Every time you browse a secure HTTPS website, transfer funds via digital banking, or verify a document on VerixID, a mathematical function called SHA-256 is operating behind the scenes. This function forms the bedrock of modern digital trust.
But how does it actually work? And why can its output — a simple 64-character string — serve as evidence stronger than a manual signature?
SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic function that transforms data of any size into a unique 64-character hexadecimal string. Developed by the United States NSA, published as the FIPS 180-4 federal standard, it now serves as the backbone of global internet security.
From File to Fingerprint: The Hashing Process
Imagine SHA-256 as an ultra-precise grinder. Whether you feed it a single sheet of paper or a million sheets, the machine always yields an output of identical size: exactly 64 hexadecimal characters (256 bits).
Consider these real-world examples. Inputs vary vastly in size, yet the output remains consistently 64 characters:
Four Fundamental Properties of SHA-256
What elevates SHA-256 above ordinary compression functions are its four absolute mathematical properties:
The Avalanche Effect: One Character, Entirely Different Hash
Among these properties, the avalanche effect is paramount for document integrity verification. Consider this concrete demonstration:
The legal implications are profound: if someone alters a figure in a contract — changing IDR 100 million to IDR 900 million — the document's hash will immediately differ from the ledger record. Tampering cannot occur undetected.
SHA-256 proves that document content remains unchanged, not that the document is legally valid or truthful. Content integrity and legal validity are separate concepts — both are required for complete evidentiary proof.
Why Tampering is Impossible
A frequent question is: "What if someone modifies a document, calculates a new hash, and claims it is the original?"
This is where VerixID’s immutable ledger enters. Your document's hash is not merely calculated — it is recorded with an absolute timestamp onto an immutable ledger. Anyone attempting to manipulate the document will generate a new hash that fails to match the registration timestamp record.
The combination of SHA-256 and an immutable timestamp ensures tamper-proof verification:
| Scenario | Outcome | Detected? |
|---|---|---|
| Document unmodified | Verification hash matches ledger hash | Integrity intact |
| 1 character modified | Hash differs by ~50% from ledger record | Detected |
| Metadata modified | Hash entirely different | Detected |
| File entirely replaced | Hash completely different | Detected |
| Ledger hash modified | Ledger is append-only; modification is impossible | Impossible |
SHA-256 in the Real World
SHA-256 is neither experimental nor novel. It has been deployed for over two decades across the world's most critical systems:
TLS/HTTPS — every secure website connection (including online banking) relies on SHA-256 to verify server certificates. When you see the padlock icon in your browser, SHA-256 is working behind it.
Bitcoin & blockchains — every block in the Bitcoin blockchain is hashed using SHA-256 twice (double SHA-256). Hundreds of billions of dollars in network security depend on its resilience.
Banking systems — transaction verification, database integrity, and audit trails across global financial institutions utilize SHA-256 as standard.
Software distribution — when downloading operating systems or applications, SHA-256 hashes verify that received files match published releases without transit tampering.
To date, no successful collision attacks against SHA-256 have been recorded, unlike SHA-1, which was proven vulnerable in 2017 and is deprecated. VerixID explicitly uses SHA-256, avoiding SHA-1 or MD5.
How VerixID Uses SHA-256
At VerixID, hashing occurs entirely within your browser using the Web Crypto API — a built-in cryptographic interface standard in modern browsers. Files are never transmitted to our servers.
Only the 64-character hash value, alongside a timestamp and Record ID, is sent to the VerixID ledger. This ensures:
Architectural privacy — our servers are technically incapable of viewing your document contents since we never receive them.
Independent verification — anyone can independently verify document integrity by recalculating the file hash and comparing it against the recorded entry, without needing to trust VerixID.
You can prove file integrity independently without relying on VerixID systems:
If results match, the document has remained unchanged since registration. If they differ, modification has occurred. No need to trust VerixID. Trust mathematics.
Mathematical proof, not institutional trust — trust is established not on VerixID's corporate reputation, but on two decades of proven mathematical properties of SHA-256.
Calculate Your Document Hash
Hashing runs directly in your browser — files are never sent anywhere. Experience your document's mathematical fingerprint firsthand.
Start at Audit Page