Signature image, hash, or seal: three things with one name
The category uses "secure" for all three. They are very different, and knowing which you have is the whole point.
Evidence · 2026-10-20 · 5 min read
Ask a vendor whether documents are "securely signed" and you will get a yes. Ask which of these three they mean and the conversation gets much more useful.
1. A signature image
The drawn or typed squiggle placed on the page. It is a picture. It carries no cryptographic meaning at all — it can be copied out of one PDF and pasted into another in about a minute. Its value is that it looks like what people expect a signature to look like, and it is evidence of intent in context, not of integrity.
2. A hash, or integrity record
A SHA-256 digest of the document’s exact bytes, recorded at a known moment. Later, anyone can recompute it and see whether the file has changed. This is real and verifiable — and it proves exactly one thing. It does not say who signed, or when, unless those facts are recorded alongside it in a record that is itself protected.
3. A cryptographic seal
A digital signature applied to the PDF itself, made with a private key whose certificate was issued to a named organization by a public certificate authority, and bound to a timestamp from an independent authority. The difference that matters: a PDF reader validates this on its own, against a chain of trust that does not come from the vendor. The reader shows who finalized the document and when, and whether anything has changed since.
Which should you care about?
For most everyday agreements, the image plus a well-protected evidence record is proportionate. A seal starts to matter when the document will be handled by people who have no relationship with you or your vendor, and who need their own software to tell them the file is intact.