What a Certificate Hash Proves
How a cryptographic fingerprint detects tampering, and the narrow thing it actually proves.
What is a certificate hash?
A certificate hash is a fixed-length fingerprint computed from a certificate's immutable fields and the document bytes at the moment of issue. Changing anything, a single digit of a purity result or one byte of the PDF, produces a completely different hash. Comparing the hash displayed by the issuing laboratory against the document you hold detects tampering.
The property that makes this work is that the function is one-way and collision-resistant: it is computationally infeasible to construct a different document producing the same fingerprint.
What it does not prove
A hash proves integrity, not correctness. It demonstrates that a document has not changed since issue. It says nothing about whether the measurement behind it was competent, whether the sample was representative, or whether the laboratory was honest.
It also does not prove the document is the current one. A certificate can be validly hashed and subsequently revoked, which is why verification checks status alongside integrity rather than treating a matching hash as sufficient.
Frequently asked questions
- Can two different documents have the same hash?
- Not in any practical sense with a modern hash function. Collisions are theoretically possible because the output is fixed-length while the input is not, but for functions such as SHA-256 no practical method exists to construct two meaningful documents sharing a fingerprint. The security assumption is computational infeasibility rather than mathematical impossibility, and that assumption holds comfortably for document integrity.
About the author
REPLACE: Quality Manager
Quality Manager · Quality systems, ISO/IEC 17025
Placeholder profile for the reviewer who signs off certificates and owns the quality system. Replace with the real person before launch.
Have a sample that needs characterising?
Build a submission online and see an itemised estimate as you select assays. Every result is reported exactly as measured.
Related reading
Certificate Verification
How Certificate of Analysis Verification Works
How QR and certificate-number verification let you detect an altered report, and why a public directory of certificates would be a confidentiality failure.
Certificate Verification
How to Spot a Fake Certificate of Analysis
Seven checks that expose a fabricated or altered certificate, most of which take under a minute.