Three different things called a PDF signature

"Can you sign this PDF and send it back?" is a request with at least three possible meanings, and they have almost nothing technically in common. One is a picture, one is a record kept by a company, and one is cryptography. They offer wildly different levels of proof, and the word "signature" covers all three without distinguishing between them.

Nearly always, what is being asked for is the simplest one. But when it isn't, supplying the wrong thing wastes a round trip, or, worse, produces a document that doesn't hold up when it matters.

1. A picture of your signature

You draw your name with a finger or a mouse, or photograph it off paper, and the image is placed on the page. This is what most people mean, and what most requests actually need.

Cryptographically, it proves nothing: it's an image. Anyone who receives the document can crop your signature out and paste it onto something you never agreed to, and nothing in the file would contradict them. It carries no identity information and no evidence of when it was applied.

That sounds worse than it is in practice. A signature on paper proves very little in isolation either. Its force comes from context, the surrounding correspondence, and the fact that most people don't commit fraud over a delivery form. For internal approvals, consent forms, school paperwork and most day-to-day documents, a drawn signature is what's being asked for.

Two practical notes. Place the signature and then flatten the document, so it becomes part of the page rather than an object the recipient can drag around or delete. And be aware that a clean, high-contrast signature image sent by email is a reusable asset for whoever receives it, which is an argument for signing the specific document rather than sending a signature file to be applied by someone else. The PDF editor handles this kind of signing, drawing it into the page directly.

2. An e-signature service

DocuSign, Adobe Sign, HelloSign and their competitors do something different: they run the signing process and keep the evidence. The mark on the page is still usually just a picture. Its weight comes from everything recorded around it: that the document was sent to a verified email address, opened from a particular IP address at a particular time, that the signer clicked through specific consent language, and that the file hasn't changed since. The audit trail is the product the service sells.

This is what most jurisdictions have in mind in their electronic signature legislation, and it's the standard for contracts, employment paperwork, leases and property transactions. If someone says "send it through DocuSign", they're asking for the audit trail, and a drawn signature emailed back will not satisfy them however good it looks.

The trade-off is that the evidence lives with the provider rather than in the document. Verifying a signature years later means the service still existing and still holding the record.

3. A cryptographic digital signature

This is the one that is real cryptography, and the one people most often don't realise exists. Using a private key that only you hold, a computation is performed over the document's bytes and the result is embedded in the file. Anyone can check it against your public certificate.

That buys two strong guarantees. Integrity: change so much as one character of the document afterwards and verification fails, because the signature was computed over exactly those bytes. Even a one-character edit breaks verification. Authenticity: only the holder of the private key could have produced the signature, so if the certificate genuinely identifies you, the signature identifies you too.

It says nothing, though, about whether you agreed to the contents. It proves the document is unaltered and came from your key. Those are claims about the file, not about your intentions, which is why cryptographic signatures are the norm for published documents, software, invoices in countries that mandate e-invoicing, and official records: cases where "is this the real, unmodified document from the real issuer?" is the question being asked.

The catch is the certificate. A signature made with a self-signed certificate is cryptographically sound and will still show as untrusted in a reader, because nothing vouches for who you are. For the signature to display as trusted, the certificate must come from an authority the recipient's software recognises, which generally means buying one and proving your identity to the issuer. Sleek PDF's signing tool applies signatures of this kind using a certificate you already hold.

Which one do you need?

• Somebody wants your assent on ordinary paperwork. Draw it, flatten it and send it; anything more is unnecessary.
• A contract of real value, or anything an employer or lawyer is handling. Use whichever e-signature service they nominate. What they're asking for is the audit trail, and you can't reproduce it yourself.
• You are publishing or issuing a document: reports, certificates, invoices, anything where a recipient needs to confirm it's unaltered and really from you. Cryptographic signature.
• You just want to stop people editing it. None of the above, quite. Flattening prevents casual changes and a password controls who can open it. A cryptographic signature doesn't prevent editing; it makes editing detectable, which is a different and often better guarantee.

If you're unsure which one a request means, ask. "Do you need this through a signing service, or is a signed PDF back by email fine?" takes one line and saves an entire round of correspondence.