Document hashes: what they are and how to verify a file with SHA-256

The hash of a document is a value calculated from the bytes in the file. It lets you compare two copies or versions without examining them page by page. With SHA-256, the result has a fixed length of 256 bits, normally represented by 64 hexadecimal characters, regardless of the document's size.

The check answers a precise question: “Does this file match the reference I am using?” By itself, it does not answer “Who wrote it?” or “Is its content accurate?” This guide explains how to use the fingerprint effectively without confusing it with a signature or timestamp proof.

What a hash actually measures

A cryptographic hash function takes a sequence of bytes and produces a deterministic fingerprint: the same bytes and algorithm produce the same result. Changing the file, even in a place that is not visible on screen, can change the fingerprint.

SHA-256 belongs to the SHA-2 family described in the NIST Secure Hash Standard. Collision resistance makes it extremely difficult to find two different files with the same hash; it does not make a collision mathematically impossible.

For example, two PDFs may look identical but contain different metadata. An application may update the document's internal date when saving it: the visible text remains the same, but the bytes do not. A hash compares the file, not the meaning of its sentences.

Calculate SHA-256 on Windows, macOS, and Linux

The following commands read a local file and do not upload it to an online service. Replace report.pdf with the path to your document. Work with the copy you actually intend to distribute, after the final export.

Windows: PowerShell

Get-FileHash -LiteralPath "./report.pdf" -Algorithm SHA256

The Hash column contains the fingerprint. -LiteralPath treats the path as a literal name, while naming the algorithm explicitly makes the command clearer for anyone repeating the check. The Get-FileHash documentation describes its parameters and output.

macOS: Terminal

shasum -a 256 ./report.pdf

The command returns the fingerprint followed by the file name. If the path contains spaces, put it in quotation marks. Confirm that you selected SHA-256 rather than another command's default algorithm.

Linux: Terminal

sha256sum ./report.pdf

Here too, the result contains the hash and path. The GNU Coreutils SHA-2 utilities can also verify lists of fingerprints, which is useful for archives containing several files.

Compare the result with a trusted reference

Calculating a hash without something to compare it with does not prove that the document is the expected one. You must know where the reference fingerprint came from and which version it describes.

1. Retrieve the hash from the issuer's official channel or from verifiable proof linked to the document.
2. Confirm that the stated algorithm is SHA-256 and that the reference applies to the file you downloaded.
3. Calculate your copy's fingerprint before opening and resaving it.
4. Compare the full sequence, not only its first or last characters. Uppercase and lowercase in the hexadecimal representation do not change the value.
5. Keep the result with the reference used and the version checked.

A hash published beside a download can help detect transfer errors. However, if someone can replace both the file and the value shown on the same page, the comparison will not detect that replacement. The trustworthiness of the reference is therefore part of the check.

Which changes alter the fingerprint

If the comparison fails, the correct conclusion is that the file does not match the reference. More information is needed to determine whether this resulted from a legitimate update, conversion, or alteration. Do not automatically infer fraud.

Hashes, digital signatures, and notarization serve different roles

A hash enables an integrity comparison. A cryptographic signature adds a link to a signing key, which must be evaluated through its trust model. An external record can add a time reference for the fingerprint. None of these elements should be interpreted beyond its scope.

Blockchain notarization of a document typically uses a fingerprint to link one version to a ledger. Content Credentials instead organize provenance claims, signatures, and relationships with assets. The two functions can complement each other, but they are not synonyms.

A hash is not encryption either: it does not protect the document's confidentiality. It is not designed to be reversed, but anyone with a possible copy can calculate its fingerprint and look for a match. Do not treat publication of a hash alone as a universal guarantee of anonymity.

A simple process for business documents

Imagine publishing a quarterly report. First approve and export the final version; then calculate its fingerprint, assign a version identifier, and retain the exact file. Finally publish the document with a reference that recipients can verify.

If you correct the report, create a new version and new proof. Keep its relationship with the previous version clear instead of silently overwriting the file behind the same link. In the CMS and API workflow, this step becomes a publishing rule.

Frequently asked questions

To apply the comparison to a file you received, see the guide to checking whether a PDF was modified, which separates fingerprints, signatures, and text review.

Can I reconstruct a PDF from its hash?

No. The fingerprint does not contain a recoverable copy of the document. You must keep the original file. A hash is neither a backup nor an archive.

Do two different hashes mean the text is different?

They mean the bytes do not match, provided the same algorithm was used. The change may affect only metadata, internal structure, or compression without altering the visible text.

Is it enough to send a file and its hash in the same email?

It can be useful as an operational check, but it does not provide an independent reference if both are replaced. Stronger requirements call for a distribution channel and reference proof designed around the relevant risk.