How to Verify a File by SHA-256 Hash: Step-by-Step Guide
Published: June 18, 2026 · tutorial · hash · verificacion · Leer este artículo en español
To verify a file by hash, compute its SHA-256 fingerprint on your own machine and compare it with the one recorded in the public seal at /verify. If both strings match character by character, the file is identical to the sealed one; if anything differs, the content changed.
Step 1: compute the local hash
On Windows, open a terminal and run certutil -hashfile photo.jpg SHA256, replacing photo.jpg with the path to your file. On macOS or Linux, the equivalent command is shasum -a 256 photo.jpg. The output is a 64-character hexadecimal string that summarizes the exact content of the file: flipping a single bit produces a completely different string. There is nothing to install, because both utilities ship with the operating system.
Step 2: compare against the public seal
Open /verify and enter the seal identifier, or paste the hash you just computed. The page is public: no account, registration, or payment, and it displays the 7-link traceability chain with the recorded fingerprint, the server_clock timestamp, and the declared identity, with contact details masked. Compare the two hexadecimal strings carefully; partial matches do not exist in this terrain, either they are identical or the file is not the same.
Step 3: interpret the result
A full match means the file you hold is, bit for bit, the one sealed on the stated date; nobody has touched it since, not even its metadata. A mismatch does not imply bad faith: re-saving the image, converting the format, or forwarding it through a messaging app that compresses already alters the fingerprint. In that case, request the original file from the source and repeat the check. If you work from a phone, the native Android app lets you run this verification without opening a computer. With a little practice, the full cycle, computing the fingerprint, pasting it, and comparing, takes under a minute on the clock. Turning it into a habit for any relevant file prevents future headaches: verifying today costs seconds, while reconstructing the history of a document a year from now may prove simply impossible. Integrity is something you check, never something you assume.
Frequently asked questions
Which command gives me the hash on Windows?
The built-in command is certutil -hashfile path-to-file SHA256, run in Command Prompt or PowerShell. It returns the SHA-256 fingerprint in hexadecimal. On macOS and Linux the equivalent is shasum -a 256 path-to-file. Both come preinstalled, so you do not need to download third-party tools to verify.
Can I verify without knowing the seal identifier?
Yes. The /verify page also accepts the SHA-256 hash itself: compute the fingerprint of the file you received and paste it into the search box. If a seal exists with that exact fingerprint, it will appear with its date and full traceability. This is the natural route when a loose file arrives without a link or reference.
The hash matches but the content looks fake. Now what?
A hash match only confirms the file has not changed since sealing; it does not validate that what it shows is true, nor that the real creation date matches the seal date. For doubtful content, cross-check the source, look for earlier versions, and consider forensic analysis. Integrity is one piece, not the verdict.
Seal your content now
Free, no account required, with a public verification link.
Veritas UGC generates technical evidence (hash, timestamp and traceability). It is not legal advice nor a government IP registry.