SHA-256

SHA-256 is a cryptographic hash function that turns any input, whether a short password or a 200-page PDF, into a 256-bit value usually written as 64 hexadecimal characters. It belongs to the SHA-2 family published by the US National Institute of Standards and Technology, and it is one of the most widely used hashing algorithms in software, security and e-signatures.

The function has a few properties that make it useful. It is deterministic, so the same input always gives the same output. It is one-way, meaning you cannot practically reconstruct the input from the output. And it is collision-resistant: finding two different files with the same SHA-256 hash is considered computationally infeasible with current technology. A tiny change to the input produces an output that looks completely unrelated.

Here is how that plays out for a small business owner. She signs a supplier agreement and receives the final PDF along with its SHA-256 value. Months later, a colleague forwards a copy from a shared drive. She runs the file through a hashing tool, or a verification page, and compares the result. Identical strings mean identical files; any difference means the copy has been altered, even if the change is invisible on screen.

The biggest misconception is that SHA-256 is encryption. It is not. Encryption is reversible with a key and is designed to keep data secret. Hashing is not reversible and does not hide anything; the original document remains readable. SHA-256 also carries no identity information on its own. It proves that a file is unchanged, not who signed it.

In signing workflows, SHA-256 is used to create a document hash for the final file. That hash can be recorded in an audit trail, printed on a certificate of completion, or, in PKI-based digital signatures, signed with a private key to form a tamper-evident seal. Older functions such as MD5 and SHA-1 are no longer considered safe for this purpose because practical collision attacks have been demonstrated against them, which is why SHA-256 has become the common default for document integrity. You can compute it yourself with built-in commands on macOS, Windows and Linux.

Our take: SHA-256 is boring in the best way. It is well studied, free to use and supported by nearly every operating system. When a vendor mentions it, the right question is not whether they use it but whether they let you check the hash yourself.

eSignSimple computes a SHA-256 hash of each completed PDF, shows it on the certificate of completion, and offers a public /verify page where anyone can confirm that a file matches the signed original.