Hashes: a fingerprint for any data

A hash is a short fingerprint worked out from any data: a sentence, a photo, a whole file. The same data always gives the same fingerprint, and the smallest change gives a completely different one.

Information, not advice.

What a hash is

A hash function takes data of almost any size and turns it into a fixed-length string of letters and numbers, called a hash or digest.

Anyone can hash the same data and get the same result, which shows the data has not changed. Change a single bit, and the result is completely different.

Try it below. The second box starts with one character changed.

Try it

Worked out in your browser. Nothing you type or choose is sent anywhere.

Some text

SHA-256 fingerprint

…

The same text, changed

SHA-256 fingerprint

…

Source: NISTIR 8202: Blockchain Technology Overview, US National Institute of Standards and Technology (Yaga, Mell, Roby, Scarfone) (Oct 2018), section 3.1 and table 1 · read 21 Oct 2026
Source: FIPS 180-4: Secure Hash Standard (SHS), US National Institute of Standards and Technology (Aug 2015) · read 21 Oct 2026

Technical detail

The function used here is SHA-256. It gives 256 bits (32 bytes), usually written as 64 hexadecimal characters. It is specified in FIPS 180-4.

NIST's own example: the SHA-256 of Hello, World! is dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f. The box below gives the same.

The text is turned into bytes as UTF-8 before it is hashed, so the same words typed on another computer give the same hash.

Why it cannot be run backwards

You cannot work out the data from its fingerprint. Nor can anyone find a second piece of data with the same fingerprint, except by trying one input after another, and that would take far too long to succeed.

Source: NISTIR 8202: Blockchain Technology Overview, US National Institute of Standards and Technology (Yaga, Mell, Roby, Scarfone) (Oct 2018), section 3.1 · read 21 Oct 2026

Technical detail

The three properties NIST lists: preimage resistance (given a digest, you cannot find an input that gives it), second preimage resistance (given an input, you cannot find another with the same digest) and collision resistance (you cannot find any two inputs with the same digest).

To find a collision in SHA-256 takes about 2^128 tries on average. NIST worked out that at the whole Bitcoin network's 2015 rate, 300 quadrillion hashes a second, that would take roughly 3.6 × 10^13 years.

How a blockchain uses them

Hashes do several jobs on a blockchain. They lock each block to the one before. They make one short fingerprint of all the transactions in a block. And they turn a public key into a shorter address.

Source: NISTIR 8202: Blockchain Technology Overview, US National Institute of Standards and Technology (Yaga, Mell, Roby, Scarfone) (Oct 2018), sections 3.1 and 3.4 · read 21 Oct 2026
Source: Bitcoin: A Peer-to-Peer Electronic Cash System, Satoshi Nakamoto (a pseudonym), on bitcoin.org, section 7 · read 21 Oct 2026
Source: Ethereum accounts, ethereum.org (page updated 6 Aug 2026) · read 21 Oct 2026

Technical detail

In Bitcoin, a block's transactions are hashed in a Merkle tree and only the root goes into the block's hash, so old transactions can be pruned without breaking it.

SHA-256 is not the only family used. Others include Keccak (the winner of NIST's competition for SHA-3; Ethereum addresses use Keccak-256) and RIPEMD-160.

Fingerprint a photo

Hashing works on any file. Choose a photo below and this page works out its SHA-256 fingerprint. The photo is not uploaded: your browser reads it on your device and sends it nowhere.

Existamp, a separate app, uses a fingerprint in this way. The sentences below are its own, from its home page.

A receipt proves that these exact files existed, unchanged, by the time shown on the receipt.

It does not prove that what a file shows or says is true, or that a scene was not staged.

It does not prove who took the photos or made the files, or where.

It is not legal advice. Whoever settles a dispute, such as a deposit scheme, a court or a hire company, decides what evidence it accepts.

Your files never leave your phone or computer. We only receive the set's fingerprint, a string of letters and numbers worked out from the files that can't be turned back into them.

Try it

Worked out in your browser. Nothing you type or choose is sent anywhere.

Choose a photo or any file

No file chosen yet.

Existamp (opens a separate app)

Source: FIPS 180-4: Secure Hash Standard (SHS), US National Institute of Standards and Technology (Aug 2015) · read 21 Oct 2026
Source: Existamp, home page, Existamp, a separate app · read 26 Oct 2026

Technical detail

The file's bytes are hashed exactly as they are, so a copy of the same photo gives the same fingerprint, but a resized or re-saved copy does not.

The hash on your receipt

A finished check on this site ends with a receipt, and the receipt carries a SHA-256 hash of its facts. “Check a receipt you were given” hashes the pasted text again and compares the two. If one character of the facts has changed, the hashes will not match.

Source: The receipt at the end of every check, Crypto Scan, the checks on this site · read 21 Oct 2026
Source: FIPS 180-4: Secure Hash Standard (SHS), US National Institute of Standards and Technology (Aug 2015) · read 21 Oct 2026

Technical detail

The facts are written as canonical JSON (RFC 8785, with numbers written as text) before they are hashed, so the same facts always give the same text and the same hash. The receipt is worked out in your browser and not stored.