# Does a SHA-256 hash prove when a document existed?

Canonical: https://senseible.earth/answers/sha-256-hash-vs-trusted-timestamp

No. A SHA-256 hash proves a file has not changed since the hash was made, but it carries no date. To prove when a document existed you need the hash recorded somewhere independent at a known time, such as a trusted timestamp under RFC 3161, a digital signature, or a copy held by someone else.

## Integrity and time are separate questions

SHA-256 (NIST FIPS 180-4) reduces any file to a fixed 256-bit value, usually shown as 64 hexadecimal characters. Anyone can recompute that value at any time, today or in five years, and get the same answer. That is why it proves the file is unchanged, and also why it says nothing about the date.

A date written next to a hash in your own system is only as trustworthy as whoever controls the system. Someone could create a file today and record yesterday's date beside its hash.

## Ways to fix the time

- Trusted timestamp (RFC 3161). You send only the hash to a time-stamping authority, which returns a signed token binding that hash to its clock time. Anyone with the authority's certificate can check it later.
- Digital signature. A signature under the Information Technology Act, 2000 (Sections 3 and 3A cover digital and electronic signatures) ties a document to a signer; with a trusted signing time it also supports the date.
- Independent copy. Emailing a report or its hash to your auditor, lender or buyer leaves a dated record on their side that you cannot edit.
- Publishing a hash. Placing the latest hash of a ledger somewhere public or with a third party fixes every earlier entry it covers.

## What a hash chain adds

A hash-chained ledger stores, inside every entry, the hash of the entry before it. Editing any past entry breaks all the links after it, so the chain shows the order of entries and makes quiet edits visible. On its own it does not prove dates to an outsider, because the operator could rebuild the whole chain. Anchoring the newest hash with someone independent closes that gap.

## What to ask for when you rely on digital evidence

1. The original file and its SHA-256 value, so you can recompute it.
2. Evidence of time from outside the preparer: a timestamp token, a signed submission, or an email or filing that you or another party received.
3. For court use in India, the certificate for electronic records under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which replaced Section 65B of the Evidence Act.

## What Senseible does here

Senseible fingerprints each uploaded file with SHA-256, which also stops the same file being counted twice, and links its ledger entries in a hash chain, with further hardening of the chain under way. Together these show a file is unchanged and the order of entries; to prove a date to an outsider, pair them with an independent record such as a trusted timestamp or a report sent to your auditor.

- [How to verify a SHA-256 fingerprint](https://senseible.earth/answers/verify-sha-256-fingerprint-carbon-report)
- [Does a hash prove emissions are correct?](https://senseible.earth/answers/does-a-hash-prove-emissions-are-correct)
- [How auditors verify activity data](https://senseible.earth/answers/how-auditors-verify-activity-data)

Sources: [NIST FIPS 180-4, Secure Hash Standard (SHA-256)](https://csrc.nist.gov)

Last reviewed 2026-10-17.