What is Hash (SHA-256)?
A one-way function that turns any document into a fixed-length fingerprint — used to detect tampering.
A cryptographic hash function (PDF Verified uses SHA-256) takes arbitrary input — a 1-byte file or a 1-GB PDF — and produces a fixed 256-bit output. Two properties matter: it's one-way (you can't reconstruct the input from the hash) and collision-resistant (you can't practically find two different inputs that produce the same hash). Change a single byte of the input and the hash changes completely. That makes hashes ideal as tamper seals on signed documents.
How PDF Verified uses hashing
When a document is uploaded, PDF Verified computes its SHA-256 hash and stores it. When a signer signs, the document's current hash is stamped into the audit trail. When someone scans the public verification QR or visits /verify, the live document's hash is recomputed and compared against the audit-trail hash. Any post-signing change is instantly visible.
Per-signature hashes
In addition to the document-wide hash, PDF Verified computes a SHA-256 of each signature image. This per-signature fingerprint sits on the audit trail next to the IP and timestamp, providing an extra layer of evidence that the specific signature image hasn't been swapped.
Why SHA-256
SHA-256 (Secure Hash Algorithm 2, 256-bit) is the NIST-recommended hash for current digital signatures. SHA-1 is broken (collisions found in 2017). MD5 is broken. SHA-256 has no known collisions and meets the bar for QES under eIDAS.