Home › Guides › Why a SHA-256 hash of the source file helps

Why a SHA-256 hash of the source file helps

Updated November 8, 2026

A SHA-256 hash is a 64-character fingerprint calculated from every byte of a file. Change a single character in the file and the fingerprint changes completely. That makes it a simple, widely accepted way to show that a file is exactly the same as an earlier copy.

What it looks like

bbbcb39e467fdfbde847070b136b6cf55cffae0e77713848b5a2eeee6a0c92c3

SHA-256 is part of the SHA-2 family of hash functions standardized by NIST in FIPS 180-4. It is built into every major operating system, so anyone can check a value without special software.

Why it helps with message exhibits

An exhibit PDF is a formatted copy. The source file (the backup or chat export) is the original. Our PDF prints each source file’s name, size and SHA-256 hash on its last page, computed in your browser at the moment you made the PDF. Later, anyone with the original file can compute its hash and compare. If the values match, the file is the same one the PDF was made from.

US federal courts recognize this idea. The committee note to Federal Rule of Evidence 902(14) explains that copies of electronic data are ordinarily authenticated by hash value: if the original and the copy have the same hash, it is highly improbable that they differ. That rule also requires a certification from a qualified person; a hash printed by a tool is not that certification.

What a hash does not show

• It does not show that the messages are genuine, complete or written by the people named.
• It does not show when the file was created. It only shows that the file has not changed since the hash was taken.
• It covers the file, not the PDF. Redaction, date filters and labels change the PDF, not the source file, so the source hash still matches the original.

Check a hash yourself

Compare the result with the value in the source log. Upper or lower case does not matter. For a WhatsApp .zip, the source log lists two hashes: one for the archive you chose and one for the chat text file inside it.

Good habits

• Keep the original export in a safe place and work from copies.
• Record the hash when you first export, along with the date, the phone and the method.
• If you send the original file to someone, they can confirm the hash themselves.
• After you create the PDF, the tool also shows the PDF’s own SHA-256, so you can later confirm a copy of the exhibit is unaltered.