How to Create an Electronic Signature: Draw, Type or Upload, Then Prove It

Creating an electronic signature takes about ten seconds. What takes longer is understanding what you just made: which parts of the file carry legal weight, why the image of your scrawl is the least important part, and how anyone can later prove the document was not changed. This guide covers both halves.

First, what an electronic signature is

Under US law an electronic signature is any electronic sound, symbol or process attached to or logically associated with a record and executed by a person with the intent to sign. That definition is deliberately broad. A drawn signature qualifies. So does a typed name in a signature field, a click on "I agree" in the right context, or an uploaded image of your handwritten signature. The picture is not the signature; the act, tied to the document and recorded, is.

That is why a proper e-signature tool does two things at once: it captures your mark, and it records the evidence around it. We will cover the mark first.

The three ways to make your signature

1. Draw it

On a phone or tablet, use your finger or a stylus. On a laptop, use the trackpad or mouse. The signature pad in ShockSign captures your stroke as an image and places it in the field. Tips: turn your phone sideways for more room, sign a little larger than you would on paper, and use the clear button until you like it. Nobody is judging; the drawing is a visual cue, not the legal core.

2. Type it

Type your name and it is rendered in a script-style font. This is the fastest option and every bit as valid. It is a good choice when you are signing on a small screen or when you sign many documents a day and want them to look consistent.

3. Upload an image

Sign a blank sheet of white paper with a dark pen, photograph it in good light, crop tightly, and upload it. The image is placed in the signature field. Use this if you want your electronic signature to match the one on your driver's license or on paper contracts. A PNG with a transparent background looks cleanest, but a well-lit JPEG works.

Signing a document someone sent you

1. Open the link in the email. It goes to a secure signing page in your browser; there is no app to install and no account to create. If the sender required it, you may be asked to enter a code emailed to you first.
2. Agree to sign electronically. The signing page states that by signing you agree your electronic signature is legally binding; completing the document records that agreement. Consent is one of the legal requirements, and the audit trail captures it.
3. Read the document. If the sender enabled it, you can view an AI-generated plain-English summary of the document before you sign. Use it as a guide, not a substitute for reading.
4. Complete each field. Required fields are highlighted. Text fields, dates, checkboxes, initials and signature fields each prompt you.
5. Finish. Tap complete. The document is sealed, and you receive a copy of the signed PDF by email once all parties have signed.

If you disagree with something, do not sign and then email your objections. Decline in the signing page, or contact the sender so they can void the document and send a corrected version.

Signing your own document

You can also sign something yourself, such as a form you need to return: upload the PDF to your ShockSign account, place a signature field, sign it, and download the sealed PDF. The free plan covers one document during a 7-day trial. See free electronic signature.

What happens when you tap complete

This is the half most guides skip. At completion, an e-signature platform does several things to make the document trustworthy:

• Flattens the signed PDF with your signature, initials and field values embedded.
• Computes a cryptographic hash of the final file. ShockSign uses SHA-256. The hash is a fingerprint: change one character in the PDF and the fingerprint no longer matches.
• Requests a trusted timestamp from an independent time-stamping authority under the RFC 3161 standard. This proves the file existed in exactly this form at that moment, using a clock that is not the sender's.
• Writes the audit trail: every send, view and signature event with timestamps, IP addresses and device information, plus how each signer was verified.
• Issues a certificate of completion that summarizes all of the above on one page and travels with the PDF.

The drawn or typed mark is the part people look at. The hash, timestamp and audit trail are the parts a lawyer looks at.

How a signed document is validated later

Suppose a year from now someone questions the contract. Validation works like this:

1. Check the integrity. Recompute the hash of the PDF you have and compare it with the hash recorded at completion. ShockSign provides a public verification page where anyone with the document's verification link can confirm that the file is authentic and has not been altered, and a QR code for each document that opens the same check.
2. Check the time. The RFC 3161 timestamp token proves when the sealed file was created; it is signed by the time-stamping authority and can be verified independently.
3. Read the audit trail. Confirm who was sent the document, when they opened it, how they were verified, and when they signed. Our guide on reading an audit trail walks through an example.
4. Compare against the legal requirements. Consent, intent, association and retention. The audit trail and certificate are how you demonstrate each one. See Are electronic signatures legally binding?

Common mistakes

• Pasting a signature image into a Word document and emailing it. That is an electronic signature in the broad sense, but there is no consent record, no hash and no audit trail, so it is easy to dispute.
• Sharing one login across a team, which makes the audit trail attribute every send to the wrong person.
• Editing a PDF after signing. Any change breaks the seal. If terms change, void and resend.
• Losing the certificate. Download the signed PDF and the certificate of completion together and keep them with the deal file.

Security while you sign

Signing pages are served over TLS, documents are encrypted at rest with AES-256, and your ShockSign account can be protected with two-factor authentication using a passkey, an authenticator app or emailed codes. You can also sign in with Google or Microsoft. Senders can require signers to enter an emailed verification code before viewing a document. Details are on the security page.