What is a cryptographic hash?

How does it work?

A hash function processes a file and produces a value, usually displayed as a string of letters and numbers. The same file processed with the same hash function always produces the same result. Calculating a hash is a straightforward operation that can be performed locally on your computer; there is no need to upload the file.

For example, you could calculate the hash of a design file before sending it to a collaborator. If you later use the same hash function to calculate the hash of the returned file and obtain the same value, that is strong evidence that its contents have not changed. If the values differ, the files differ—even if the change is not immediately visible.

Changes to information stored inside the file, such as embedded metadata, can also change its hash. Renaming a file ordinarily does not, because its filename is separate from its contents.

What is SHA-256, and how long is its hash?

SHA stands for Secure Hash Algorithm. SHA-256 is a widely used member of the SHA-2 family, standardised by NIST. SHA-2 and SHA-3 are both current families of cryptographic hash algorithms; the older SHA-1 is being phased out. NIST’s overview describes these standards.

The “256” refers to the length of the result: 256 bits, or 32 bytes, usually displayed as 64 hexadecimal characters using the digits 0–9 and letters a–f. A short text file and a large design archive both produce a SHA-256 hash of exactly that length. The hash’s length depends on the algorithm, not on how much information the file contains.

A longer hash provides more possible values: SHA-256 has 2²⁵⁶ possible results. Two different files can theoretically have the same hash, which is called a collision, but finding such a pair is computationally infeasible with a secure algorithm such as SHA-256. This is why a matching hash is strong evidence of identical contents, rather than a mathematical guarantee that every possible file has a unique fingerprint.

How much difference can one character make?

These sentences differ only in their final punctuation: a full stop versus an exclamation mark.

Each hash contains 64 hexadecimal characters, split across four lines here for readability. The hashes were calculated from the exact sentences shown, encoded as UTF-8, including the final punctuation and with no trailing space or line break.

Changing just the punctuation produces a very different hash. The same principle applies to files: changing a single byte—even in metadata that is not visible when you open the document—changes the hash with overwhelming probability. Similar-looking hashes do not indicate similar files.

What does a hash tell you about a file?

A hash helps identify an exact digital version and detect changes. On its own, it does not establish when the file existed, who created it or who owns the rights to its contents.

To establish a dated record, the hash needs to be connected to reliable evidence of time, such as a digital timestamp. To connect the file to a person or development process, additional records are needed.

Does a hash reveal the file’s contents?

A cryptographic hash is not an encrypted copy of the file, and it cannot be decrypted to recover the original.

A timestamp provider can receive the hash rather than the file itself. Check what actually reaches its server: only a fingerprint, an encrypted file, or readable contents. If the service also stores the file, check whether encryption happens before upload and who can access the decryption keys.

Why does this matter for intellectual property?

A hash lets a certificate or timestamp refer precisely to a particular design, document, source-code archive or other digital file. The file itself does not need to be included in the timestamp record.

Keep the exact certified file alongside its certificate. Later verification depends on recalculating its hash and checking that it matches the certified value. A hash cannot reconstruct a missing file or restore an altered file to its certified version.