The Fingerprint Analogy
You know how every person has a unique fingerprint? A SHA-256 hash is like a fingerprint for a file.
Just as your fingerprint:
- Is unique to you
- Doesn’t reveal what you look like
- Can be compared to confirm your identity
- Doesn’t change over time
A SHA-256 hash:
- Is unique to the exact file contents
- Doesn’t reveal what the file contains
- Can be compared to confirm the file is unchanged
- Doesn’t change as long as the file doesn’t change
The technical term is a cryptographic hash function. But “digital fingerprint” captures the essential idea.
What SHA-256 Actually Does
SHA stands for Secure Hash Algorithm. The 256 refers to the output size: 256 bits, which is displayed as 64 hexadecimal characters.
When you feed a file into SHA-256, it processes the data through a series of mathematical operations and produces a fixed-length output. Here’s what that looks like:
Input: A text file containing “Hello, World!”
Output: dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f
Input: A text file containing “Hello, World**.**” (added a period)
Output: f764c9cdb2be87c5a760ce69f58e30af78de1a3af07a7e5acfa62a5559acab00
Notice: one tiny change (adding a period) produced a completely different hash. This is called the avalanche effect — any modification to the input, no matter how small, cascades through the algorithm and changes roughly half the bits in the output.
This property is what makes SHA-256 perfect for proving file integrity. If the hash matches, the file is identical. If it doesn’t, something changed.
The Five Properties That Matter
1. Deterministic
The same input always produces the same output. Hash your file today and hash it again next year — if the file hasn’t changed, the hash will be identical. This is what makes verification possible.
2. One-way
You can easily compute the hash from a file, but you cannot compute the file from a hash. This is not a limitation — it’s a feature. It means publishing a hash reveals zero information about the file’s contents.
3. Collision-resistant
It’s computationally infeasible to find two different files that produce the same hash. The number of possible SHA-256 outputs (2^256) is approximately 1.16 × 10^77. For context:
- Atoms in the observable universe: ~10^80
- Grains of sand on Earth: ~10^19
- Seconds since the Big Bang: ~10^17
Finding a collision by brute force would require trying more combinations than atoms in the universe.
4. Avalanche effect
Change one bit of input, and roughly half the output bits change. There’s no way to predict which bits will change, and no way to make a “small” change to a hash. Every modification looks completely random.
5. Fixed output size
Whether your file is 1 byte or 100 gigabytes, the hash is always 64 hexadecimal characters. This makes hashes practical to store, transmit, and compare, regardless of the original file size.
How TimeProof Uses SHA-256
When you timestamp a file with TimeProof:
- Your browser computes the SHA-256 hash of your file, locally on your device
- Only the hash (64 characters) is sent to TimeProof’s servers
- TimeProof anchors the hash to the Polygon blockchain via a smart contract
- To verify later, you hash the file again and compare it to the blockchain record
If the hashes match → the file is bit-for-bit identical to what was timestamped. If they don’t match → the file has been modified.
The beauty of this system is that TimeProof never sees your file. We can’t see your file. No one in the process sees your file. Only the mathematical fingerprint is recorded.
Common Questions Demystified
”What if my file is modified slightly?”
Even the tiniest change — a single pixel in an image, a single character in a document, one reordered byte — produces a completely different hash. There’s no concept of “close” in hashing. The hash either matches (identical file) or it doesn’t (different file).
”What if I rename the file?”
The hash is based on the file’s contents, not its name. Renaming photo.jpg to evidence.jpg produces the same hash because the contents haven’t changed.
”What about compressing or converting files?”
Compressing (ZIP), converting (JPEG to PNG), or re-encoding (WAV to MP3) changes the file contents, producing a different hash. Always hash the original file and keep that exact file for verification.
”Can I hash a folder?”
Not directly — SHA-256 operates on individual files. To hash a folder, either ZIP it first (and hash the ZIP) or hash each file individually. TimeProof supports both approaches.
SHA-256 in the Real World
SHA-256 isn’t just for timestamping. It secures much of the internet:
- Bitcoin: The entire Bitcoin blockchain uses SHA-256 for mining and transaction verification
- HTTPS: The padlock in your browser relies on SHA-256 for certificate verification
- Software updates: When you download an app, SHA-256 verifies it hasn’t been tampered with
- Password storage: Responsible services store SHA-256 hashes of passwords, not the passwords themselves
- Digital signatures: Government, financial, and legal digital signatures use SHA-256
When you timestamp a file with TimeProof, you’re using the same cryptographic foundation that secures trillions of dollars in financial transactions daily.
Try It Yourself
Curious what your file’s hash looks like? Use the free SHA-256 hasher on this page. Drop any file — it’s computed entirely in your browser, nothing is uploaded. The resulting 64-character string is what TimeProof would anchor to the blockchain.