Skip to content

Verify a Document

Check whether a file is byte-identical to the one it claims to be. Computes its SHA-256 fingerprint and compares it against the one you were given.

Private · on device. Runs in your browser: your file is not uploaded. No sign-up.

Any file: a PDF, an image, anything
What a fingerprint proves, and what it does not. A matching fingerprint proves the file is byte-identical to the one it was taken from, nothing has been edited, added or removed. It does not prove who created it, who signed it, or when. For that you need a certificate authority, which needs a server. This is the part that can be done honestly without one.

The question nobody can usually answer

Someone sends you back a signed contract. It looks right. How do you know the figure in clause 4 is the figure that was there when you sent it?

Usually you do not. You read it again, carefully, and hope you would notice. For a two-page letter that is fine. For a forty-page agreement with a number buried in a schedule, it is not.

What a fingerprint is

SHA-256 reduces a file of any size to 64 characters. Two properties make it useful here.

The same file always produces the same value. Anyone, on any machine, at any time.

Any change produces a completely different value. Not a similar one, a completely different one. Changing a single character of a document changes the fingerprint beyond recognition. There is no way to alter a document and keep its fingerprint.

So a fingerprint recorded at signing is a check anyone can run afterwards, with no trusted third party involved, forever.

How to use it in practice

When you send a document: run it through this page and include the fingerprint in your covering message. It costs you ten seconds.

When you receive one back: run it through again and compare. If it matches, nothing has been touched.

One caveat worth understanding. Send the fingerprint by a different route from the document where it matters, a message, a phone call, a separate email. Anyone able to alter the document in transit could also alter a fingerprint travelling with it. For most situations this is over-cautious; for a high-value contract it is not.

Why a mismatch is not automatically alarming

This is the part people get wrong, so it is worth stating plainly: a document can change bytes without changing meaning.

Opening a PDF in some readers and saving it rewrites the internal structure. Adding an annotation and removing it again can leave the file different. Re-downloading a document from a system that regenerates it produces a different file each time.

So a mismatch means the bytes are not the same, which is worth knowing. Whether that indicates a change of substance is a question you then go and answer by reading. The tool says exactly this rather than declaring the document tampered with.

What this cannot do

It cannot tell you who. A fingerprint has no identity attached: it establishes that a document is unchanged, never who wrote or signed it. Binding a signature to a verified identity requires a certificate authority, and a certificate authority requires infrastructure this site deliberately does not have.

It also cannot tell you when, beyond what you record yourself. A trusted timestamp is another service with another server behind it.

What is left is the half that can be done honestly with no server at all, and it happens to be the half free signing tools leave out entirely. The signing tool shows you a fingerprint when you sign, and can append a record page carrying the fingerprint of the document as signed.

Frequently asked questions

What does a matching fingerprint actually prove?

That the file in front of you is byte-identical to the one the fingerprint was taken from. Not a word changed, not a figure altered, not a page added or removed. That is a strong and precise claim, and it is the whole claim. It says nothing about who made the document or who signed it.

And what does a mismatch prove?

That the bytes differ. That is not the same as proving tampering: opening a PDF in some readers and saving it rewrites the file without changing a word, and re-downloading a document can produce a different file. So a mismatch means "this is not the same file", which is worth knowing, rather than "someone has altered this document".

Why is this not just a digital signature?

Because a fingerprint has no identity attached. A certificate binds a signature to a verified identity through a certificate authority, so the document proves both that it is unchanged and who signed it. A fingerprint gives you the first half only. The reason this site offers the first half is that it can be done honestly with no server, and the second half cannot.

Is my file uploaded?

No. The fingerprint is computed in this browser tab using the browser's own cryptography, and nothing is transmitted. Which matters, since the documents worth verifying are usually the confidential ones.

What files does this work on?

Any file at all, PDF, Word, images, spreadsheets, archives. SHA-256 does not care what the bytes mean.

Where do I get the expected fingerprint?

From whoever sent you the document. If they signed it with the sign tool here, they were shown one to keep. Otherwise, ask them to run their copy through this page and send you the value, by a different route from the document itself, ideally, since a fingerprint sent alongside a file can be changed by anyone who could change the file.