What is a digital signature

When you do not know who sent it

Say a letter arrives with someone's name at the end. Did that person really write it? Anyone can copy down a name, and the contents may have been quietly altered on the way. You cannot tell from the text alone.
This is not a question of secrecy; it is fine for the contents to be completely open. What you want to know is whether it really came from that person and whether it changed on the way.

Press the doubt-the-name and doubt-the-content buttons. From the text alone, you cannot tell whether the name was copied or the contents were changed.

Trying it was frustrating: even with a name written, you cannot be sure. We need two kinds of proof: proof that it really came from that person, and proof that it did not change on the way.
It would be ideal to have one mark that shows both at once and that nobody else can imitate. The pair of keys from the public-key lesson does exactly that.

Sign with the private key

In the public-key lesson, we locked with the recipient's public key. A signature goes the other way: the sender uses their own private key to attach a signature to the message. It is not locking with a padlock but more like stamping a seal beside the message, so the contents stay fully visible.
In practice the signature is made not from the whole message but by running a calculation with the private key on the message's hash, its fingerprint. Only that person has the private key, so only that person can stamp this seal.

Press sign with private key. The contents stay visible, and a signature only that person can make is attached.

A signature was attached, yet not one character of the message was hidden, because it was not locked; a seal was added. The signature comes from the fingerprint of the message's contents, so it is tightly tied to those contents. The signature covers the fingerprint rather than the whole message because a fingerprint is short and always the same length, so signing finishes quickly even for a large file. And since the fingerprint changes whenever the contents change, signing it protects the whole message.
And making this seal requires that person's private key. The private key never leaves its owner's hands, so nobody else can make the same seal. So how does the receiver check it?

Verify with the public key

The receiver verifies the signature with the sender's public key. Verifying asks whether this seal really was made with the private key that pairs with that public key, and whether it matches the fingerprint of the contents just received.
If both hold, verification passes. A seal made with someone else's private key fails when verified with that public key, because it passes only when the public and private keys form a pair.

Tap the signatures one at a time to verify them with Minu's public key. Only the signature made with Minu's private key passes; ones made with other people's keys fail.

Only the signature made with the matching private key passed. What passing means is clear: this message really came from that person. It is fine for the whole world to hold the public key, because a public key can only verify; it cannot make a signature.
The power to stamp the seal belongs only to the owner of the private key, while checking the seal is open to everyone. It is the mirror image of locking with a public key.

Genuine, and unchanged

Because the signature is tied to the contents, passing verification proves two things at once. One is authenticity: it really came from that person. The other is integrity: not a single character has changed.
If anyone alters the contents even slightly on the way, the fingerprint changes completely, so it no longer matches the tied signature and verification breaks at once. A single changed character becomes an alarm.

Press the change-the-time button. Changing even one digit means the contents no longer match the signature, and verification breaks.

Changing just one character made verification fail at once. Seeing this failure, the receiver realizes the contents are not the original and can stop instead of trusting them. Also, someone who signed with their private key cannot later deny having sent the message; this is called non-repudiation.
That is why digital signatures are used wherever the source and the original matter, such as software updates, electronic contracts and official documents. Now let's set locking and signing side by side.

Wrapping up

In short, a digital signature uses the key pair of public-key encryption in reverse. The sender signs the message's fingerprint with their own private key, and the receiver verifies it with the sender's public key. If it passes, it proves both that the message really came from that person and that it did not change on the way.
Locking keeps contents secret; signing proves who sent them and that they were not altered.

Tap lock and sign to compare them. Locking keeps a secret; signing proves authenticity and integrity.

Now you know the difference between locking and signing. Lock with the recipient's public key and the secret is kept; sign with the sender's private key and authenticity and integrity are proven. The same key pair does two jobs just by changing direction.
For verification to mean anything, though, one condition must hold: the public key really has to belong to that person. The next lesson, on certificates, covers how a public key can be trusted.