Skip to content
Skip to content

It proves that a file or a notice is exactly the one that was recorded, and it proves nothing about who made it or whether it is true.

A SHA-256 fingerprint is a 64-character code worked out from the contents of a file. The same file always gives the same code. A change to a single byte gives a different code. Finding a different file that gives the same code is not practical. The code does not contain the file, so it reveals nothing about what the file says.

You meet fingerprints in four places:

  • On each document's details, where it is the fingerprint of the file as it arrived.
  • On your client's receipt, where it is the fingerprint of the notice they agreed to.
  • In the manifest of an export, which lists every file with its fingerprint.
  • In the proof chain, where each entry has a fingerprint of its own.

A match shows these things:

  • ✓The file in your hands is the file that arrived, unchanged.
  • ✓The notice on your client's receipt is the notice you hold.
  • ✓The fingerprint was written into the chain when the file arrived, so the chain shows the date.

It does not show these things:

  • ✗Who made or signed the file.
  • ✗Whether what the file says is true.
  • ✗That an edited copy is the original. A copy that was opened and saved again can give a different code, because saving can change the file.

A document your client fetched through DigiLocker has its source and issuer recorded beside its fingerprint.