SHA-256 file integrity: how a digest proves a file has not changed

A SHA-256 digest is a 64-character fingerprint computed from the bytes of a file: change a single byte and the digest changes completely, so two matching digests show that two files are identical. This page explains how a hash works, gives the command to compute one on macOS, Windows and Linux, and says what a digest cannot tell you.

By Martin Ferret · Published September 18, 2026 · Last updated October 28, 2026

What is a SHA-256 digest?

A SHA-256 digest is the fingerprint the SHA-256 hash function computes from a file: it reads a file of any size and always returns 256 bits, written as 64 hexadecimal characters.

9f2c4e8a1b7d3f60c5a29e84bb1730df
5e6a0c93d47182fbe95c2a7d3810a41d

The same file always produces the same digest, on any machine, in any year. A different file produces a different one.

Why does changing one byte change the whole digest?

Change a single character anywhere in the file and the digest does not shift slightly. It becomes an entirely unrelated string, with roughly half its bits flipped.

That property is what makes comparison useful. You do not have to read two files to know they differ; you compare two short strings and they either match exactly or they do not. There is no partial match and nothing to interpret.

How do you compute a SHA-256 yourself?

No software needs to be installed. Every major operating system ships with this built in.

Commands to compute a SHA-256 digest
macOS	shasum -a 256 _chat.zip
Linux	sha256sum _chat.zip
Windows, PowerShell	Get-FileHash _chat.zip -Algorithm SHA256
Windows, Command Prompt	certutil -hashfile _chat.zip SHA256

Run it against the file, compare the result to the digest printed on the certificate page, and you have checked the work yourself rather than taken anyone's word for it. If you would rather not read sixty-four characters off a page, the digest checker does the comparison for you, in your browser, with nothing uploaded.

Why does the source file travel with the document?

A digest printed on a page proves nothing on its own: without the file it describes, there is nothing to compare it against.

So the original ZIP is attached inside the PDF when it is under 10 MB. Whoever receives the document can extract it, run one of the commands above, and see for themselves whether the string matches. The verification does not depend on us being reachable, or on us existing at all. A larger archive is supplied beside the PDF instead, because filing systems cap attachment sizes, and the certificate says which of the two it is.

The digests match: the file is byte-for-byte the one that was used.
They differ: something changed after the document was generated.

What can a digest not tell you?

A digest is evidence of integrity, not of authenticity and not of accuracy. Those are separate questions, answered by people rather than by arithmetic. Making a page citable is a third question again, and the answer to that one is Bates numbering. How a digest fits with the other ways messages are authenticated is covered in How to use WhatsApp messages as evidence in a custody case.

It is also worth saying plainly: ChatExhibits generates a document and a digest. It does not decide what any court accepts, and facilitating verification is not the same thing as guaranteeing anything.

Common questions

Is a SHA-256 digest a form of encryption?

No. A digest hides nothing and protects nothing: the file stays exactly as readable as before. It is a one-way summary, and there is no way to turn a digest back into the file.

Does renaming or copying a file change its SHA-256?

No. The digest is computed from the file’s contents only, so a new name, a copy or an email attachment gives the same value. Opening and re-saving it, or compressing it again, can change the bytes and therefore the digest.

Can two different files have the same SHA-256?

In theory, since there are more possible files than digests. In practice no two different files with the same SHA-256 have ever been found, which is why a match is treated as proof the files are identical.

Why is the digest taken from the ZIP and not from _chat.txt?

Because the ZIP is the file that was provided. Hashing the transcript inside it would describe a different file, and anyone who checked the ZIP against that value would see a mismatch that means nothing.

Why does the certificate not print the PDF’s own digest?

Because writing the digest into the PDF changes the PDF, and with it the digest. A document cannot carry its own fingerprint; it carries the fingerprint of its source file instead.