What is an electronic signature and how does it work?

An electronic signature is defined in Article 3(10) of the eIDAS Regulation (EU) No 910/2014 as data in electronic form that is attached to or logically associated with other electronic data and used by the signatory to sign. The definition is purely legal and technology-neutral: it covers a scanned signature image as well as a cryptographically protected qualified signature.

What matters is not how a signature looks but whether two things can be proven: who applied the mark (authenticity) and that the document has not changed since (integrity). From the advanced level upwards, both properties are established cryptographically rather than merely asserted.

Here's how an electronic signature works:

• Identity verification: Before a signing certificate is issued, the signatory is identified — via eID, video identification or in person, depending on the signature level.
• Certificate issuance: A trust service provider binds the verified identity to a key pair and issues an electronic certificate.
• Hash generation: A unique, tamper-evident hash value is calculated from the document, representing its entire content.
• Signature creation: The hash value is encrypted with the signatory's private key and attached to the document.
• Signature validation: Recipients decrypt that value with the public key and compare it against the hash they compute. Any later change breaks the signature visibly.
• Timestamp and long-term validation: A qualified timestamp and embedded validation data keep the document verifiable for years, even after the certificate expires.

eIDAS distinguishes three signature levels:

• Simple electronic signature (SES): Lowest level, no prescribed identity check. Suitable for internal approvals, purchase orders and announcements.
• Advanced electronic signature (AES): Must meet Article 26 eIDAS: uniquely linked to the signatory and capable of detecting subsequent changes. Typical for sale and lease agreements.
• Qualified electronic signature (QES): Based on a qualified certificate and a qualified signature creation device (QSCD). Legally equivalent to a handwritten signature under Article 25(2) eIDAS.

At primesign, all three eIDAS signature levels are delivered on one platform — through primesign ENTERPRISE for configurable signature workflows, the primesign SIGNATURE SERVER for API integrations, and primesign REMOTE SIGNING for qualified remote signing with ID Austria, the German national ID card and future EUDI Wallets. As a listed qualified trust service provider, primesign produces long-term validatable PAdES signatures that Adobe Acrobat Reader recognises as trustworthy automatically.