How Digital Signatures Work in Crypto, Step by Step

Say you want to send 0.5 BTC to a friend called Ana. No bank checks your ID. Instead, the network checks a number attached to your instruction that only your private key could have produced.

That number is a digital signature. It fits one exact message, so it cannot be moved onto a different one.

What a signature proves

A valid signature proves two things:

The message was signed by whoever holds the private key that matches a given public key.
The message has not changed since it was signed, not even by one character.

It also makes it hard for the signer to deny approving the message later, because only the holder of that key could have produced the signature.

A handwritten signature looks the same on every document, so it can be traced or cut and pasted. A digital signature is different for every message. Copy it onto another message and the check fails.

A signature proves possession of a key and says nothing about the person holding it. If a thief has your key, their signatures are as valid as yours.

Signing, step by step

Your wallet does this in a fraction of a second, on your own device:

It hashes the message. The SHA-256 hash of the text "Pay Ana 0.5 BTC" starts with b9f0d506 (the first 8 of 64 characters).
It combines that hash with your private key in a signing formula. The result is the signature.
It sends the message, the signature and your public key together.

Hashing first lets the formula handle a message of any length. A one-line message and a long contract are both signed as one 256-bit hash. What hashing is explains why that hash changes completely if the message changes at all.

The message Pay Ana 0.5 BTC is hashed with SHA-256, and the hash is combined with the private key to produce a signature. — The private key never leaves your device; only the signature does.

Checking, step by step

Anyone can check the signature. They need the message, the signature and the public key, and nothing secret:

Hash the message they received.
Run the checking formula on the signature and the public key.
If the result fits the hash, the signature is valid. If it does not, they reject the message.

Now suppose someone in the middle changes 0.5 to 5.0. The edited message has a completely different hash, starting with 3ba5040e, and the old signature does not fit it. The check fails.

The same signature and public key pass the check for Pay Ana 0.5 BTC but fail for the edited Pay Ana 5.0 BTC. — Any edit to a signed message makes the check fail.

To make the edited message pass, the attacker would need a new signature, and making one needs your private key.

Worked example with tiny numbers

Real keys use numbers dozens or hundreds of digits long, but the idea fits in small ones. This toy key pair is for illustration only and uses an older method called RSA:

Public key: 33 and 3.
Private key: 7.
Message hash: 4, a stand-in for a real 256-bit hash.

To sign, raise the hash to the power of 7 and keep the remainder after dividing by 33:

4⁷ = 16,384.
16,384 ÷ 33 = 496, remainder 16.
The signature is 16.

To check, raise the signature to the power of 3 and keep the remainder after dividing by 33:

16³ = 4,096.
4,096 ÷ 33 = 124, remainder 4.
The result, 4, equals the hash, so the signature is valid.

Toy numbers: hash 4 signed with private key 7 gives signature 16, and checking 16 with public key 3 gives back 4, so the signature is valid. — Only the private key can make a signature that the public key turns back into the hash.

Now change the message so its hash is 5. The old signature still checks out to 4, which no longer matches.

Signing 5 properly with the private key gives 14, and 14³ = 2,744, which leaves remainder 5. With real key sizes, finding that 14 without the private key is out of reach.

Bitcoin does not use RSA. It uses ECDSA and, since the Taproot upgrade, Schnorr signatures, both built on elliptic curves. The steps are the same: sign with the private key, check with the public key.

Where signatures are used, and where they fail

Every input in a typical Bitcoin transaction carries a signature. The signature covers the amounts and the destination, so a node passing your transaction along cannot redirect it without breaking the signature. Each node checks every signature for itself.

The maths is sound, so failures come from around it:

Bad randomness. ECDSA needs a fresh secret random number for each signature. Wallets that reused one, or generated it badly, have exposed private keys and lost coins.
Signing what you did not read. A website can ask your wallet to sign a token approval that lets it move your tokens later. The signature is valid, and you have agreed to the wrong thing.
A stolen key. The network cannot tell your signature from a thief's.

Protecting yourself from crypto scams covers the checks to run before you approve a signature request.

คำถามที่พบบ่อย

Is a digital signature the same as an e-signature?

Not always. An e-signature on a contract can be a typed name or an image of your handwriting, while a digital signature is a cryptographic calculation tied to one exact message.

Can a digital signature be copied to another transaction?

It can be copied, but it will not pass the check on any other message. Bitcoin also stops the same signed transaction being used twice, because each coin can only be spent once.

Which signature method does Bitcoin use?

ECDSA on an elliptic curve called secp256k1, plus Schnorr signatures on the same curve since the Taproot upgrade in 2021. Ethereum uses ECDSA on the same curve.

Does signing cost a fee?

Signing happens on your device and is free. A fee is paid only when a signed transaction is sent to the network and confirmed, but a free signature request can still give a website permissions, so read it first.