgreSQL database. You get an eIDAS-compliant process without having to understand the technical detail.

Discover the Certyneo electronic signature solution

FAQ

Can I verify a signature without the platform that issued it?

Yes. A PDF signed in PAdES format can be verified by any compatible PDF reader (Adobe Reader, pdfsig, and others). Even if the issuing platform disappears, the signature stays verifiable.

What happens if I modify the PDF after signing?

The signature becomes invalid. The PDF reader shows a warning — "The document has been modified since it was signed" — and the hash no longer matches.

How long does an electronic signature last?

The signature stays valid for as long as the cryptographic algorithms it uses do. For long-term validity, PAdES-LTA (Long Term Archive) formats are used, embedding qualified timestamps that are regenerated periodically.

Can several documents be signed at once?

Yes. A Certyneo envelope can carry several documents, all signed in a single click. Each document keeps its own hash, but the audit trail is shared.

Does the hash reveal the contents of the document?

No. Hashing is one-way: you can compute the hash from the document, but you cannot recover the document from the hash. That is one of the fundamental properties of cryptographic hash functions.

Conclusion

An electronic signature is a cryptographic process that verifiably binds a signatory, a document, a date and a consent. The signatory needs to understand none of it — for them it is a click and an SMS code. For you, it is solid evidence, archived and ready to use.

Try Certyneo to send, sign and track your documents online simply, quickly and securely.