E-signatures · Glossary

What is non-repudiation in electronic signing?

Non-repudiation is the property that a person who took an action cannot later credibly deny taking it. In signing, it means the record around a signature is strong enough that a denial fails: the signer was identified, the moment was fixed, the document was pinned, and the log itself cannot have been rewritten.

Nothing makes a denial impossible, and any tool that claims otherwise is selling certainty it does not have. What good practice buys is a record that makes the denial expensive to maintain.

Nuwan Madhusanka · Co-founder

5 min read · Published 12 September 2026

Each denial, and the record that answers it
The claim	What answers it	Where the answer runs out
I never received the request	The invitation entry, plus opened and viewed entries with their times	Nothing proves who was reading the inbox
That is not my signature	The stored image and its hash, tied to the signing entry	A drawn mark is not a biometric and never was
Somebody else used my email	A second check on top of the link, by code or by phone	A shared or delegated inbox defeats both
The document was altered afterwards	The hash at signing, plus certification that forbids later edits	Says nothing about what happened before it was sent
I never agreed to sign electronically	The consent timestamp and the version of the wording accepted	A consent box can be clicked without being read
The log was edited to suit you	Every entry hashes the one before it, so a rewrite breaks the chain	A whole draft envelope can still be deleted before sending

A cryptographic word for a human problem

The term arrived from security engineering, where it describes a property of a protocol: given a message and a signature, nobody but the key holder could have produced the pair. Lift it into a room where two businesses are arguing about an agreement and it stops being a property and becomes a question of persuasion. A tribunal is not verifying a mathematical claim. It is deciding whether the account offered by one side is more believable than the account offered by the other, and it does that on the whole picture, including conduct afterwards, invoices paid, work started and emails sent. Cryptography contributes one strong ingredient to that picture. Treating it as the whole dish is how people end up with a technically excellent record of an event nobody can place a person at.

What actually makes a denial expensive

Specificity, mostly. A record that says the document was signed on a Tuesday is easy to shrug at. A record that says a named recipient opened a link at a stated minute from a stated address, answered a six digit code sent to that address, accepted a named version of the consent wording, and applied a mark whose stored image matches a stated hash, is a great deal harder to talk around. Each item is individually deniable and collectively awkward, because a denial has to explain all of them at once. The most valuable single item is usually the second factor, since it forces the story from somebody read my email to somebody read my email and had my phone, which is a much larger claim.

The shared inbox problem

Accounts payable, admin, office, info: every one of them is a signing request waiting to be attributed to nobody. If the address belongs to a role rather than a person, the strongest technical record still resolves to an inbox that several people can open, and a second factor sent to that same inbox resolves to exactly the same set. It is the single most common weakness in real signing records and it is fixed at the point of preparing the request rather than afterwards, by naming an individual and using their own address. Where a role address is genuinely the only one available, an access code shared by phone at least moves one factor onto a channel the inbox does not control.

What certification does and does not settle

Certifying a finished file locks it. The signature covers the whole document, permissions are written in that forbid any change at all, and a reader will report the file as modified if a single byte moves. That closes off one class of dispute completely: nobody can argue the terms were swapped after signing. It closes off nothing about what came before. A document can be certified perfectly and still have been the wrong version, or a version altered between negotiation and sending. Certification proves integrity from the moment of completion forward, and the hash recorded at signing is what reaches back one step further, to the file each signer actually had in front of them.

Raising the bar without making signing miserable

The cost of friction is real and is usually paid by the person you want to say yes. Three settings do most of the work. Name individuals rather than roles, so the record points at a person. Choose the identity check by exposure rather than by habit, since a code is cheap on a supply agreement and pointless on a policy acknowledgement. And keep the certificate with the contract in the same file store, because evidence nobody can find at the moment it is needed does not function as evidence. Beyond that, the returns fall away quickly, and the next real improvement is legal drafting rather than anything technical. It is also worth deciding in advance who inside the business holds the certificates, because a record filed in one person's mailbox leaves with that person. A shared contract folder, named by counterparty and date, costs nothing to set up and is the difference between producing the bundle in an afternoon and reconstructing it from memory two years later under pressure.

Questions people ask

Is non-repudiation a legal term?

Not really. It comes from security engineering and is used loosely in commercial writing. Courts do not ask whether a signature is non-repudiable; they ask whether, on the evidence, this person signed. The word is still useful shorthand for the design goal, as long as nobody treats it as a status a product can grant.

Does a qualified certificate make repudiation impossible?

It makes one part of the argument much harder, because a qualified certificate ties a key to an identity that a trust service provider checked in person or to an equivalent standard. It still does not prove the key holder was at the keyboard. Stolen credentials and lent devices are the same problem at every assurance level, only rarer at the top.

How does a timestamp help?

It moves the question of when from the signer's own machine to an independent party. Without one, the recorded moment ultimately rests on a clock somebody could have changed. With one, a third party has signed a statement that the data existed at that time, which turns a date from an assertion into a piece of evidence.

Can a signer repudiate by claiming they did not understand?

They can try, and it is a different argument. That is not a denial of signing but a challenge to the agreement itself, along the lines of misrepresentation, duress or unconscionable conduct. No amount of signing evidence answers it, which is why plain drafting and a real chance to read matter as much as the identity check.

Does the hash chain prove nothing was deleted?

It proves nothing was quietly rewritten or reordered, because each entry carries the hash of the one before it and a verification pass reports the exact point where the chain fails. Wholesale deletion of an entire draft envelope is a separate matter and is deliberately possible, since abandoned drafts have to be removable.

What is the weakest link in a typical signing record?

The inbox, almost always. Everything else in the bundle is either cryptographic or logged, while access to the email account is assumed rather than proved. That is why a second factor delivered to a different channel improves the record more than any other single change, and why role addresses undo most of the benefit.

Make one with e-signatures

The button opens the generator with this use case already described. Change the wording to match your own.

Send a document for signing

Sources

Written and checked by the OneCraft team. Last checked 12 September 2026.