How Electronic Signature Authentication Works

Electronic signature authentication is how a signing platform confirms that the person opening and signing a document is the person it was meant for. It happens before or during signing, using one or more checks: access to an email inbox, a passcode, a one-time code sent to a phone, a government ID matched to a selfie, or a qualified certificate. The stronger the check, the stronger the evidence it leaves.

Not every document needs the strongest check. A lunch order approval and a property sale carry very different risks, and the right method depends on what you would need to prove later if someone said "that wasn't me."

What's the difference between authentication, verification, and authorization?

These three words get used interchangeably, but they answer different questions at different moments.

• Authentication happens before or while someone signs. It asks: is this person who they claim to be, right now?
• Verification happens after signing. It asks: can I trust this signed document? You check the signer's identity evidence, the audit trail, the timestamps, and whether the file changed. Our guide on how to verify an electronic signature walks through those checks.
• Authorization is about permission, not identity. It asks: is this person allowed to sign for the company? A perfectly authenticated employee may still lack the authority to commit their employer to a contract.

Authentication is the foundation for the other two. If you never confirmed who opened the document, there is little for anyone to verify later.

Why does signer authentication matter?

A signature only helps you if you can show it came from the right person. Authentication supports that in four ways:

• Access control. A document with salaries, health details, or bank information stays closed until the recipient passes the check.
• Attribution. In the US, UETA says a signature is attributable to a person if it was their act, and that this can be shown in any manner, including by showing that a security procedure worked. A logged passcode or ID check is that kind of evidence.
• Fewer disputes. "I never signed that" is much harder to argue when the record shows the signer entered a code sent to their own phone or matched their face to their ID.
• Higher signature levels. In the EU and Switzerland, a Qualified Electronic Signature (QES) is only possible after a qualified trust service provider has verified the signer's identity.

What are the main electronic signature authentication methods?

Here are the common methods, from the lightest to the strongest. Each one proves something specific, and none proves everything.

1. Email link

The signer receives a unique signing link in their inbox. Opening it shows they had access to that email account. That's the baseline for almost every eSignature platform, and it works well for routine, low-risk documents between people who already know each other.

Its limit is that an inbox is only as safe as its password. The US National Institute of Standards and Technology (NIST) doesn't accept email as a second authentication factor in its digital identity guidelines, because a mailbox can be opened with a password alone and messages can be intercepted or rerouted.

2. Passcode or access code

The sender sets a code and shares it with the signer through a different channel, for example by phone or in person. The signer must enter it before the document opens. This proves the person knows something only the intended recipient was told.

A passcode is only as strong as the way you share it. Sending it in the same email as the signing link defeats the purpose.

3. SMS one-time code

The signer receives a short code by text message and enters it to open the document. Combined with the email link, this means the signer needs both the inbox and the phone, which is a meaningful step up.

Text messages have known weak spots. NIST treats codes sent over the phone network as a restricted method and advises checking for risk signals such as a recent SIM change or a number that was ported to another carrier. For most business agreements an SMS code is a reasonable middle ground. For high-value deals, pair it with something stronger.

4. Knowledge-based questions

Some platforms ask the signer questions drawn from personal or credit records, such as a previous street address. This approach is losing ground. In its current identity guidelines, NIST says knowledge-based verification must not be used to verify identity, largely because the answers are often findable online or exposed in data breaches.

5. Government ID and selfie check

The signer photographs a government-issued ID, such as a passport or driver's license, and then takes a selfie or short video. Software checks that the ID looks genuine and that the face matches the photo on it. A liveness check confirms a real person is in front of the camera, not a printed photo or a screen.

This is the strongest method that works for signers you have never met. It ties the signature to a real identity document, not just to an inbox or a phone number, which matters for onboarding new customers, high-value contracts, and remote property deals.

6. Qualified certificate (QES)

At the top of the ladder, a qualified trust service provider verifies the signer's identity and then issues a qualified certificate used to sign. Under eIDAS, that identity check must use an approved route: a European Digital Identity Wallet or national eID at assurance level high, an existing qualified certificate, another remote method confirmed by a conformity assessment body, or the person's physical presence.

This is what gives a QES the same legal effect as a handwritten signature across the EU. It is also the most involved option for the signer, so it makes sense when the law or the other party requires it.

What about IP addresses and device details?

Many platforms record the IP address, approximate location, and device behind each action. That's useful context for spotting anything odd, but it doesn't authenticate anyone. Treat it as supporting evidence next to one of the methods above, never as a replacement.

How do you choose the right authentication method?

Start with one question: if this signature were challenged, what would you need to show? Then weigh these factors:

• What the document is worth. Internal approvals and routine renewals can rely on the email link. Contracts with money, liability, or personal data attached deserve a second factor.
• How well you know the signer. A long-standing client is different from a first-time applicant. The less you know someone, the more an ID check is worth.
• What is in the document. Health, financial, or HR details call for access control even if the agreement itself is simple.
• What the law or the other party requires. Some documents in the EU and Switzerland need a QES. In those cases the choice is made for you.
• How much friction the signer will accept. Every extra step adds a little time. Over-securing a two-line acknowledgment just slows everyone down.

In practice, most teams settle on a small set of defaults:

• Routine documents with known signers: email link.
• Customer contracts and external agreements: email link plus a passcode or SMS code.
• New or unknown signers, high-value or sensitive deals: government ID and selfie check.
• Documents that legally require the highest level in the EU or Switzerland: QES.

How does recipient authentication work in Sign.Plus?

Every Sign.Plus signature request starts with a unique signing link sent to each recipient's email. Signers don't need a Sign.Plus account and can sign on the web, iOS, or Android. On top of that, you can add recipient verification and choose the method separately for each recipient in the same request. Until a recipient passes their check, even the document preview stays hidden.

You can also send the request by text message or WhatsApp in addition to email. If a recipient opens the document from the text message, they confirm their email address before they can sign, so the request still ties back to their inbox.

• Passcode: you set a code of 4 to 50 characters and share it with the recipient yourself. They can't view or sign the document without it.
• SMS code: the recipient receives a one-time code by text message and enters it before viewing. Account admins decide in Settings which team members can require SMS verification.
• ID Check: the recipient uploads a government-issued ID and completes a facial verification with a liveness check. You see a confirmation and the legal name taken from the ID, while the ID images stay private. While ID Check is on, the request can't be reassigned to someone else. After two failed attempts, the sender needs to send the request again.
• QES: for qualified signatures, the signer is redirected to Swisscom Trust Services, a Swiss qualified trust service provider, which verifies their identity and issues the qualified certificate. QES identity verification replaces the other recipient verification options rather than stacking on top of them.

Every verification step lands in the document's audit trail, for example "Verified by Passcode" or "Verified by ID Check," next to the timestamps, IP address, and device for each action. The Certificate of Completion collects that evidence in one downloadable file.

Authentication applies to your own account too. Sign.Plus supports two-factor authentication, organizations can require it for every member, and larger teams can use single sign-on with Google or Okta. Behind all of this, Sign.Plus is certified to ISO/IEC 27001:2022 by EY CertifyPoint and has a SOC 2 Type 2 report from EY.

How does authentication relate to SES, AES, and QES?

The three signature levels defined by eIDAS set different expectations for identity:

• Simple Electronic Signature (SES): no specific identity method is required. Any of the methods above can be added, and the stronger the method, the better your evidence.
• Advanced Electronic Signature (AES): the signature must be uniquely linked to the signer, capable of identifying them, created with means under their sole control, and linked to the document so any later change can be detected.
• Qualified Electronic Signature (QES): an advanced signature backed by a qualified certificate, issued only after a qualified trust service provider has verified the signer's identity.

One point is easy to get wrong: a passcode, SMS code, or ID check on a simple signature doesn't turn it into a QES. Those methods strengthen your evidence, but only the qualified provider's identity process and certificate make a signature qualified. In Sign.Plus, SES is the default, and AES and QES are available on paid plans, so you can raise the level for a single document without switching tools.

In the US, the ESIGN Act and UETA don't define signature levels at all, so the authentication you choose is mainly about evidence and risk.

Signer authentication best practices

• Set defaults by document type, not case by case, so nobody forgets the second factor on an important contract.
• Share passcodes through a different channel than the signing link.
• Double-check phone numbers and email addresses before sending. Authentication confirms the person behind the contact details, so wrong details authenticate the wrong person.
• Use an ID check for anyone you haven't met, especially when money or property changes hands.
• Keep the evidence. Download and file the Certificate of Completion with the signed document.
• Protect the sender side too. Turn on two-factor authentication for every account that can send documents.

Ready to match the check to the document? Add recipient verification to your next Sign.Plus signature request.