The mental model most people have is wrong
Ask someone how an electronic signature works and they'll usually describe pasting a picture of their handwriting onto a PDF. That's not it — a scanned signature image is trivially copyable and proves almost nothing. A real electronic signature is a recorded event: a sequence of actions, captured with context and then sealed so that any later change to the document is detectable. The signature isn't the squiggle; it's the evidence around the squiggle.
This article walks through what actually happens, step by step, from the moment a document is sent to the moment you have a record that holds up. It's the foundation under a lot of the more specific guides here — what makes a signature legally binding, what an audit trail is, and how signed documents are verified — pulled together into one plain explanation.
Step 1: The document is prepared and sent
It starts before anyone signs. The sender uploads a document, places signature, initial, and date fields where input is needed, and sends it to one or more recipients — either all at once or in a routing order. Each recipient gets a unique, single-purpose link by email. That link is important: it's tied to a specific person and a specific document, so the platform knows who opened what.
Step 2: The signer is identified
When the recipient opens the link, the platform establishes who they are. At the baseline, control of the emailed inbox is the identity signal — the person who received the link is presumed to be the intended signer. For higher-stakes documents, the sender can add a stronger check: an access code, an SMS one-time passcode, or knowledge-based authentication. This is the who leg of a defensible signature, and how strict it needs to be depends entirely on the stakes.
Step 3: Consent to sign electronically
Before capturing anything, the signer agrees to do business electronically. This isn't a formality to skip — for consumer documents, ESIGN requires this electronic-records consent be obtained in a way that shows the signer can actually access the electronic format. The platform records that the disclosure was shown and agreed to, and logs which version. Without it, an otherwise-valid signature can become legally fragile.
Step 4: The signature itself is captured
Now the signer acts. They draw, type, or upload a signature, fill any required fields, and click to complete. Here's the key point that surprises people: the appearance of the signature — the drawn line, the styled name — is the least important part. What gives it weight is everything captured alongside it. The signature mark is a symbol of intent; the intent is what the law cares about, and the surrounding record is what proves the intent was real.
Step 5: The event is recorded in an audit trail
As the signer acts, the platform records the context of the event: the signer's email, IP address, device and browser, and precise timestamps for each step — opened, viewed, consented, signed. This audit trail is the when and how of the signature. It's a chronological record tying each action to a specific person and session, and it's often more probative than the signature mark itself, because it's much harder to fabricate a consistent, timestamped sequence of events than to copy an image.
Step 6: The document is sealed with a cryptographic hash
This is the step that makes an electronic signature genuinely tamper-evident, and it's worth understanding even without a technical background. When signing completes, the platform computes a cryptographic hash of the final document — specifically a SHA-256 digest. A hash is a fixed-length fingerprint derived from the document's exact bytes: change a single character, and the fingerprint changes completely and unpredictably. The hash is recorded as part of the sealed record.
The practical consequence is powerful: to prove the document hasn't changed since signing, you recompute the hash of the file you have and compare it to the one on record. If they match, the file is bit-for-bit identical to what was signed. If they don't, something changed. This is the integrity leg — the "nothing changed since" that turns a signed file into evidence. It's also the technical difference behind electronic vs. digital signatures.
Step 7: A trusted timestamp anchors it in time
A hash proves the document is unchanged, but on its own it doesn't prove when signing happened — a self-reported clock can be argued with. So the seal is anchored with a trusted timestamp (an RFC 3161 timestamp), obtained from an independent timestamping authority. That third party attests that the sealed record existed at a specific moment, which no party to the document controls. Now the record proves not just that nothing changed, but that it existed, unchanged, as of this time — a much harder thing to dispute.
Step 8: Everyone gets the completed record
When the last signer finishes, the platform distributes the completed document to all parties, along with a completion or audit certificate that packages the evidence: who signed, when, from where, the identity checks used, and the SHA-256 seal and timestamp. This bundle is what you keep. If the agreement is ever questioned, it's the complete evidence package that answers the question — not a lone PDF with a picture of a signature on it.
Putting it together: intent, identity, integrity
Everything above maps onto the three things a court actually looks for: intent (the signer meant to sign — captured at the click, with consent), identity (you can show who signed — the email, the audit trail, any added verification), and integrity (the document hasn't changed — the SHA-256 seal and trusted timestamp). An electronic signature "works" not because it looks like handwriting, but because it produces a recorded, sealed, timestamped event that stands behind all three. That's the difference between a signature you have and a signature you can prove.
The takeaway
An electronic signature is a recorded event, not an image. The flow runs: prepare and send → identify the signer → capture electronic-business consent → capture the signature and intent → record the audit trail of who, when, and how → seal the final document with a SHA-256 hash so any change is detectable → anchor it with a trusted RFC 3161 timestamp → deliver the completed, certified record. The result satisfies intent, identity, and integrity at once — which is exactly why it holds up under ESIGN and UETA. Start free or see how the pieces fit in the features.
This article explains the general mechanics of electronic signing and is not legal advice. Requirements for specific document types and jurisdictions vary — consult qualified counsel when it matters.