Review and share

What does a file hash prove?

A SHA-256 digest helps compare file bytes. It does not identify a message’s author, establish its truth or reconstruct its history.

By UnPack · Last reviewed: · All resources

A digest describes bytes

A cryptographic hash algorithm takes file bytes and produces a digest. SHA-256 is one such algorithm. NIST’s Secure Hash Standard, FIPS 180-4 defines secure hash algorithms used to detect changes relative to previously generated digests.

The useful comparison is specific: the same algorithm, the exact file you intend to compare and a baseline you have reason to trust. A filename, screenshot of a document or a description of its contents is not that comparison.

What a comparison tells you

If SHA-256 digests differ, the compared byte sequences differ. If they match, that is strong practical support for byte equality, subject to the properties of the algorithm and a reliable comparison. It is not a universal guarantee about the origin of the material.

Fictional example: Alex Example saves an exported TXT and records its SHA-256 digest. Later, a working copy is resaved with different line endings. It may look the same in an editor but have a different digest. The difference shows changed bytes; it does not explain the reason for the change.

What it cannot tell you

A digest alone does not establish who wrote a message, who controlled an account, whether the words are true, or whether someone altered the export before it was hashed. It also does not independently establish when the file was created or prove an uninterrupted chain of custody.

If someone can replace both a file and its accompanying digest, comparing the two does not recover the earlier version. Keep a trusted baseline independently rather than relying solely on a digest supplied beside an unknown file.

Compare the right object

A ZIP, the TXT inside it and a PDF made from it are different files. Their hashes are not expected to match. Repackaging a ZIP or regenerating a PDF can change bytes without changing the conversation text. Record the exact file, algorithm and comparison result; investigate a mismatch rather than labelling it automatically as tampering.

UnPack packages include SHA-256 checksums alongside source and presentation material. They identify contents; they do not authenticate evidence. A signed payment receipt serves a different purpose again: it supports export-access verification, not proof of the conversation. Any decision about legal use requires separate assessment.

Start with your conversation.

Import and explore free. Built for laptop and desktop.

Try UnPack Free