How a SHA-256 digest proves a file has not changed

A hash function reads a file of any size and returns a short, fixed string. SHA-256 always returns 256 bits, written as 64 hexadecimal characters.

9f2c4e8a1b7d3f60c5a29e84bb1730df
5e6a0c93d47182fbe95c2a7d3810a41d

The same file always produces the same digest, on any machine, in any year. A different file produces a different one.

Change a single character anywhere in the file and the digest does not shift slightly. It becomes an entirely unrelated string, with roughly half its bits flipped.

That property is what makes comparison useful. You do not have to read two files to know they differ; you compare two short strings and they either match exactly or they do not. There is no partial match and nothing to interpret.

No software needs to be installed. Every major operating system ships with this built in.

Run it against the file, compare the result to the digest printed on the certificate page, and you have checked the work yourself rather than taken anyone's word for it. If you would rather not read sixty-four characters off a page, the digest checker does the comparison for you, in your browser, with nothing uploaded.

A digest printed on a page proves nothing on its own: without the file it describes, there is nothing to compare it against.

So the original ZIP is attached inside the PDF. Whoever receives the document can extract it, run one of the commands above, and see for themselves whether the string matches. The verification does not depend on us being reachable, or on us existing at all.

• The digests match: the file is byte-for-byte the one that was used.
• They differ: something changed after the document was generated.

A digest is evidence of integrity, not of authenticity and not of accuracy. Those are separate questions, answered by people rather than by arithmetic. Making a page citable is a third question again, and the answer to that one is Bates numbering.

It is also worth saying plainly: ChatExhibits generates a document and a digest. It does not decide what any court accepts, and facilitating verification is not the same thing as guaranteeing anything.