What is Hash (SHA-256)?
A one-way function that turns any document into a fixed-length fingerprint, used to detect tampering.
A cryptographic hash function (PDF Verified uses SHA-256) takes arbitrary input, a 1-byte file or a 1-GB PDF, and produces a fixed 256-bit output. Two properties matter: it's one-way (you can't reconstruct the input from the hash) and collision-resistant (you can't practically find two different inputs that produce the same hash). Change a single byte of the input and the hash changes completely. That makes hashes ideal as tamper seals on signed documents.
Drop your document here and sign it now. PDF, Word and Excel all work: a .docx or .xlsx is laid out in your browser exactly as it was written, so there is nothing to convert first. Add a signature, a date, a company stamp or a watermark, then download it sealed. Free to start, no account, and the file is never uploaded to open it.
How PDF Verified uses hashing
When a document is uploaded, PDF Verified computes its SHA-256 hash and stores it. When a signer signs, the document's current hash is stamped into the audit trail. When someone scans the public verification QR or visits /verify, the live document's hash is recomputed and compared against the audit-trail hash. Any post-signing change is instantly visible.
Per-signature hashes
In addition to the document-wide hash, PDF Verified computes a SHA-256 of each signature image. This per-signature fingerprint sits on the audit trail next to the IP and timestamp, providing an extra layer of evidence that the specific signature image hasn't been swapped.
Why SHA-256
SHA-256 (Secure Hash Algorithm 2, 256-bit) is the NIST-recommended hash for current digital signatures. SHA-1 is broken (collisions found in 2017). MD5 is broken. SHA-256 has no known collisions and meets the bar for QES under eIDAS.
What PDF Verified is, and what it is not
PDF Verified is a tool for preparing, signing, stamping and checking documents. It is not a law firm, a compliance service or a forensic examiner, and nothing here is legal, financial or compliance advice. Requirements differ by country, by document type and by the party asking, so check what applies to your document before you rely on it, and take advice where the document matters. You are responsible for the documents you create, sign and send, and for having the authority to do so: signing or stamping in somebody else name, or as an organisation you do not represent, is forgery whatever tool is used. To the extent the law allows, we accept no liability for how a document made with this tool is used or relied on. The full position is in our terms of service.