How Are Digital Signatures Created? PKI and Hashing Explained

How digital signatures are created, in 60 seconds

A digital signature is created in three steps: hash the document to a fixed-length fingerprint, encrypt that hash with the signer's private key, and attach the result along with the signer's certificate. Verification reverses the process with the public key. This guide explains each piece and how they fit together.

Why hashing comes first

Signing the full document would be slow and would leak content. Hashing reduces the document to a fixed-length fingerprint that is fast to sign and reveals nothing about the content. The hash also makes tampering detectable: change one byte and the hash changes completely.

Steps to create a signature

Key pair components

X.509

Standard certificate format

SHA-2/3

Common hash algorithms

The key pair, explained

Everything rests on the key pair. Two keys, one job.

Known only to the signer. Used to create signatures. If compromised, the attacker can sign as the signer.

Shared openly. Used by anyone to verify signatures. Mathematically linked to the private key, but you cannot derive one from the other.

What one key encrypts, the other decrypts. Signing with the private key produces something only the public key can verify.

The role of certificates

A key pair proves cryptographic control, but not identity. Certificates bridge that gap.

What a certificate is

A digital document issued by a certificate authority (CA) that binds a public key to a verified identity.

The trust chain

The CA's certificate is signed by a higher authority, forming a chain up to a root CA. Verification walks the chain to establish trust.

Why it matters for signatures

Without a certificate, a signature proves "someone with this key signed". With a certificate, it proves "the verified person named in the certificate signed".

Putting it together: the signing flow

The complete flow, from signing to verification.

Signing

Hash the document, encrypt the hash with the private key, attach the signature and the signer's certificate.

Verification

Recompute the document hash, decrypt the signature with the public key, compare. Then validate the certificate chain and its revocation status.

Timestamping

A trusted timestamp anchors when the signature was created, protecting against key compromise after the fact.

Common questions about how digital signatures are created

No. Electronic signature is the broad legal category. A digital signature is a specific technical implementation using cryptography, often based on PKI.

How eSign.AI applies this cryptography

eSign.AI uses PKI-based signing with CA certificates, trusted timestamps, and complete evidence packages. For everyday contracts, the platform's audit trail provides the evidence record; for regulated workflows, certificate-based signatures are available where required.

Legal review checklist

Before publishing, verify the following points with legal review.

Technical accuracy

The cryptographic explanation must be technically accurate and current.

Security claims

Claims about infeasibility should be framed as computational security, not absolute impossibility.

Regulatory alignment

References to certificate requirements should align with current practice and applicable regulations.

Team discussing the right eSignature approach for a business

Explore the right eSignature approach for your business

Talk to our team about eSignature requirements, compliance considerations, and document workflows across your target markets.

Keep reading

Glossary