Your document
A contract, drawing or report. Keep the exact file, because it is the thing you may need to produce later.
The document contains the information.Evidence, in plain language
A fingerprint for your file.
A record you can check.
When two copies disagree, memory is not enough. A digital fingerprint checks the exact file; the supporting record connects permitted actions to an account, a version and a time.
Try changing a sentence ↓Three ideas. No technical knowledge needed.
The file. Its fingerprint.
An independent time receipt.
The hash
Software reads the exact file and calculates its digital fingerprint. Change one comma, one character, or one pixel saved in an image, and its fingerprint changes.
SHA-256 is the recipe. The hash is the result.
The timestamp
A separate timestamp authority signs a receipt for that fingerprint and a time. A reviewer can check the receipt later.
Evidence that this fingerprint existed by that time.Keep the file. Record its fingerprint. Preserve the time receipt.
Together, they help someone check the version and its recorded timing.
Try it yourself · educational example
One small change.
A different fingerprint.
Even a tiny edit changes the fingerprint: one comma, one character, or one pixel saved in an image. It does not matter why the file changed. Try adding a comma below, then restore the original to bring back its original fingerprint.
Original text
The delivery is approved.
Original SHA-256 fingerprintCalculating…Calculating…Calculating the fingerprints…
The coloured pattern is a visual aid derived from the hash, not a biometric fingerprint or a verification result. The full letters and numbers below it are the actual hash.
This example calculates fingerprints on your device. It does not upload your text or sign a document. Use the sample sentence, not confidential information.
What a fingerprint can and cannot tell you
A matching fingerprint is strong evidence of an exact file match when compared with an authentic recorded reference. It does not prove the contents are true, that someone read them, or who approved them. You cannot reconstruct the original document from its fingerprint, so the original file must also be preserved.
Files are compared byte for byte. Re-exporting a PDF or changing hidden metadata can change its fingerprint even if the pages look identical. A mismatch means the files differ, not that someone committed fraud.
SHA-256 produces a 256-bit result, usually displayed as 64 hexadecimal characters. Different inputs can theoretically share a hash, but finding such a collision is computationally impractical with current methods. A hash is not encryption.
Why the independent time matters“We had this version
“We had this version
at that time.”
Your own computer clock is something you control. An independent timestamp adds another party’s signed receipt, which a reviewer can validate.
The authority receives the fingerprint for timestamping, not the document’s contents. The receipt does not say the document is truthful or that someone read it.
Illustrative time receiptFingerprint received
- For this fingerprint
- 2557fcab…3b6e2ecd
- Recorded time
- 29 Sep 2026 · 09:41 UTC
- Issued by
- Independent timestamp authority
In a real receipt, the authority’s digital signature lets a verifier check the receipt’s origin and integrity.
Example only. No timestamp was requested.How the pieces work together
Who. What. When.
Preserved. Verifiable.
Each layer answers a different question. A fingerprint alone cannot answer them all.
Connect the response to a participant.
A person is invited to a named role. The configured process can require KYC for a person, KYB for an organisation, PEP screening and a questionnaire. Those checks have their own status; a human reviewer decides the outcome. Authentication then helps connect a supported opening, acknowledgement or signature to the account and exact document version.
Where captured, time, IP address and browser/device information add context to the event. A passkey can use a biometric or device PIN, but neither a passkey nor an open event proves who physically held the device or that they read and understood every word.
Keep the version that mattered.
The document's SHA-256 fingerprint identifies the exact file being recorded. A later edit, even one character or an image pixel, produces a different fingerprint. A digital signature on the evidence helps a verifier check its origin and detect changes, using an independently established verification key.
An event chain links recorded steps together. Its integrity must be checked against an authenticated reference, not just hashes supplied by the person presenting it.
Get an independent time receipt.
An independent timestamp authority signs a receipt for the fingerprint. RFC 3161 is the format for that receipt. It helps establish that the fingerprint existed by the stated time, without relying only on our server clock.
The receipt must be validated. It does not establish when the document was first written, or prove its contents are true. Check the actual pack for timestamp coverage.
Keep the original and the supporting record.
Files, signatures and timestamp receipts need to remain readable. Retention-locked storage, protected encryption keys and tested backups work together to preserve them.
Strengthened retention controls are an engineering priority, not a claim that every deployment already uses locked storage. Retention periods must suit the applicable obligations.
Give a reviewer something they can check.
A useful evidence package combines the relevant files, a readable account of recorded events and the supporting verification material. The reviewer checks the file match, record signatures and timestamps separately.
The simplified document-checking journey and automatic delivery of independent copies to parties are planned improvements. The example below is a fictional specimen.
When someone asks later
Start with the document.
Follow the supporting record.
For the company and participants
Keep the relevant original documents and evidence export together. If a different copy appears, compare it with the authenticated recorded version. A hash alone cannot recover a missing file.
For a lawyer, auditor or court reviewer
Begin with a readable summary, then inspect the original files and supporting checks. A valid check confirms a specific technical property. The reviewer still assesses context, authority and the meaning of the evidence.
Built to be checked.
Designed to keep improving.
Our engineering priorities include stronger document-bound approvals, preservation controls and simpler independent verification. Post-quantum signatures and additional blockchain timestamp anchors are areas for evaluation, not current service promises.
Read the underlying standards
NIST: Secure Hash Standard
RFC 3161: timestamp receipts
W3C: WebAuthn authentication
NIST: ML-DSA digital signatures