How to collect a signature on a form

Put a signature box at the bottom of a consent form and almost everyone signs it. What they cannot tell, and what most people building the form have not thought about, is whether that squiggle is a record of a decision or just an image stored next to some answers. Those are two different products, and the form builder offers both.

Two kinds of signature on a form

The inline signature is a field like any other. The person filling in the form draws with a finger or a mouse, or types their name and has it rendered into an image, and the result is submitted with the rest of their answers. It costs one field and no configuration.

The e-signature add-on is a different mechanism wearing similar clothes. When the response is submitted, the whole thing is rendered to a PDF, and that PDF becomes a signing envelope. A named signer gets an email, opens a separate signing portal, signs there, and the finished document is certified and sent back. The form field marks where the signature goes and who it belongs to.

The distinction that matters is not how it looks. It is what exists afterwards.

What an inline signature records

An image, and the moment it was drawn. That is the whole of it.

It is stored with the response, rendered into the response PDF along with every other answer, and shown in the responses table. In a CSV export it becomes the literal text [Signature Image], because a base64 image in a spreadsheet cell helps nobody.

What it does not record is who drew it. There is no email verification, no link sent to a nominated address, no IP address kept against the act of signing, and no way to demonstrate later that the document was not altered after the fact. If the person filling the form is already known to you, if they are signing in your presence, or if the stakes are a class booking rather than a lease, that is completely fine and the extra machinery is waste.

It is also worth saying plainly: this only works on a classic form. On a published conversational form the signature component falls through to a plain text renderer, so the respondent gets a box asking them to type an answer instead of a signature pad. The format comparison post covers the rest of that gap.

What the e-signature add-on produces

Three artefacts, and they are the reason to bother.

An envelope. One per submitted response, holding the rendered PDF, the recipients and the field positions. It has a status you can watch, and the responses table shows whether a response is waiting on a signature or finished.

An audit trail. Every event is appended to a log with a hash chain, so each row’s hash covers the row before it and the chain can be verified end to end. Eighteen event types are recorded, including opened, viewed, signed, declined, resent, voided and expired, each with a timestamp, the recipient, the IP address and the user agent.

A certificate of completion. A separate A4 PDF with three sections: the envelope, including the document hash as sent and the hash once fully signed; each signer, with their verification method, the time they signed, their IP address and the version of the consent they accepted; and the full event log. It is always produced as its own download, and it is appended to the signed PDF itself only when the form’s e-signature field asks for it.

On top of that, the finished PDF carries a PAdES signature with DocMDP certification, which is what makes a later edit detectable rather than merely unlikely.

Decision table

The table at the foot of this post sets the two side by side, row by row, and two of its rows are the ones people are surprised by.

The envelope expires 30 days after it is created. The e-signature field does have an expiry-in-days setting, but the handover that turns a form response into an envelope does not pass it on, so every form-originated envelope gets the 30 day default regardless of what the field says.

And the identity check on that path is email link only. The signing service supports an access code and a one-time email code as well, but the same handover hardcodes the method to none. Those stronger checks belong to envelopes started from the signing app, where you upload the document yourself.

Which documents need which

The test is not importance, it is what you would need if the other party said they never agreed.

An inline signature is enough for an internal acknowledgement, a booking or a photo permission slip, where the surrounding record already establishes who the person is and nothing turns on the exact document version.

Use the e-signature add-on where a third party might dispute it later, where you need to show the document was not changed after signing, or where somebody other than the respondent has to sign, such as a manager approving a claim or a guarantor on an agreement. Leases, contractor agreements, guarantees and anything with money attached sit here.

On the law itself, the principle is broadly consistent across the jurisdictions with legislation on this. The US ESIGN Act defines an electronic signature as “an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record”, and provides that a record may not be denied legal effect solely because it is electronic. The UNCITRAL Model Law on Electronic Signatures builds on non-discrimination, technological neutrality and functional equivalence. In England and Wales, the Law Commission concluded in its September 2019 report that an electronic signature is capable in law of executing a document, including a deed, where the signatory intends to authenticate it, while noting that a deed still requires a witness physically present. So the format is rarely the obstacle. Proof is. None of this is legal advice, and formality rules vary by document type and jurisdiction, so check yours.

What the respondent sees

With an inline signature, nothing unusual. They reach a signature area, sign, and submit. One flow, one sitting, done.

With the add-on, submitting is not the end. The form is rendered, an envelope is created, and an email arrives titled “Signature requested” with the document, who they are signing as, when it expires and a button into the signing portal. There they accept a consent notice, sign once, and every signature spot on the document is filled from that one drawing. Then a completion email arrives with the certified PDF attached.

That second flow is better evidence and more steps. If the signer is the same person who just filled in the form, they will be mildly surprised to receive an email asking them to sign something they thought they had finished. Say so on the thank-you screen.

The example

The background check consent form is a good shape to copy. It is sixteen fields, classic, and the signature is the second to last field. Before it sits a required multiple choice consenting to each individual check, and above that a section that states what is being consented to. The signature is not the consent. It is the acknowledgement that the consent above it was given.

That ordering is the part worth stealing: a paragraph that says what is being agreed, a required tick that records the agreement, then the signature. The school excursion consent form does the same thing in seventeen fields for a parent audience.

Both use the inline field, which suits them. To turn either into a certified document with an audit trail behind it, the form with e-signature page shows what the add-on adds, and if you only need the drawn box, the signature field on its own is the smaller build. For the difference between an electronic and a digital signature as terms, see that question page.