What Is a Hash?
A cryptographic hash is a mathematical function that converts any data — a file, a message, an entire hard drive — into a fixed-length string of characters. Think of it as a digital fingerprint that is unique to the exact content of the data.
For SHA-256 specifically, the output is always a 256-bit (64-character hexadecimal) string, regardless of input size:
Input: "Hello"
SHA-256: 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
Input: "Hello." (one period added)
SHA-256: 2d8bd7d9bb5f85ba643f0110d50cb506a1fe439e769a22503193ea6046bb87f7
Notice how adding a single period completely changes the hash. This is called the avalanche effect — even the tiniest change produces a dramatically different output.
Why SHA-256 for Evidence?
SHA-256 has three properties that make it ideal for evidence verification:
1. Deterministic
The same input always produces the same output. If you hash your evidence package today and again in five years, you'll get the identical hash — proving nothing changed.
2. One-Way (Pre-image Resistant)
Given a hash, it is computationally infeasible to reconstruct the original data. You cannot work backwards from the fingerprint to fabricate matching content.
3. Collision Resistant
It is practically impossible to find two different inputs that produce the same hash. The probability of a collision is approximately 1 in 2^256 — a number larger than the estimated atoms in the observable universe.
How TrueSnap Uses SHA-256
When TrueSnap captures a webpage, the hash verification process works like this:
- Capture phase: All evidence files (screenshot, DOM, HAR, certificates) are bundled
- Hash computation: SHA-256 is computed over the complete evidence package
- Blockchain anchoring: The hash is written to the Polygon blockchain with a timestamp
- Verification: Anyone can recompute the hash and compare it with the blockchain record
The verification logic:
If recomputed_hash == blockchain_hash:
Evidence is UNTAMPERED (100% mathematical certainty)
If recomputed_hash != blockchain_hash:
Evidence has been MODIFIED (something changed since capture)
Verifying a Hash Yourself
You don't need to trust TrueSnap's software to verify evidence. Any SHA-256 implementation will produce the same result:
On macOS/Linux:
shasum -a 256 evidence-package.zip
On Windows (PowerShell):
Get-FileHash evidence-package.zip -Algorithm SHA256
Online tools: Many websites offer SHA-256 calculation — the result will be identical regardless of which tool you use, because it's pure mathematics.
Common Questions
Can SHA-256 be broken?
As of 2026, no practical attack against SHA-256 exists. It remains the standard for:
- Bitcoin and cryptocurrency security
- Government document verification (NIST standard)
- Software distribution integrity
- SSL/TLS certificates
What about quantum computers?
Theoretical quantum attacks (Grover's algorithm) would reduce SHA-256's security from 256-bit to 128-bit equivalent — still considered secure. Post-quantum hash standards are being developed, but SHA-256 remains safe for the foreseeable future.
Does the hash prove WHEN something was captured?
The hash alone only proves integrity (nothing changed). For timing proof, the hash must be anchored to a timestamped record — which is why TrueSnap writes it to a blockchain with an immutable timestamp.
The Bottom Line
SHA-256 transforms the question "has this evidence been tampered with?" from a matter of trust into a matter of mathematics. When a hash matches, it's not an opinion or an assertion — it's a mathematical proof that the evidence is identical to what was originally captured.