Document hash

What does Document hash mean?

A document hash is a short, fixed-length string calculated from the exact contents of a file, acting as a digital fingerprint for that version. If even one character, pixel or byte changes, the hash changes completely. When people ask what a hash of a PDF is, or how a hash proves a document was not altered, this is the idea they are circling.

It works through a hash function such as SHA-256. You feed the whole file in and get a value out, for example a 64-character hexadecimal string. The same file always produces the same hash, but you cannot run the process backwards to recreate the file from the hash. That makes the value safe to publish and easy to compare.

Suppose a freelance designer signs a statement of work with a client. The signing platform records the hash of the final, signed PDF. A year later the client sends back a copy with a different payment schedule and says it is the signed version. The designer computes the hash of that copy and it does not match the recorded value, so the file has been changed since signing. No expert testimony about fonts or metadata is needed to show it.

A frequent misunderstanding is that hashing encrypts or hides a document. It does neither. The file stays exactly as readable as before; the hash just lets you check whether two files are identical. It also does not say who created the file or who signed it. That identity evidence lives in the audit trail, while the hash ties that trail to one precise version of the document.

Hashes are the building block behind tamper-evident seals and digital signatures in PKI, where the hash is signed with a private key. A plain recorded hash is simpler: it gives integrity checking without certificates. The two approaches complement each other. A PKI signature embeds the check inside the PDF, while a recorded hash lets anyone verify integrity with free tools, even years later and without special software. Either way, the audit trail and certificate of completion are what connect that fingerprint to real people and real events.

Our take: a published hash is one of the most underrated trust features in e-signature. It is cheap, transparent and understandable, and it lets anyone check a file without trusting the vendor's word or logging into anything.

eSignSimple calculates a SHA-256 hash of every completed document, prints it on the certificate of completion and makes it checkable on our public /verify page. Upload a copy there and you will see whether it matches the file that was actually signed. Our guide on how to verify an electronic signature walks through checking a hash in practice.

What is an example of document hash?

A consultant and a client disagree about the payment terms in a signed agreement, and each has a PDF that looks slightly different. The consultant uploads both files to eSignSimple's /verify page. Her copy matches the SHA-256 hash recorded at completion; the client's copy produces a different hash, which shows it was changed after signing.

Why does my copy not match the hash when nothing looks changed?

Because a hash compares bytes, not appearance. Opening a PDF and saving it again, even without editing, often rewrites internal structures, updates a modification date or recompresses images, and every one of those changes the fingerprint. Printing to PDF, exporting from a preview app, adding a single highlight, flattening form fields, merging with another file or extracting pages all produce a new file that looks the same but is not the same.

The fix is to go back to the file as it was delivered: the attachment in the completion email, or a fresh download from your dashboard. Email attachments and normal cloud storage keep files byte-for-byte intact, so a copy saved straight from them should match. If you have only a re-saved copy, it will not verify, which is not proof of tampering, just proof that it is not the original file. That is why we suggest storing the delivered PDF untouched and making any working copies separately.

Which hashes does eSignSimple record, and when?

We compute fingerprints at three points. When you upload a document, we record the SHA-256 of the file as uploaded. When you finish preparing it and send it for signature, the version signers will see is fingerprinted again and logged as finalized for signing. And when the last signer completes, we stamp the field values into the PDF, append the certificate of completion, and fingerprint the finished file. That final value is the one checked on the verify page.

Together these show the chain from the file you started with to the file everyone signed. The original fingerprint is printed on the certificate, so it travels with the document; the final one sits in our records, because a file cannot contain its own hash. If you use the certificate of completion in a dispute, these two values let you show both where the process began and what it produced.

How do you check a document hash yourself, step by step?

The quickest way is our /verify page. Select the PDF; your browser computes its SHA-256 locally and sends only the 64-character fingerprint to look it up, so the document itself is not uploaded. If it matches a completed document, you see its title, completion time and the signers with their signing times. If it does not match, the file is not identical to any completed document.

To check independently of us, compute the hash with your operating system. On macOS or Linux, open a terminal and run shasum -a 256 followed by the file name; on Windows, run certutil -hashfile followed by the file name and SHA256. Compare the result with the value you were given, character by character, or paste both into a text editor and search for one inside the other. Our guide on how to verify an electronic signature covers what to do when the results differ.

Which terms are related?

• Digital signature: A digital signature is a cryptographic mechanism that uses public key infrastructure to prove who signed a document and that it has not changed.
• Audit trail: An audit trail is a chronological record of events in a document's signing process, such as sending, viewing and signing, with timestamps.
• Certificate of completion: A certificate of completion is a summary document issued when all parties have signed, listing signers, timestamps and document integrity data.
• SHA-256: SHA-256 is a cryptographic hash function from the SHA-2 family that turns any file into a unique 256-bit fingerprint used to detect tampering.
• Tamper-evident seal: A tamper-evident seal is a cryptographic seal on a PDF that shows whether the document has been changed in any way after it was signed.