Browser-based signing often raises suspicion: how can something so simple be secure? In fact, the in-browser signing model protects your key more reliably than the familiar plugins and installers. Let's look at how it works.
How in-browser signing works
The core idea is simple: the cryptographic operations happen on your device, not on the server. When you sign a document in eObig right in the browser, here is what happens:
- You select your private key file (QES) and enter its password.
- The browser loads the key locally — into your device's memory, without sending it anywhere.
- The electronic signature, following the ДСТУ 4145 standard, is computed right there, on your computer or phone.
- Only the finished signature reaches the server — the result of the computation, not the key itself and not the password.
In other words, your private key and password never leave your device. Even if someone intercepted the traffic, they would only get the finished signature, from which the key cannot be reconstructed.
A state-certified crypto core
Browser-based signing works thanks to a cryptographic core that holds a positive conclusion from Ukraine's DSSZZI (Держспецзв'язку) — the state regulator. This means the algorithms are implemented in line with Ukrainian standards and verified at the state level. You are not relying on a homemade solution but on certified technology. What a QES is and why it carries legal force is explained in our article on the qualified electronic signature.
Why it's safer than plugins
Traditional signing schemes required installing a plugin, extension or separate program. Each such component is an extra point of vulnerability that has to be updated and trusted. Signing without any plugins removes that risk: there is nothing to install and nothing to break at the system level.
Additional layers of protection
Client-side signing is the foundation, but not the only barrier. eObig protects your data comprehensively:
- Two-factor authentication (2FA/TOTP) — even if your account password is compromised, sign-in is impossible without the second factor.
- Encryption — documents and communication channels are protected by encryption in transit and at rest.
- Audit log — every action on a document is recorded: who opened, signed or sent it, and when.
- Access control — you decide which team members see which documents.
A detailed overview of all measures is on our security page and in the article on electronic document security.
Common fears — and the reality
| Fear | How it actually is |
|---|---|
| "My key will end up on the server" | The key stays on your device; only the signature is sent |
| "A browser is less reliable than an app" | A certified core does the computing, not the browser itself |
| "Someone will intercept my password" | The password is never transmitted over the network |
| "It has no legal force" | A signature under ДСТУ 4145 is equal to a handwritten one |
What this means for your business
In practice, the client-side signing model brings a double win. First, convenience: you can sign a document from any device with a browser — no administrator rights, no installation, no configuration. Second, control: you know for certain that your key physically stays with you and not "somewhere in the cloud". For an accountant, a manager or a sole trader, this means security does not require technical knowledge — it is built into the very architecture of the service. That is why more and more companies choose browser-based signing as the standard for their day-to-day document work.
Conclusion
Browser-based signing is secure precisely because the most valuable things — the private key and password — never leave your device. A certified core, 2FA, encryption and audit make this model more reliable than the familiar plugins.
Want to see for yourself? Try the demo or create a free account at portal.eobig.com and sign your first document in the browser within minutes.