Document hash

A document hash is a short, fixed-length string calculated from the exact contents of a file, acting as a digital fingerprint for that version. If even one character, pixel or byte changes, the hash changes completely. When people ask what a hash of a PDF is, or how a hash proves a document was not altered, this is the idea they are circling.

It works through a hash function such as SHA-256. You feed the whole file in and get a value out, for example a 64-character hexadecimal string. The same file always produces the same hash, but you cannot run the process backwards to recreate the file from the hash. That makes the value safe to publish and easy to compare.

Suppose a freelance designer signs a statement of work with a client. The signing platform records the hash of the final, signed PDF. A year later the client sends back a copy with a different payment schedule and says it is the signed version. The designer computes the hash of that copy and it does not match the recorded value, so the file has been changed since signing. No expert testimony about fonts or metadata is needed to show it.

A frequent misunderstanding is that hashing encrypts or hides a document. It does neither. The file stays exactly as readable as before; the hash just lets you check whether two files are identical. It also does not say who created the file or who signed it. That identity evidence lives in the audit trail, while the hash ties that trail to one precise version of the document.

Hashes are the building block behind tamper-evident seals and digital signatures in PKI, where the hash is signed with a private key. A plain recorded hash is simpler: it gives integrity checking without certificates. The two approaches complement each other. A PKI signature embeds the check inside the PDF, while a recorded hash lets anyone verify integrity with free tools, even years later and without special software. Either way, the audit trail and certificate of completion are what connect that fingerprint to real people and real events.

Our take: a published hash is one of the most underrated trust features in e-signature. It is cheap, transparent and understandable, and it lets anyone check a file without trusting the vendor's word or logging into anything.

eSignSimple calculates a SHA-256 hash of every completed document, prints it on the certificate of completion and makes it checkable on our public /verify page. Upload a copy there and you will see whether it matches the file that was actually signed.