Verify Timestamp

About file integrity verification

The Verify Timestamp tool re-hashes a file with SHA-256 and compares the result against the hash recorded in a receipt produced by the companion Timestamp tool. If both fingerprints match to all 64 hexadecimal characters, you have mathematical proof the file is bit-for-bit identical to the version that existed when the receipt was generated. This is how Git detects modified blobs, how Linux package managers verify downloads, and how Bitcoin links blocks. None of the file or the receipt leaves your browser; verification runs through the Web Crypto API's crypto.subtle.digest entirely client-side.

Integrity verification is different from time anchoring. A matching hash proves the content is unchanged, but not when it was created. For court-admissible time stamps, use a Trusted Timestamping Authority following RFC 3161 (DigiCert, Sectigo, FreeTSA, or eIDAS-qualified providers in the EU). The receipt JSON used here captures your local UTC time at the moment of stamping; treat it as a self-signed note, not a notarised act.

How verification works step by step

1. Read file bytes  -> ArrayBuffer
2. Hash via Web Crypto subtle.digest('SHA-256', buffer)
3. Convert digest (Uint8Array) to 64-char hex string
4. Parse receipt JSON to read receipt.sha256
5. Compare: computedHash === receipt.sha256
6. Match -> file unchanged. Mismatch -> file modified.

Receipt schema:
{
  "filename":   "contract-v3.pdf",
  "sha256":     "9b74c98...64 hex chars",
  "size":       284172,
  "timestampUtc": "2026-05-28T14:32:11.452Z",
  "tool":       "3tej-timestamp",
  "version":    "1"
}

• SHA-256 output is always 64 hex characters (256 bits / 4 bits per character).
• Hash mismatch by one character means the file has changed. There is no partial match in cryptography.
• Web Crypto API is available in all modern browsers (Chrome, Firefox, Safari, Edge) on secure origins (HTTPS or localhost).

Worked example: verifying a signed PDF

You receive contract-v3.pdf and contract-v3-receipt.json from a counterparty. You want to confirm the file matches the version the receipt describes.

1. Upload the file. Browser reads bytes into an ArrayBuffer.
2. Tool computes SHA-256 via Web Crypto: 9b74c98...e2a1d.
3. Upload the receipt JSON. Tool parses the sha256 field.
4. Receipt expects: 9b74c98...e2a1d with timestamp 2026-05-28T14:32:11Z.
5. Match: green badge confirms the file is identical to the stamped version.

Hash algorithm comparison

Common pitfalls when verifying

• Re-encoded uploads. Email, WhatsApp, and Slack often recompress files (especially images). The re-encoded copy hashes differently even if visually identical.
• Wrong file uploaded. If you have multiple versions, double-check the filename and size against the receipt before concluding tampering.
• Receipt edits. If anyone modified the JSON receipt, the comparison is meaningless. Re-fetch the receipt from the original source.
• Trusting the timestamp value. The receipt records local clock time, not a notarised time. For legal use, employ RFC 3161 TSA countersigning.
• Trailing whitespace and BOM. Text files copy-pasted between editors can pick up byte-order marks or line-ending changes (CRLF vs LF) that break the hash invisibly.

Related calculators on 3Tej

Frequently asked questions