Prove a PDF has not been modified
A file's SHA-256 hash is a 64-character fingerprint that changes completely if even one byte of the file changes, so a recorded hash later proves the file is byte-for-byte unmodified. This tool computes the SHA-256 of your uploaded PDF locally, appends a human-readable verification page (file name, size, hash, date and re-checking instructions), and produces a matching sha256sum-format .txt file. The hash identifies the original file — keep it — because the output copy with the extra page necessarily hashes differently.
How it works
When you drop in a PDF, the tool reads the raw bytes and feeds them to your browser's built-in Web Crypto SHA-256 implementation — the same algorithm behind TLS certificates and software release checksums. SHA-256 maps any input to one of 2256 possible 256-bit values with no known way to find two files that share one; flipping a single bit anywhere in the document yields an unrelated hash. That is what makes the fingerprint meaningful: a match later is overwhelming evidence the file is identical, and a mismatch is proof it is not.
The tool then builds a verification page and appends it to a copy of the document. The page records the original file name, exact byte size, the hash printed in two lines of Courier (so all 64 hex characters survive photocopying legibly), the date of fingerprinting, and step-by-step verification instructions — including the exact commands a recipient runs: shasum -a 256 file.pdf on macOS/Linux and certutil -hashfile file.pdf SHA256 on Windows. Alongside the PDF you also get a one-line .txt file in standard sha256sum format (hash filename), which command-line tools can check automatically with sha256sum -c.
Understand the one unavoidable subtlety: the recorded hash belongs to the original upload, not to the output file. Appending a page rewrites the PDF, so the fingerprinted copy has a different hash by definition — hashing it and comparing against its own last page will always "fail," and that is correct behavior, not a bug. The working practice is: archive the untouched original (that is the file the fingerprint proves), and circulate the fingerprinted copy as the human-readable record of what the hash was and how to check it. If you only need a hash value with no verification page, the simpler checksum tool does exactly that for any file type.
Illustrative example: fingerprinting a signed contract scan
Illustrative scenario, not a recorded benchmark. File sizes, timings and results depend on the input and device. Try the reproducible samples.
A signed contract scan, services-agreement-signed.pdf, is 14 pages and 3,481,602 bytes. The tool computes its SHA-256 — say 7f3a…c91e in full 64 characters — in under a second, then downloads two files: a 15-page PDF of about 3.49 MB whose last page shows the name, the byte count 3,481,602, the hash in two Courier lines, the date August 15, 2026 and the shasum/certutil instructions; and services-agreement-signed.pdf.sha256.txt, a 90-byte text file. The original is archived unchanged. Eighteen months later, either party runs shasum -a 256 services-agreement-signed.pdf against their archived copy: output matching the printed value proves the scan is the same file to the byte — any edit, re-save or page swap in between would have changed the hash entirely.
Frequently asked questions
Why do I have to keep the original file and not just the fingerprinted copy?
The hash on the verification page describes the file exactly as it was uploaded. Appending that page creates a new, different file with a different hash, so only the untouched original will ever match the recorded value. Archive the original; circulate the fingerprinted copy.
How does someone verify the hash later?
Run shasum -a 256 filename.pdf on macOS or Linux, or certutil -hashfile filename.pdf SHA256 on Windows, against the original file. If the printed 64-character value matches the command's output exactly, the file is byte-for-byte unchanged; these commands are also printed on the verification page itself.
Can two different PDFs ever have the same SHA-256 hash?
No practical chance. SHA-256 has 2^256 possible outputs and no known collisions; changing even one byte of the file produces a completely different hash. Matching hashes is accepted evidence of file integrity in forensic practice.
Is this the same as digitally signing a PDF?
No. A hash proves the file is unchanged but not who made it — anyone can hash any file. A digital signature binds an identity certificate to the document cryptographically; a fingerprint page is a lighter-weight integrity record.
What is in the .txt file the tool also downloads?
One line in standard sha256sum format: the 64-character hash, two spaces, then the file name. Tools like sha256sum -c can check the original against it automatically, and it is convenient to email alongside the document.
Is the PDF uploaded to compute the hash?
No. The hash is computed by your browser's built-in Web Crypto implementation on your own device, and the file never leaves it.