Prove a file has not changed PROVENANCE

What the record proves

The digest is SHA-256 over the whole file. Change one bit anywhere in it (a character in a document, a pixel in a photograph, a byte of padding nobody would notice) and the digest changes into something with no visible relationship to the old one. So if the value you take today matches the value you take in eight months, the file is byte for byte the file you were given.

The short fingerprint printed alongside it is the first twenty-four characters in groups of four. It is there so two people can compare a file over the phone without reading sixty-four hexadecimal characters at each other. Because it is short it is far easier to collide deliberately, so it is a convenience for spotting a difference, never the thing you rely on. When it matters, compare the whole digest.

What the record does not prove, and how to fix that

It does not prove when you had the file. The time in the record is read off the clock of the machine that made it, and a clock can be set to anything at all. A record that says a file existed on 3 March carries no weight whatever against somebody who says you wrote it in June, because you could have made that record in June with the clock moved back. The tool says so in the record itself rather than leaving you to find out at the point it matters.

The way to fix it is to put the digest somewhere you do not control and cannot edit afterwards, as soon as you have it. Email it to yourself through a provider that keeps its own timestamps, and to somebody else. Post it publicly. Read it into a meeting whose minutes are kept. Any of those anchors the digest to a time that is not yours to move, and once the digest is anchored the file is too.

It also does not say the file is genuine. A perfect record of a forged document proves you have kept the forgery unaltered since you received it, which is worth having and is not the same claim. That is what the rest of the record is for: where it came from, when it reached you, who took custody of it, and anything odd about how it arrived. Fill those in at the time. Nobody remembers accurately eight months later, and a record written from memory is worth less than no record, because it can be shown to be wrong.

Where this sits among the rest

Use CHECKSUM when a publisher has printed a hash and you want to know whether the download matches it; that is verification against somebody else's value. PROOF and SIEVE do this over a whole folder at once rather than one file, which is what you want when the thing you were handed is a disk or an export. CHAIN keeps the running log of who held the material and when it moved, and ATTEST produces the certified schedule that goes with a bundle of electronic evidence. STATEMENT seals a witness statement with a digest of its own so the text cannot be quietly revised after signature.

Everything on this page happens in the browser. The file is read from the disk into memory, hashed, and released; it is never sent anywhere, and the record is a plain text or JSON file you keep.