Hash (Cryptographic Hash)

A cryptographic hash is the result of running a document through a hash function, a mathematical process that reads every byte of the file and outputs a short, fixed-length string of characters. That string is the document's fingerprint. A small PDF and a 500-page contract both produce a hash of the same length, but the values are entirely different. The same input always produces the same hash, so two parties can independently compute the hash of a file and check that they match.

The property that makes hashing useful for signing is sensitivity to change. Altering a single character, adding a space, or swapping one pixel in an image changes the output completely, not just slightly. This is sometimes called the avalanche effect. Because the original hash and a hash of the modified file will not match, anyone can tell that the document is no longer the one that was signed. A good cryptographic hash function is also one-way: you cannot reconstruct the original document from its hash, and it is not practical to find a different document that produces the same hash.

In an electronic signature workflow, the platform computes a hash of the final document at the moment it is signed and records that value. If a question about the document comes up later, you re-compute the hash of the file you have and compare it to the recorded one. Matching hashes mean the file is byte-for-byte identical to what was signed; a mismatch means something changed. This is the mechanism behind a tamper-evident seal and the integrity entries in an audit trail. On sign.pink, every signed document is hashed so its integrity can be checked independently of us.

Hashing supports integrity but does not, by itself, prove who signed or when. It tells you whether a file changed, not who created it. That is why hashing is combined with other building blocks: signer authentication establishes who, a timestamp establishes when, and in a digital signature the hash is encrypted with a private key so the result can be tied back to a specific signer through public key infrastructure. Common hash function families you may see named include the SHA-2 family, such as SHA-256.

Examples

• A 2 KB receipt and a 40 MB contract scan both produce a SHA-256 hash that is the same fixed length; only the values differ.
• Someone edits one number in a signed invoice and saves it. The new file's hash no longer matches the recorded one, exposing the change.
• Two parties each compute the hash of the same signed PDF on their own computers and confirm the values are identical, proving they hold the same file.
• An audit trail stores the document's hash at signing so its integrity can be verified later without trusting any single party.