How to Choose an E-Signature: Image, Certificate, or Platform

A signature image takes two minutes to make and proves almost nothing. A digital certificate proves a file was not altered, yet says little about who held the key. A signing platform bundles identity checks, timestamps, and evidence into one fee. This guide helps you decide which one a given document actually needs.

What a PNG Signature Solves, and What It Does Not

Most people sign by writing a name, exporting a PNG, and pasting it into Word, a PDF, or an email. The gain is speed. No printer, no meeting, no scanner. A delivery confirmation that used to take half a day now takes two minutes.

The gain is not proof. A PNG is an image file. Anyone who has it can paste it onto another document. Change one digit in the contract and the picture still looks fine. Nothing records who signed, when, on which device, or against which version of the file.

A simple test helps. Ask who pays if the document goes wrong. Between colleagues, a signature usually stands for "I have seen this", and an image is enough. On a document that triggers payment or hiring, or could end up in court, the signature stands for "I accept this obligation". For those documents, an image is not enough.

One more point is easy to miss. A signature image is a copy of handwriting, and it falls well short of a reliable electronic signature. In a dispute it works more like a pasted stamp, and the other side can simply deny it.

Three Tiers and Three Kinds of Proof

Options fall into three tiers, with the platform tier split into standard and qualified service. Prices run from zero to tens of dollars per document, and each tier adds a different kind of evidence. The table sums up the trade-offs; the sections below explain why.

Three things separate the tiers: how identity is checked, whether changes can be detected, and whether the time of signing can be fixed. The "prove" column describes evidence strength, not a legal verdict.

Tier One: The Signature Image

There is no barrier to entry. Sign on a screen or on paper, export a bitmap, paste it in. Once embedded, it can be copied, deleted, or swapped like any other picture. Identity rests on whether the reader recognizes your handwriting. Integrity rests on nobody wanting to change the file.

The time saved is real, and so is the risk. An image makes sense when the document is internal, the amount is small, the parties know each other, and other records exist. A reimbursement form with an approval trail in the finance system is a good case. If a dispute starts, the approval log matters more than the picture.

Tier Two: Cryptographic Signatures

A digital signature is not a digitized autograph. It is a cryptographic process. The sender hashes the document, then signs that hash with a private key. The recipient verifies with the public key inside a certificate. Change one byte and the hash no longer matches, so verification fails.

A certificate authority binds a public key to an identity. The binding has a limit. A certificate proves that a key belongs to a named person or organization. It does not prove that the person at the keyboard is that person. Anyone who obtains the private key, on a laptop or a USB token, can sign as the owner.

PDF signatures can carry a timestamp. A timestamp authority certifies that a given hash existed at a given moment. Long-term validation data keeps that proof alive after the certificate expires or is revoked, so the file still verifies years later.

Cost is low and maintenance is the catch. Internal CAs, open-source tools, and self-signed certificates all work. They suit internal systems, software releases, and archived technical records. Send one to an outside client and the trouble starts. The client does not know how to verify it, or whether to trust your root certificate.

Tier Three: Signing Platforms

A platform packages the pieces: a CA certificate, identity verification, an SMS or face check, a timestamp, an audit trail, and a downloadable evidence report. The user sees one click. Behind it sits a full identity check and a chain of custody.

"Compliant" is a marketing word, not a legal category. Check four things before you buy. Which CA issues the certificate? Does the platform verify identity and intent? Can you export an evidence report with the document hash? Will it help if a dispute reaches arbitration? A banner that says "meets e-signature law" is not evidence.

Pricing varies widely. Standard plans charge per envelope, often a few dollars. Qualified signatures need a qualified certificate and device, cost tens of dollars, and sometimes require a video interview. High volume is worth a yearly contract.

What the Law Actually Requires

China, the EU, and the US write the rules differently and aim at the same target. An electronic signature does not need to look handwritten. It needs to be attributable to a person, and changes need to be detectable. The notes below are general; ask a lawyer about a specific document.

China's Electronic Signature Law lists four conditions for a "reliable electronic signature". The signature creation data belongs exclusively to the signer. At the time of signing, only the signer controls that data. Any later change to the signature can be detected. Any later change to the content or form of the data message can also be detected. Meet all four and the signature has the same effect as a handwritten signature or seal.

The law also excludes some documents. Those involving marriage, adoption, or inheritance are outside its scope, as are notices to cut off water, heating, or gas service. Other exclusions can come from statutes and administrative regulations. No signing tool fixes those cases.

One point is widely misread. The law does not require a particular vendor. A self-built system that meets the conditions can work in theory. The hard part is convincing a judge that your system is reliable, which is why most organizations buy a service.

EU eIDAS defines three levels. A simple electronic signature (SES) only has to be electronic data attached to a message and used by the signer. No strict identity check applies. An advanced signature (AES) must be uniquely linked to the signer and able to identify the signer. It must be created with data the signer alone controls, and it must reveal any later change. A qualified signature (QES) adds a qualified certificate and a qualified signing device. Across the EU, it has the same legal effect as a handwritten signature.

The levels differ in identity assurance and liability, not in math. When a counterparty demands QES, an SES file will likely come back. Redoing the deal costs more than getting the level right at the start.

The QES label is European. Chinese platforms usually offer a reliable signature that meets the four conditions, and the EU tiers matter mainly with European counterparties.

US ESIGN and UETA set one baseline: a signature or record cannot be denied legal effect just because it is electronic. The analysis turns on intent and attribution. Did the person mean to sign? Can the record be retained accurately? Did both sides agree to electronic records? Wills, adoption, divorce, and court documents are usually excluded, and state details differ.

This approach is the most forgiving toward images. An email that says "I agree" can, in principle, count as a signature. Forgiving is not the same as easy to prove. Attribution fights still happen, just with different evidence.

Where an Image Is Enough, and Where It Is Not

Sorting use cases into two groups beats memorizing statutes.

The first group holds internal approvals such as leave requests, expense claims, and company seal requests. It also covers delivery receipts, material handovers, and sign-off on designs, copy, and quotes. Classroom assignments, training attendance, and event waivers fit here too. The pattern is a small amount, familiar parties, and chat or email records in reserve.

The second group covers employment contracts, loan agreements, equity documents, and leases. It also includes high-value NDA clauses and anything that may reach a courtroom. The pattern is a large amount, a counterparty you may not know, and a file someone will reopen years later.

The middle ground causes the most trouble. Picture a purchase order worth a few thousand dollars with a client for three years. The amount is not trivial and the relationship is not close. The image worked for two years. Then a new procurement manager arrives and says the contract never existed, which stalls payment.

Ask what else you hold if the signature is denied. With only a PNG, move up a tier. With email confirmation, payment records, delivery notes, and chat logs that corroborate each other, the image becomes a manageable risk.

Also ask whether the other side accepts it. Legal permission is not acceptance. Banks, schools, government offices, and corporate legal teams often have their own forms and platforms. One question at the start saves a round of rework: "Do you accept e-signatures, and on which platform?"

Making a Signature Image That Holds Up

The signature pad on this site exports a 1200 × 420 PNG with a transparent background. Ink can be black, blue, or red, and stroke width runs from 1 to 8. At 300 DPI that canvas is about 10.2 cm wide, larger than a real handwritten signature. Scale it to 3 to 5 cm inside a document and the edges stay clean.

Settings matter. Use a stroke width between 3 and 5; thin lines break when shrunk, thick ones look clumsy. Write slowly enough to keep the start and end of each stroke clear. Black is right for formal documents. Blue helps separate an original from a copy, and red belongs in annotations. Export as a transparent PNG for overlaying. The white background option leaves a visible box on dark pages, and it is only useful for standalone printing.

Do not photograph a signature. A photo brings perspective, shadow, paper texture, and background. Cut it out and the edges fray; scale it and the flaws show. Do not convert the same PNG to JPG over and over either. Every pass leaves blocks around the strokes, and on white paper they read as gray fuzz.

Crop the empty margins before use. The canvas is a fixed size, so a small signature leaves a lot of blank space. The placement box then ends up far larger than the ink. Run the PNG through the image cropper, trim to the strokes, and positioning becomes easy.

Pick pixel dimensions from the intended print width. On screen, 600 pixels is plenty. For print at 300 DPI, 3 cm needs about 354 pixels and 5 cm needs about 591. The table gives the common cases.

Placing the image is the last step. Word inserts a PNG and lets you float it above the text. Most PDF editors let you place an image directly, then drag it onto the signature line. The PDF watermark tool here adds text only, in Latin characters, digits, and common symbols. It is useful for marking a file DRAFT or VOID, and it cannot insert a signature. Once the image is placed, finalize the file. Every later edit means signing again.

The whole flow runs in the browser. Strokes are never uploaded, and a refresh clears them. A signature sample deserves the same care as an ID card, and local processing removes one place where it could leak. The local processing guide explains how that works.

Six Expensive Misconceptions

A signature is not a contract. The signature evidences assent. A contract also needs agreement on its essential terms. A page with a beautiful signature but no subject matter or price binds nobody. The reverse also holds. Emails plus payment records can form a contract with no signature at all.

A scan is not an electronic signature. A scan is a picture of a paper original, which makes it a copy. It cannot show who holds the original or whether pages were swapped. Offices accept scans because they check them against originals, not because a scan proves anything on its own.

PDF encryption is not a signature. Open passwords, permission passwords, and print restrictions are access controls. They limit who can open or edit a file. They do not bind a signature to a person. An encrypted file with no signature can be altered and re-encrypted to look normal.

Skipping timestamps and evidence. A signature answers who, and a timestamp answers when. Without a trusted time source, backdating and late signing are hard to disprove. Evidence also has to be exportable and verifiable by a third party. A screenshot sitting in a vendor dashboard proves little.

Treating any digital signature as valid. A self-signed certificate produces a real digital signature, and a reader may show "signature valid". It shows only that the file is unchanged. It does not prove that the signer is who the certificate names. The issuance process is what gives a certificate its weight.

Assuming the platform makes the contract valid. A platform certifies one signing event, not the legality of the deal. Illegal terms or a signer without authority remain your problem. Technology settles attribution and integrity. Commercial and legal judgment still need a person.

A Three-Minute Decision Test

Run three questions and the answers point to a tier.

1. What is the worst outcome? A few hundred dollars, or tens of thousands, a lost job, or a court date?
2. Will the other side accept an image? A colleague or long-term client, or a bank, school, or government office?
3. Will anyone need to prove this in six months, before a court, an arbitrator, or an auditor?

If any answer is heavy, move up one tier. The table shows the common combinations.

Read the table by stakes first, counterparty second, evidence third. When the three conflict, take the stricter tier rather than an average.

One internal rule of thumb works well. Move to a platform when any of these is true. The amount exceeds a month of salary, the term runs beyond a year, or the counterparty is an organization rather than a person. The line is not precise, but it is consistent, and a team can agree on it.

When the counterparty names a platform, the tier debate is over. Register, verify, and sign where they ask. Confirm three practical details. Who pays? Can you download the evidence? Can you still reach past documents after you leave the company or change your phone number?

One Rule to Remember

Use images for internal flow and platforms for external contracts. For anything above a month of salary, or likely to reach court, add a qualified signature and a lawyer's review. The tiers do not replace each other. They spread cost in proportion to risk.

If you remember one line, make it this: ask where the document ends up if it goes wrong. If the answer is anything more than an email thread, do not use a PNG.