Digital signature vs electronic signature in India: what's the difference?

In Indian law, "electronic signature" is the wider term and a digital signature is one kind of it. The Information Technology Act, 2000 defines an electronic signature as authenticating an electronic record using a technique listed in the Act's Second Schedule, and says that this includes a digital signature. In everyday use, a "digital signature" usually means one made with a Digital Signature Certificate (DSC), and the other common type is Aadhaar-based eSign.

A picture of your handwritten signature pasted into a PDF is neither of these. It may still be accepted for plenty of everyday paperwork, but that's the recipient's decision, not something the Act guarantees. This explainer sets out the three side by side. It is general information, not legal advice.

The three things people call an "e-signature"

What the IT Act actually says

Three provisions do most of the work.

Section 2(1)(ta) defines an electronic signature as "authentication of any electronic record by a subscriber by means of the electronic technique specified in the Second Schedule and includes digital signature."

Section 3 covers the digital signature itself. It works with an "asymmetric crypto system and hash function": the signer uses a private key, and anyone with the matching public key can check the record. This is the technology behind a DSC.

Section 3A lets a subscriber use other electronic signatures, provided the technique is considered reliable and is specified in the Second Schedule. The Act lists what reliable means, including that:

• the signature data is linked to the signatory and to no other person,
• it was under the signatory's control at the time of signing, and
• any change to the signature or to the information after signing is detectable.

Section 5 then says that where a law requires something to be signed, the requirement is met by an electronic signature affixed in the manner the Central Government prescribes.

Put those together and the gap with an image signature is plain. Anyone who has a copy of your signature image can paste it anywhere, and if someone edits the document afterwards, nothing in the file shows it. A pasted picture doesn't have the properties section 3A describes.

How a DSC works in practice

A Digital Signature Certificate is issued to you by a licensed Certifying Authority after it checks your identity. The CCA publishes the list of licensed CAs on its website. The certificate and its private key are commonly kept on a USB token, which you plug in when you sign.

You'll meet DSCs in places like company filings and tax. The income tax e-filing portal, for instance, lists "Digital Signature Certificate" as one way to e-verify a return, and it asks for the DSC USB token to be plugged in along with a signing utility on your computer.

A DSC costs money, has an expiry date and needs some setup. For someone who signs official filings regularly, that's worth it. For signing a rent receipt once a year, it's overkill.

How Aadhaar eSign works

eSign is an online service. You don't buy anything yourself; the organisation asking for your signature (a bank, a lender, an e-stamp platform, an HR system) integrates it into its own website or app.

According to the CCA, the flow is:

1. You choose to eSign a document in that organisation's app or website.
2. You authenticate through Aadhaar e-KYC, by OTP on the mobile number registered with your Aadhaar, or by fingerprint or iris.
3. A licensed Certifying Authority issues a short-lived signature certificate, signs the document and destroys the key after that one use.

The CCA describes eSign as legally recognised, and its e-authentication guidelines place the service under the IT Act's Second Schedule. You need an Aadhaar number and a working Aadhaar-linked mobile number for the OTP route.

The practical point: you can't eSign a PDF on your own just because you have Aadhaar. It happens through a service the other party has set up.

Where an image signature fits

Most people who search "e-sign PDF" want something simpler: put their signature on a form or agreement without printing and scanning it. A signature image does that. Our Sign PDF tool is one way to do it, and it says plainly what it is: a picture of your signature, initials, date or text placed on the page. It's not a DSC and not an Aadhaar eSign, and it doesn't verify who signed, add a timestamp or create an audit trail.

That doesn't make it useless. Lots of organisations accept a signed PDF or a scanned signature for routine documents, such as HR forms, offer letter acknowledgements, society forms or simple declarations. They're choosing to accept it under their own policy. The steps are in our guide on signing a PDF without printing.

Which one do you need?

Go by what the person or portal asks for:

• "Sign and send back the PDF" with no other detail: ask whether a signed PDF is fine. Often it is.
• "Upload a digitally signed document" or "sign with DSC": you need a DSC. An image won't do.
• "eSign using Aadhaar OTP": use the eSign flow inside their app or website.
• A will, a trust deed, or a document a lawyer is preparing: check first. The IT Act's First Schedule lists documents to which the Act doesn't apply, and wills and trusts are among them. The Schedule was amended in 2022 for some other documents, so take advice on anything property- or finance-related.

If you've been sent a PDF that's already digitally signed by someone else, be careful about adding anything to it. Any change to the file makes the existing signature show as invalid or changed. Our Sign PDF tool warns you when it spots one.

Questions people ask

Is a scanned signature valid in India?

There's no single answer. It isn't a digital signature or a technique listed in the IT Act's Second Schedule. Whether it's accepted for your document depends on the document and on whoever is receiving it, so ask them.

Is Aadhaar eSign the same as a digital signature?

Both create a cryptographic signature backed by a certificate from a licensed Certifying Authority. The difference is how you get it: a DSC is issued to you and you keep it, while eSign gives you a one-time certificate after an Aadhaar check, through someone else's service.

Can I make a DSC myself?

Not one that the CCA's system recognises. Software can create a self-signed certificate, but PDF readers will show it as not trusted. A DSC comes from a licensed Certifying Authority.

Does a typed name count as an electronic signature?

Not in the sense of the IT Act's definition. Whether a typed name is enough for a particular agreement is a question for the recipient or a lawyer.

Can I fill a form and then add a DSC?

Yes. Fill the fields first, for example with Fill PDF Form, then apply the DSC as the last step in your DSC software. Anything changed after the DSC is applied makes it show as invalid.

Sources

• PRS Legislative Research: The Information Technology Act, 2000 (text with amendments), sections 2(1)(ta), 3, 3A, 5 and the First Schedule
• Controller of Certifying Authorities: eSign
• Controller of Certifying Authorities: eSign brochure
• Controller of Certifying Authorities: e-Authentication guidelines for eSign
• Controller of Certifying Authorities: Licensed CAs
• Income Tax Department: How to e-Verify your return
• Leegality: Amendment to Schedule I of the IT Act (explainer on the 2022 changes)