Someone sent you a document and a checksum

You are holding two files. One is the document, a PDF or an HTML file with a conversation in it. The other is much smaller, has the same name with .sha256 on the end, and looks like a single long line of letters and numbers. That line is the document's fingerprint, taken at the moment it was written.

Recompute the fingerprint yourself. If it matches, the document has not changed by a single character since that moment. You do not need our program to do it, and you should not have to: the check below uses software your computer already has.

On Windows

Open the folder with the document in it, right-click while holding Shift, and choose "Open in Terminal" (older versions of Windows say "Open PowerShell window here"). Then type this, putting your file's name between the quotes:

certutil -hashfile "conversation.pdf" SHA256

You will get a line of 64 characters. Open the .sha256 file in Notepad and compare the two. Upper case or lower case makes no difference; nothing else does either.

On a Mac

Open Terminal, type shasum -a 256 and a space, then drag the document into the window:

shasum -a 256 conversation.pdf

Reading the answer

• The two lines are identical. The document is byte for byte the file whose checksum was recorded. Nobody has edited a message, removed a page or changed a date since.
• They differ, anywhere at all. The file is not the one that checksum describes. A single altered character changes roughly half the fingerprint, so there is no such thing as a small difference here: it is a match or it is not.
• There is no .sha256 file. That is ordinary rather than suspicious. Ask the sender for the checksum in writing, by mail or in the message that carried the document, and compare against that. A value they gave you before you asked any questions is worth more than the file itself.

What a match proves, and what it does not

A match proves the document has not changed since its checksum was recorded. That is a real thing to know and it is the whole of what this proves.

It does not prove who wrote the messages inside it. This is a comparison of bytes, not an opinion about whether a conversation happened or whether the phone it came from belonged to the person named. If someone fabricated a conversation and then exported it, the export has a perfectly good checksum. Anyone who tells you a checksum settles authenticity is selling something.

What it does do is remove one question from the argument. Once the file cannot have changed since it left the sender's computer, the discussion moves to where the messages came from, which is the question worth having.

If you would rather not type a command

Your browser can do the arithmetic. Drop the document below: the fingerprint is computed on your own computer, by the browser itself, and the file is not sent anywhere. If it sits beside a .sha256 file, drop that in too and the comparison happens by itself.

ChatExport has a screen that does the same comparison for you. Install it, choose Check a document I was given on the first screen, and drop the document onto it. The .sha256 file is read automatically when it sits beside the document, and when it does not, there is a box for the checksum the sender gave you. Nothing is uploaded, no account is asked for, and the file never leaves your computer.

It is the same arithmetic as the commands above, with the same limit stated on the screen itself. If you are checking a document because you doubt it, prefer the commands: they come from your own operating system, and this one comes from the people who made the program that wrote the document. That is a real difference and it is why this page teaches the commands first.

Where these files come from

ChatExport writes the .sha256 file next to every export it produces, without being asked and without anywhere to switch it off. The document also carries an integrity page of its own, stating the device, the backup date and the export's own reference, so a reader who has only the document still knows what they are looking at.

If you need the other side of a case to produce an export like this, they can: the program runs on their own Windows PC, reads a backup that is already there, and asks for no account. That is usually a shorter conversation than asking somebody to hand over a phone.

Still unsure

Write to support@getchatexport.com with what you are seeing. A mismatch is worth understanding rather than guessing about, and it is sometimes something dull: a mail system that reflowed an attachment, or the wrong one of two similar files.