Document Integrity and SHA-256

Overview

A cryptographic hash such as SHA-256 gives a file a compact, fixed-length fingerprint so it can be checked for unnoticed change. It is a document-integrity tool — about the file, not about the material a document describes.

What a cryptographic hash is

SHA-256 is a cryptographic hash function. It takes a file of any size and produces a fixed-length string of characters — a digest, or fingerprint. Two properties make it useful for integrity checking: the same input always produces the same digest, and even a one-character change to the input produces a completely different, unpredictable digest. It is also one-directional — the digest cannot be turned back into the original file.

How it verifies integrity

To check a document, you compute its hash now and compare it to a hash that was recorded earlier. If the two digests match, the file is byte-for-byte identical to the version the recorded hash came from. If they differ, the file has changed in some way since then. This makes a published hash a practical, tamper-evident integrity check for records such as a certificate of analysis: anyone can independently confirm the file they hold matches the reference.

What it does and does not establish

A matching hash establishes that a file is unchanged relative to a reference. It does not judge whether the file’s original contents were correct, complete, or authored by any particular party, and it says nothing about the identity, purity, quantity, or status of any physical material a document describes. Integrity of the file and correctness of the contents are separate questions.

What this test can and cannot establish

Key terminology

SHA-256

A cryptographic hash function producing a fixed-length fingerprint of a file.

Hash / digest

The fixed-length fingerprint a hash function produces.

Tamper-evident

A property that makes unnoticed changes detectable.