A qualified electronic signature (QES) can live in different places: in the cloud via the Diia app, in an ordinary key file, or on a secure hardware device. Your choice affects both day-to-day convenience and the level of protection. Let's walk through all three options so you can pick the one that fits your scenario.
Three carriers — one signature
First, it helps to separate two things: the qualified electronic signature itself and the carrier that stores your private key. The legal force of the signature is identical in all three cases — a document signed with Diia.Signature, a file key, or a token is a fully valid original. The only difference is where the key "lives" and how you use it.
Diia.Signature: a cloud signature on your phone
Diia.Signature is a cloud-based QES that you create directly in the Diia app after photo verification. The private key is stored in a protected cloud environment, and you confirm each signing operation from your smartphone.
- Who it suits. Primarily individuals and sole traders: you can sign an application, a contract, or a report anywhere with nothing but your phone.
- Advantages. Nothing to store or carry around, free of charge, and the key cannot get lost along with a USB stick.
- Limitations. You are tied to the app and your smartphone; for corporate scenarios involving a company seal or high-volume signing it is not always convenient.
File key: the business standard
A file key is a .dat, .jks, or .pfx file issued by an accredited trust service provider and protected with a password. It is the most widespread option among Ukrainian businesses: accountants, directors, and managers have worked with it for years.
- Who it suits. Companies and sole traders who regularly sign documents from a computer: acts, delivery notes, contracts, reporting.
- Advantages. Works everywhere — from government service portals to document management systems; easy to back up; requires no extra hardware.
- Limitations. The file can be copied, so everything rests on discipline: a strong password, restricted access, and never sending the key by email or messengers.
In eObig you can sign documents with a file key right in your browser — no plugins or software installation, and the private key and password never leave your device.
Secure token: when the stakes are higher
A secure carrier is a hardware device (a token or smart card) in which the key is generated inside the chip and never leaves it. Copying such a key is technically impossible: all cryptographic operations happen inside the device itself.
- Who it suits. Officials, signatories with elevated risk, and organisations with strict security policies or regulatory requirements for key carriers.
- Advantages. Maximum protection against copying and compromise; a lost device is noticed immediately.
- Limitations. You need to buy the token and carry it with you, and if it is lost, the key has to be reissued.
Comparison table
| Criterion | Diia.Signature | File key | Secure token |
|---|---|---|---|
| Security | High: key kept in a protected cloud | Depends on storage discipline | Maximum: the key cannot be copied |
| Convenience | Signing from a smartphone | Familiar desktop workflow | Device must be at hand |
| Cost | Free | Usually cheap or free | Hardware must be purchased |
| Mobility | Maximum | High: the file is portable | Medium: the token travels with you |
| Best for | Individuals, sole traders | Most businesses | Elevated security requirements |
How to choose your option
There is no universal answer — it all comes down to how you sign:
- You sign occasionally and mostly from your phone — go with Diia.Signature and keep things simple.
- You work with company documents daily — a file key offers the best balance of convenience and compatibility. It is also the typical choice for sole traders — see our guide on e-document workflow for small business.
- You sign critical documents or your policies demand it — a secure token is worth the money.
Keep in mind certificate validity periods and the long-term verifiability of signatures — we cover this in the article on retention periods for electronic documents.
Key Takeaways
- The legal force is identical — Diia.Signature, a file key, and a token all produce an equally valid QES.
- Diia.Signature is the most convenient option for individuals and sole traders with a smartphone.
- A file key is the working standard for business; the main rule is to protect the file and the password.
- A secure token is for elevated requirements: the key is impossible to copy.
- In eObig, file keys and secure carriers are supported, and signing happens in the browser on a cryptographic core with a positive attestation from Ukraine's SSSCIP.
Want to see how it works on your own documents? Start for free at portal.eobig.com or book a demo — we will show signing with any of these carriers in just a few minutes.