--- title: "How to tell if a document was changed after signing · Attest" description: "Fingerprints (hashes) explained simply: why one changed word shows, how Attest's verifier catches a change after signing, and what to do if a check fails." url: https://attest.datahubz.com/guides/document-changed-after-signing updated: 2026-10-12 --- [Attest](https://attest.datahubz.com/)/[Guides](https://attest.datahubz.com/guides) # How to tell if a document was changed after signing Compare the document's fingerprint, a code calculated from every byte of the file, with the fingerprint recorded when it was signed: if even one character changed, the two won't match. Attest's free verifier does this for you: it checks the original document inside a signed copy against what every signer signed, checks each signer's entries, confirms that the pages you see are exactly the pages it re-makes from what was signed and anchored on a public blockchain, and confirms that nothing was added to the PDF after it was sealed. By DataHubz · Updated October 12, 2026 · 6 min read ## What a document fingerprint is A **fingerprint**, or **hash**, is a short code calculated from the exact contents of a file. Three properties make it useful: - The same file always gives the same fingerprint. - A file that differs by even one character gives a completely different fingerprint. - You can't rebuild the file from its fingerprint, so a fingerprint can be made public without publishing the document. Attest uses **SHA-256**, a standard published by NIST (FIPS 180-4). A SHA-256 fingerprint is 64 characters long. Here are the fingerprints of two sentences that differ by a single digit: ``` The deposit is $1,000. 2edc7efa1129f4f2952e13afbf7561b8c3854013d8a4677105fbeb2dd43541fb The deposit is $7,000. aa47a92a7056d3e684268c2f61558fa6bebd5a8496c8e9784c47fc6ac72db76b ``` Nothing about the second code hints that the change was small. That is the point: in practice, no one can change a document and keep its SHA-256 fingerprint. US federal evidence rules rely on the same idea. The 2017 committee note to Federal Rule of Evidence 902(14) says that "data copied from electronic devices, storage media, and electronic files are ordinarily authenticated by 'hash value'", and that "If the hash values for the original and copy are different, then the copy is not identical to the original." ## Why changing one word changes the fingerprint A fingerprint is computed from the file's bytes, not from how the page looks. So it changes when anyone edits a word, a number, a date or a name, and also when a file is re-saved, printed to PDF, scanned or converted, even if every word looks the same. A fingerprint doesn't stop anyone from editing a file. It makes the edit visible: the changed file no longer matches the fingerprint recorded at signing. ## How most signed PDFs reveal changes The statements in this section are as published on October 11, 2026. Many e-signature services seal the finished PDF with a certificate-based signature that a PDF reader checks. Documenso's documentation describes the result: "If anyone modifies the PDF after signing, the signature becomes invalid. PDF readers will display a warning that the document has been changed." Adobe Acrobat users report that warning as "The document has been altered or corrupted since the Signature was applied." Some services keep the fingerprints on their side. Dropbox Sign's legal page says: "If you ever need to prove there was no tampering… Dropbox Sign can provide you with the two unique document records." ## How Attest detects a change Attest records fingerprints at each step and anchors them on Horizen, a public blockchain anyone can read: 1. **When each signer signs,** their passkey signs a statement that names the document's SHA-256 fingerprint and the fingerprint of the entries they made on it (their signature, initials, dates, name and text). 2. **When the last signer signs,** a fingerprint of the signed state (the document's fingerprint and, for each signer, who signed, when, and the fingerprint of their entries) is signed with Attest's platform key and anchored on Horizen. Attest's anchor of the agreement also covers the completion details the signed copy prints: the verification code, the completion time, where each entry sits and the steps up to completion. 3. **When the sealed signed copy is made,** the fingerprint of its visible pages is anchored in its own transaction. The evidence is appended after the pages as an incremental update, so the pages' bytes stay exactly as they were. Only fingerprints go on the blockchain. No document content, title or email is written there. Attest's verifier then compares what you hold with what was signed and anchored: | If someone changed | The verifier compares | Result | | ----------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | | A word in the document | The original's SHA-256 with the fingerprint every signer's statement names | Fails | | A signer's entries (a date, a name, a text field) | The entries' SHA-256 with the fingerprint in that signer's statement | Fails | | The visible pages of the signed copy | The pages, byte for byte, with the pages it re-makes from what was signed, and their SHA-256 with the fingerprint anchored on Horizen for the copy | Fails | | Content added to the PDF after it was sealed (a new layer over a page, a script, an annotation) | The file's structure: after the signed pages there must be exactly Attest's own update, attaching the evidence, the original and the verifier | Fails | | Who signed, or when | The signed state with Attest's anchored record of the agreement on Horizen | Fails | In short: change one byte of the document, of any signer's entries or of the signed pages, and verification fails. The parties also see this protection while they work: when a party opens the document in Attest, their browser checks the decrypted file against the fingerprint recorded for the agreement. ## Step by step: check whether your copy changed 1. **Open the verifier.** Save the one attached to the signed PDF (attest-verifier.html), download it from [the verify page](https://attest.datahubz.com/verify), or open the current version at [attest.datahubz.com/attest-verifier.html](https://attest.datahubz.com/attest-verifier.html). It runs in any browser. 2. **Drop the signed PDF on it.** On your device, reading only a public blockchain node, it checks the original document inside against what every signer signed, each signer's passkey signature and entries, Attest's anchored record of the agreement on Horizen, and that nothing was added to the PDF after it was sealed. It also re-makes every page you see from what was signed and compares the result with the copy byte for byte, so pages drawn with anything else fail. It pins its trust root (the chain, Attest's registry and the keys it checks against are built into the verifier, never read from the file being checked) and accepts only anchors from Attest's registered wallets. 3. **Or check online.** Drop the file on [attest.datahubz.com/verify](https://attest.datahubz.com/verify). It is fingerprinted in your browser and never uploaded. A sealed signed copy is found by its fingerprint, and so is the original document of an agreement whose certificate is public. A changed file won't match. 4. **For a printed copy,** compare it with the signed copy. The stamp's code and QR code lead to the agreement's record, but a printed page can't prove its own words. ## What to do if verification fails 1. **Make sure you have the file as downloaded.** A copy downloaded while anchoring was still in progress is marked preliminary: download the signed copy again once it is sealed. A copy that was re-saved, printed to PDF, scanned or converted is a different file, even if it looks identical. 2. **Get a fresh copy.** Every party downloads the same sealed PDF. A signer's link opens it for 30 days after completion, and signing in with their email opens it after that. 3. **Check the original separately.** The signed copy carries the original document as an attachment (original-document.pdf). Its SHA-256, from any SHA-256 tool, must equal the document fingerprint shown on the certificate of completion. On a Mac, run `shasum -a 256` followed by the file name in Terminal; on Windows, run `certutil -hashfile` followed by the file name and SHA256 in Command Prompt. 4. **If it still fails, don't rely on that file.** It is not the document that was signed. Ask the other party for their copy and compare. Because every party holds the same sealed copy, a genuine copy will verify. For the full picture of what a check proves (who signed, what and when), see [how to verify that a signed document is genuine](https://attest.datahubz.com/guides/verify-signed-document). ## Questions people ask What changes does Attest's verifier catch? A change to the document, to any signer's entries or to the signed pages: change one byte and verification fails, because each is checked by SHA-256 against what was signed and anchored on a public blockchain. A signed copy with anything added to the PDF after it was sealed fails too. To confirm that the whole file is exactly the one recorded, drop it on attest.datahubz.com/verify, which matches it by its fingerprint. Could Attest itself alter a signed document or the list of who signed? Not without verification failing. The document's fingerprint is in every signer's passkey-signed statement, and the signed state, with each signer, their signing time and their entries fingerprint, is anchored on Horizen. A changed document or a changed record of who signed no longer matches. Does a fingerprint reveal what my document says? No. A fingerprint can't be turned back into the document. That is why Attest puts only fingerprints on the blockchain, never document content, titles or emails. Why does my copy fail when the text looks the same? A fingerprint is computed from the file's bytes, not its appearance. Re-saving, printing to PDF, scanning or converting a file creates a different file. Download the signed copy again and check that file. Does the QR code on a signature stamp prove a printed page wasn't changed? No. The QR code and the stamp's code open the agreement's record, which shows who signed and when. To check a paper, compare it with the signed copy; to check a file, drop it on the verifier. ## Sources 1. [Federal Rules of Evidence, Rule 902 and 2017 committee notes](https://www.law.cornell.edu/rules/fre/rule%5F902), Legal Information Institute, Cornell Law School, read October 11, 2026 2. [Signing certificates](https://docs.documenso.com/docs/concepts/signing-certificates), Documenso, read October 11, 2026 3. [The document has been altered or corrupted since the signature was applied](https://community.adobe.com/t5/acrobat-discussions/the-document-has-been-altered-or-corrupted-since-the-signature-was-applied/m-p/9353946), Adobe Community, read October 11, 2026 4. [Dropbox Sign legal](https://www.dropboxsign.com/about/legal), Dropbox, read October 11, 2026 ## Read next - [Verify](https://attest.datahubz.com/verify) Check a signed document, receipt, certificate or proof for free, with no account. Drop the file, or enter its ID or fingerprint: it is checked in your browser. - [How to verify that a signed document is genuine](https://attest.datahubz.com/guides/verify-signed-document) Check who signed, that nothing changed and when. How e-signature services verify documents, and how to check an Attest document free, even without Attest. - [How to prove someone signed a document electronically](https://attest.datahubz.com/guides/prove-someone-signed-electronically) The evidence that proves an electronic signature: intent, identity, integrity and timing. How most services record it, and how Attest makes it checkable. --- Source: https://attest.datahubz.com/guides/document-changed-after-signing