How to verify a document with a checksum and OpenTimestamps
A published document can be changed after the fact, and a date can be claimed. Two checks make both impossible to fake — and neither needs you to trust the publisher.
Check one: the checksum
A checksum is a fingerprint of a file: a fixed-length number computed from every byte. Change one byte and the fingerprint changes completely. SHA-256 is the algorithm in common use; its fingerprints are 64 hexadecimal characters.
When a publisher lists a checksum beside a file, you can compute the fingerprint of the copy you downloaded and compare. If the two match, your copy is byte for byte the one released. If they differ, something changed on the way — the file, or the listing.
On macOS: open Terminal and run shasum -a 256 followed by the file name. On Linux: sha256sum and the file name. On Windows, in PowerShell: Get-FileHash, the file name, and -Algorithm SHA256. Each prints the fingerprint; compare it with the published one character by character, or paste both into a text editor and use search.
One caution: do not open and re-save the document before checking. A word processor rewrites the file when it saves, even with no visible change, and the fingerprint will no longer match. Check first, then read.
Check two: the timestamp
A checksum proves what a file is. It does not prove when it existed. For that, OpenTimestamps: a free, open standard that anchors a fingerprint in the Bitcoin blockchain, whose blocks carry dates that nobody can edit afterwards.
A timestamp proof is a small file with the extension .ots, published beside the document. It does not contain the document; it contains a path from the document’s fingerprint to a Bitcoin block. Verifying it establishes that a file with this exact fingerprint existed no later than that block’s date. It does not establish who made the file — only that it existed then.
To verify: install the OpenTimestamps client (pip install opentimestamps-client, on any system with Python), place the document and its .ots file in one folder, and run ots verify followed by the .ots file name. The client reads the proof, checks the fingerprint against the document, and reports the block and the date. A freshly stamped proof may say “pending” for a day or so, until the Bitcoin block is mined; the publisher then upgrades the proof, and the verification becomes final.
What the two checks do not do
They do not tell you whether the document is true, sensible or complete. They tell you that this file is the one released and that it existed on that date. Everything else is reading.
They do not need the publisher to be honest. The fingerprint is arithmetic; the block is on a public chain. A publisher can lie about the contents of a document but cannot make a changed file match an old fingerprint, or make a new file appear in an old block.
Why we publish both
Every document on this site has a checksum and a timestamp proof beside it. The reason is the one above: readers should not have to take our word that a version is the version, or that a date is the date. If a document changes, it gets a new checksum, a new proof, and a new row in the table; old rows stay.