PLAIN QUANTUM
Quick answer

What is a digital signature, and what is a certificate?

By Muhammad Atif3 min readReviewed 12 October 2026
The short answer

A digital signature is a short piece of data, made from a message with a private key, that anyone holding the matching public key can check. If the check passes, the message really came from the key's owner and hasn't been changed by even one character. A certificate is a signed document that says which public key belongs to which name, such as a website, a bank or a payment system. Signatures and certificates are how computers prove identity to each other, and they appear in almost every secure connection, payment message and software update.

How a signature works

Signatures use public-key cryptography in reverse from the padlock picture: the private key does the signing, and the public key does the checking. In practice the signature is made over the message's hash, a short fingerprint, which is why changing any part of the message breaks it.

SENDER: SIGN message + private key signature RECEIVER: CHECK message signature public key valid: unchanged, and from the key's owner change one character and it fails
A digital signature in two halves. Only the private key can make it; anyone with the public key can check it. It proves who sent the message and that it wasn't altered, but it doesn't hide the message: that's a job for encryption.

What a certificate adds

A signature only proves that a message came from whoever holds a particular private key. A certificate answers the next question: whose key is it? It's issued and signed by a certificate authority, whose own certificate is signed by a higher authority, up to a root that systems are configured to trust.

CERTIFICATE namebank.example public keythe bank's key validfrom … until … signed bya certificate authority The authority's own signature is checked against one the system already trusts
A certificate binds a public key to a name, and a certificate authority vouches for that binding with its own signature. Systems follow those signatures back to an authority they already trust; the certificate plumbing behind payment networks covers how those chains work.

Why quantum computers matter here

Today's signatures and certificates mostly use RSA or elliptic-curve keys. A large enough quantum computer could work out a private key from its public key, and then sign anything as that key's owner: forged payment messages, fake certificates, malicious software updates that look genuine.

Unlike encrypted data, a signature can't be harvested now and attacked later to reveal secrets; forgery becomes possible only once a capable machine exists. But the systems that check signatures, such as card terminals, payment networks and certificate chains, take years to change, so the replacement work starts now. The new standards are ML-DSA, SLH-DSA and, soon, FN-DSA. Their main practical cost is size: post-quantum signatures are much larger than today's.

Common confusions

  • "A digital signature is a scanned handwritten signature." No. It's a value computed from the message, and it's different for every message.
  • "A signature encrypts the message." No. It proves origin and integrity, but anyone can still read the message unless it's encrypted separately.
  • "The browser padlock means a site is trustworthy." It means the connection is encrypted and the certificate matches the site's name. It says nothing about whether the business behind it is honest.

Sources and further reading

Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.

  1. StandardFIPS 186-5: Digital Signature Standard (DSS)NIST, 2023
  2. StandardFIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA)NIST, 2024
  3. StandardFIPS 205: Stateless Hash-Based Digital Signature Standard (SLH-DSA)NIST, 2024
  4. StandardPost-Quantum Cryptography project (status of FN-DSA and other work)NIST Computer Security Resource Center
← All quick answersNext: What is an HSM? →