A records manager at a design studio reads a headline on a Monday morning. It says an old way of fingerprinting files has been broken. She has spent a year sealing the studio's design files, and each seal uses a method called SHA-256. She wants to know one thing. Is the method behind her sealed files still safe to trust in 2026? The short answer is yes, and here is why.
What a hash is, in plain words
A hash is a short fingerprint that a computer makes from a file.
When you seal a file, the system does not copy the file. It runs the file through a math function and gets a short string of letters and numbers. That string is the hash, and people also call it a fingerprint. Change one comma in the file, and the fingerprint changes completely. Two different files should not share the same fingerprint. SHA-256 is one such function. The 256 means the fingerprint is 256 bits long, so the space of possible values is very large, which makes an accidental match extremely rare. You cannot work backwards from a fingerprint to rebuild the file. So a fingerprint is safe to share, even when the file is private.
Why SHA-256 is a standard, not a guess
SHA-256 is written into an official public standard that many systems follow.
SHA-256 is defined in NIST FIPS 180-4, published by the United States National Institute of Standards and Technology (NIST) in August 2015. A standard means the method is written down in full, open for anyone to read, and used the same way everywhere. Because the rules are public, researchers test the method in the open. That open testing is a strength, not a weakness. Systems that most people rely on every day already use it:
- secure websites, when your browser shows a padlock
- software updates that check a download was not changed
- many banking and payment systems
Why SHA-256 and not something newer
Newer methods exist, but SHA-256 is chosen because it is proven and supported almost everywhere.
Newer hash methods exist, such as the SHA-3 family. They are good too. We use SHA-256 for a practical reason. It is supported almost everywhere, by almost every tool that opens or checks a file. A proof is only useful if other people can check it years later, on their own computer, with common software. A method that is widely supported makes that easy. SHA-256 has that reach today, and it is still recommended, so it fits a proof that must last.
Old warnings were about SHA-1, not SHA-256
NIST retired the older SHA-1 method but still recommends the SHA-2 family, which includes SHA-256.
You may have read that a hash method was broken. That news was almost always about SHA-1, an older method. On 15 December 2022, NIST said it would retire SHA-1 and told people to move to the SHA-2 and SHA-3 families, as its retirement notice explains. SHA-256 is part of the SHA-2 family. So the same reviews that retired SHA-1 are the ones that keep SHA-256 in use. Using SHA-256 today follows that advice, it does not ignore it.
What the planned revision means
NIST plans to update the standard, which is routine upkeep and not a sign the method failed.
The NIST page for FIPS 180-4 carries a note, dated 7 March 2023, about a planned revision. A revision is normal. Standards get tidied, clarified, and kept current over time. A planned update does not mean SHA-256 stopped working. It means the people who own the standard are doing their job. We follow the standard as it changes.
What a fingerprint proves, and what it does not
A seal shows a file existed in one exact form at one time, not who created it.
Here is an honest word on limits. A SHA-256 fingerprint shows that a specific file existed, unchanged, at the moment it was sealed. If anyone edits the file later, the fingerprint will not match, and the change shows. That is strong evidence in a dispute. But a seal has limits you should keep in mind:
- it does not show who wrote the work, only who sealed it and when
- it cannot prove the file was correct or truthful before it was sealed
- it protects a file, not an idea in your head
How a seal uses SHA-256
Only the fingerprint, not your file, is sent to the timestamp service.
When you seal a document, the system makes its SHA-256 fingerprint. Only that fingerprint is sent to a trusted timestamp authority, under a public rule called RFC 3161. The authority signs the fingerprint with the date and time, and you get a certificate and a public link that anyone can check without an account. Our FAQ names SHA-256 as the method used when a file is sealed.
So, is it still a sound choice?
Yes, SHA-256 remains a NIST-approved, widely trusted method for document proof in 2026.
The method behind your sealed files is sound. SHA-256 is a NIST-approved method, it is widely trusted, and NIST still recommends the SHA-2 family that it belongs to. The records manager can keep sealing with confidence. If you have a file that matters, seal it before you share it, and keep the dated proof. Start at swisstrustlayer.com.
