Many people use the terms "electronic signature" and "digital signature" as if they were one thing, and then land in awkward situations: a client asks for a "digital signature" and is sent a link where he signs by drawing his name, or a manager rejects a signing platform because he heard that only the "digital" kind is recognised. The truth is that the difference between an electronic signature and a digital signature is the difference between a broad concept and a specific technology within it. Every digital signature is an electronic signature, but not every electronic signature is a digital signature.
In this article we explain both without technical complexity: what each one is, how a digital signature works with a public key and a certificate, how they differ in legal strength and practical experience, and when to choose one or the other. For each point we cover why it matters, how to apply it, the common mistake and a practical example, followed by a checklist and frequently asked questions.
1. The electronic signature is a broad legal concept
Why it matters: When you know that the electronic signature is a legal concept and not a particular technology, you are freed from the illusion that there is a single correct method. Egyptian Law No. 15 of 2004 defines it as anything placed on an electronic document in the form of letters, numbers, symbols, signs or the like, with a distinctive character that identifies the signatory and distinguishes him.
What falls within it: Drawing the signature on screen, typing a name, clicking an "I agree" button, entering a verification code sent to email or phone, and signing with a digital certificate on a token. All of these are electronic signatures, and the difference between them lies in the strength of their link to the person and the evidence preserved with them.
The common mistake: Judging the electronic signature by its weakest form and saying it is just an image that can be copied. An image alone is indeed weak, but an electronic signature enhanced with a verification code, an event log, a fingerprint and a timestamp is something entirely different.
Example: A customer signs an internet service subscription by entering a code that reached his phone and then typing his name. There is no token or certificate here, but it is an electronic signature with evidence: the code went to his number, the time of entry is recorded, and the contract is locked by its fingerprint.
2. The digital signature is a specific cryptographic technology
Why it matters: The digital signature is the method that achieves the strongest link between the signature, the signatory and the document all at once, and it is the basis of signing with a certified certificate. Knowing how it works, even in simplified form, lets you assess what any provider offers.
How it works in brief: The signatory has a pair of keys: a private key he keeps secret, usually inside a token from which it never leaves, and a public key that anyone may know. At signing, the document's fingerprint is calculated, and this fingerprint is signed with the private key. Later, any party can use the public key to verify that the signature came from the owner of the private key and that the document has not changed by a single character since signing.
- A unique number called the fingerprint, or hash value, is calculated for the document.
- The fingerprint is signed with the signatory's private key.
- The signature and the certificate are attached to the document.
- At verification, the fingerprint is recalculated and the signature is checked with the public key.
- If they match, it is established that the signature came from its owner and that the document is intact.
The role of the certificate: The public key alone does not say who its owner is. This is where the digital certificate comes in, issued by a licensed certification provider, which links the public key to the person's name and details after verifying his identity. That is why the evidentiary strength of a digital signature depends on the body that issued the certificate.
The common mistake: Assuming that any digital signature is necessarily strong. If the certificate is self-issued, meaning the person created it for himself without a trusted body, it proves the document's integrity but does not prove the signatory's identity.
Example: A PDF reader sometimes displays "Signature is valid but the signer's identity is unknown." This means the file has not changed, but the certificate was not issued by a body the program trusts.
3. A direct comparison between the two concepts
| Criterion | Electronic signature (in the general sense) | Digital signature with a certified certificate |
|---|---|---|
| Nature | A legal concept covering multiple means | A cryptographic technology using a public key |
| What the signatory needs | An email, phone or account | A certificate from a licensed provider, usually on a token |
| Proof of identity | Depends on the verification means used | Built into the certificate after the provider's verification |
| Detecting alteration | Through the document fingerprint and log, if present | Built into the signature itself |
| Ease of use | Very high, from any device | Needs the token and its software |
| Strength as evidence | Varies according to the evidence | The highest |
| Suitable use | Most everyday contracts | High-value or conditional transactions |
How to read the table: The table does not mean that one is absolutely better. The digital signature is stronger, but it requires every party to hold a certificate, which is not always available. An enhanced electronic signature is much easier and provides sufficient evidence for most transactions.
4. Where the two concepts meet in practice
Why it matters: Good platforms do not make you choose sharply between the two concepts but combine them. Even when a party signs with a verification code, the platform can seal the final file with a digital signature that protects its integrity, and fix its time with a trusted timestamp.
How this happens: Each party signs by the method available to him, then the final file's fingerprint is calculated, a timestamp from an independent party is attached, and the event log is preserved. If one of the parties has a token, he signs with it, and the file carries his digital signature with his certificate.
This is what the Wthaiq platform does: a party signs by drawing or typing his name after a verification code by email or WhatsApp, or with a token issued by a licensed certification provider if he has one. The document fingerprint, the timestamp and the audit log are preserved with the contract, and the platform verifies the token's certificate and records the result.
The common mistake: Asking every party for a token in a simple contract, so signing is delayed by weeks until the other party obtains a certificate he did not need.
Example: A supply company signs with dozens of small shops. The company owner has a token and signs with it, while the shop owners sign with a code sent to them via WhatsApp. The contract carries both methods, and each party signed in the way that suited him.
5. When should you choose the digital signature with a certificate?
Why it matters: The right decision balances strength of evidence against ease of procedure. Excess in either is costly: either delay and alienation, or weak evidence in a sensitive situation.
- High-value transactions: such as partnership, acquisition and large financing contracts.
- What a particular authority requires: such as certain government or banking bodies that ask for signing with a certified certificate.
- High likelihood of denial: such as dealing with a party with whom a dispute has arisen before.
- Signing on behalf of a company on fundamental decisions: where you want indisputable proof that the authorised person himself signed.
And when an enhanced electronic signature is enough: Employment contracts, service and subscription contracts, leases, purchase orders, confidentiality agreements and engagement letters. In these cases the level can be raised by identity verification, matching the face to an official document, without the need for a token.
Example: A law firm signs engagement letters with its individual clients using the enhanced signature, and requires token signing in large dispute settlement contracts between companies.
6. Related terms that get mixed up with the two concepts
| Term | Meaning |
|---|---|
| Digital certificate | A file linking the public key to its owner's identity, issued by a certification provider |
| Token | A small device that stores the private key and the certificate and does not allow the key to be extracted |
| Certification provider | A body licensed by ITIDA to issue certificates in Egypt |
| Document fingerprint | A numeric value that changes entirely if any part of the file changes |
| Timestamp | A stamp from an independent party proving the document existed at a specific moment |
| Signature embedded in a PDF | A digital signature stored inside the file itself, shown in reader programs |
The common mistake: Calling any signature on a PDF file a "digital signature." If a signature image is added to the file without a cryptographic signature, it is a simple electronic signature, not a digital one.
7. How to word the signing-method clause in the contract
When the signing method differs between parties, it is good for the contract to say so expressly, so that no one later claims that the other party's method is not acceptable. A wording such as this can be used:
The Parties agree that this Contract may validly be signed by any electronic means that identifies the signatory, whether by an electronic signature accompanied by a verification code or by a digital signature with a certificate issued by a licensed certification provider, and that each regards the signature issued by him as binding on him.
If one of the authorities requires signing with a certified certificate, state this clearly:
The First Party signs this Contract with a digital signature using a valid electronic certification certificate issued by a licensed provider in the Arab Republic of Egypt.
8. How to check the type of signature on a contract you receive
Why it matters: You may receive a contract signed by another party who tells you it is "digitally signed." Before you build obligations on it or pay amounts, you have the right to know what was actually used to sign and whether the signature is sound. A contract carrying only an image of a signature is very different from one carrying a digital signature with a certified certificate, even if the two look alike on screen.
How to check: Open the file in a reader that shows the signatures panel, and see whether a digital signature is embedded in the file. If there is one, read the certificate holder's name, the body that issued it and its validity date, and make sure the program says the document has not changed since signing. If the contract came from a signing platform, look for the verification number or QR code, and open the public verification page to see the parties, the times of their signatures and the document's fingerprint. Then calculate the fingerprint of the file you have and compare it with the one displayed.
The common mistake: Relying on the look of the last page, so that on seeing a signature and a stamp you feel reassured. The image says nothing about the integrity of the file, since it can be added to any document after it has been altered.
Example: An accountant at a company received an addendum to a supply contract raising prices, with the supplier's signature and stamp at the end. He opened the verification page from the attached link and found that the addendum's recorded fingerprint did not match the file he had received, which showed that the file had been altered after signing. He stopped payment until the supplier resent the original addendum, and it turned out that the increase was smaller than in the altered copy.
This simple step protects you from many problems, because it turns the question from "Do I trust the other party?" into "Does the file match what was signed?", a question with a definitive answer.
It is good to make this check a fixed part of the finance and legal departments' procedures, so that no payment is made and no performance begins on the basis of an electronic contract before its fingerprint is matched. If the contract carries no means of verification, ask the other party to sign it again through a platform that preserves evidence, or with a certified digital certificate, before you rely on it for a large obligation. This request is not doubt about their intentions but protection for both parties, because strong evidence protects the one who signed as much as the one who received.
Checklist for choosing the type of signature
- What is the value of the transaction, and what would be the effect if the signature were denied?
- Does any authority require signing with a certified certificate?
- Do all parties have tokens, or will that delay signing?
- Will the document fingerprint and a timestamp be preserved with whichever type you choose?
- Do you need identity verification instead of a token?
- Does the contract state the accepted signing methods?
Frequently asked questions
Are the digital signature and the electronic signature the same thing?
No. The electronic signature is a broad concept, and the digital signature is one form of it that relies on public-key cryptography and the digital certificate.
Which is recognised in Egypt?
Both fall within the definition of the electronic signature in Law No. 15 of 2004, and a signature tied to a certificate from a licensed provider enjoys the strongest position in evidence.
Can the two methods be combined in one contract?
Yes. Each party signs by the method available to him, and a record is kept with the contract showing each party's method.
Where do I get a certified digital signature?
From one of the electronic certification providers licensed by ITIDA, and the certificate is usually delivered on a token.
Does a digital signature prevent the file from being altered?
It does not physically prevent alteration, but it reveals it immediately, since the signature shows as invalid if the file changes afterwards.
Does a digital signature expire?
A digital certificate has a validity period, but a signature made while it was valid remains valid after it expires, especially if its time was fixed with a trusted timestamp showing that the signature was made before the certificate expired or was revoked. That is why it is always advisable to pair a digital signature with a timestamp, so that no doubt arises years later about the date of signing.
Does a digital signature look different to the other party?
It may look like any other signature on the page, but the difference appears when it is examined: supporting reader programs display the certificate holder's name, the issuing body and the document's status, and warn you if it changed after signing.
Conclusion
The electronic signature is the legal umbrella, and the digital signature is a strong technology beneath it. The smart choice neither imposes a token on every contract nor settles for a signature image in a sensitive transaction, but matches the level to the risk. If you want a platform that accepts both methods and preserves the evidence for each, try the Wthaiq platform on your next contract.
And remember that the choice between the two methods is not a one-time decision, but one to be reviewed whenever the nature or value of your transactions changes.
This article is for general awareness and does not constitute legal advice.