How SHA-256 File Hashing Works
What SHA-256 file hashing is, why fingerprints matter for digital evidence, and how ProofIt uses them.
Published 2026-08-12 · Updated 2026-09-15 · ProofIt Editorial
Direct answer
SHA-256 turns any file's bytes into a fixed 256-bit (64-character hexadecimal) fingerprint. Change a single byte anywhere in the file and the resulting hash changes completely and unpredictably. Two files producing the same hash is, for practical purposes, proof they are byte-for-byte identical.
Definitions
A cryptographic hash function is one-way: given a file, you can quickly compute its hash, but given only the hash, there is no practical way to reconstruct the original file. SHA-256 (Secure Hash Algorithm, 256-bit output) is part of the SHA-2 family published by NIST and is the same hash function used to secure Bitcoin's blockchain, TLS certificates, and countless software integrity checks—it's a well-studied, widely trusted standard rather than a proprietary or exotic algorithm.
Worked example
Hash the text 'ProofIt' and you get one specific 64-character SHA-256 output. Change it to 'ProofIt.' (adding a period) and the output is completely different—not a small variation, but an entirely unrelated-looking string, which is exactly the property ('the avalanche effect') that makes hashing useful for detecting even the smallest tampering. This is also why hashing is sensitive to file format: exporting the same image as a PNG versus a re-compressed JPEG produces different bytes and therefore different hashes, even though the image looks the same to a human.
Why hashing, not encryption, is the right tool here
Encryption is reversible (with the right key) and is designed to hide content. Hashing is one-way and is designed to fingerprint content without hiding it or revealing it—you can prove a file matches a hash without ever disclosing the file itself. That's exactly the property needed for timestamping: a Time Stamping Authority or a blockchain can attest to 'this hash existed at this time' without ever seeing what the file actually contains.
Where ProofIt fits
ProofIt uses SHA-256 content fingerprints as the foundation for certification, optional RFC 3161 trusted timestamping, and Ethereum blockchain anchoring—only the hash moves through those systems, never the original file. See the technology page for the full pipeline from upload to certificate.
FAQ
Can two different files ever produce the same SHA-256 hash? In theory (a 'collision') it's astronomically unlikely and has never been demonstrated for SHA-256 in practice, unlike older algorithms such as MD5 or SHA-1. Does hashing protect the file's content from being seen? No—hashing fingerprints content, it doesn't encrypt or hide it; ProofIt simply never uploads your original file to the TSA or blockchain in the first place.