Checksums, signatures, and what each actually proves

Two mechanisms get treated as interchangeable when they answer entirely different questions.

A checksum answers: is this the same file?

Run a document through a hash function and you get a fixed-length string. Change a single byte and the string changes completely.

That is the whole guarantee. Given a checksum recorded when a document was handed over, anyone holding the file later can recompute it and confirm the bytes are identical.

What it does not tell you:

• Who made the document. Anyone can hash anything.
• When. The checksum has no timestamp in it; the timestamp is whatever you wrote down beside it.
• Whether the contents are true, only that they have not changed.

And critically: a checksum you received alongside the file proves nothing. If someone alters a document and sends you the checksum of the altered version, the two match perfectly. It only has value when it was recorded independently — noted in a covering letter, logged in a system, exchanged over a different channel.

A visual signature answers: nothing

An image of a signature placed on a page is a picture. It carries the same weight as typing a name in a text box, which is to say: it is a convention, widely accepted in practice, and entirely unverifiable from the file.

It can be copied from one document to another in seconds. Anyone claiming a scanned signature image proves authorship is mistaken about what is in the file.

That does not make visual signatures useless — most business runs on them, and their value is procedural rather than cryptographic. It makes them worth naming accurately.

A digital signature answers: who stood behind this, and has it changed since?

A certificate-backed digital signature is a different mechanism entirely. It binds a cryptographic key to an identity through a certificate authority, signs the document with it, and lets any reader verify both that the signer holds that key and that the document has not been altered since.

That is the thing people usually mean when they say "signed". It requires a certificate, which requires an authority, which is precisely what makes it meaningful — and precisely why it cannot be conjured up by drawing on a page.

Using them well

• Handing over a document set? Record a checksum, separately from the files themselves, and keep the record. The cost is seconds and the value appears only in a dispute.
• Need to show a document has not changed? Checksum.
• Need to show who approved it? A digital signature, or a paper trail. Not an image.
• Need something to look signed for an internal process? A visual signature is fine, as long as everyone involved understands that is what it is.

The failure is not using the weaker tool. It is describing the weaker tool with the stronger word.