Verify
Apply for certificate
XENLOOK C2PAVerify

Pilot · C2PA review in progress · Korea Mar 2027 · Japan Jun 2027 · Korean model law

Copyright C-2026-036487 · Patent app. 10-2026-0100026 (not yet registered)

Legal & policies →
Course contents
Chapter 2 of 10

Chapter 2File fingerprints (hashes) and practice certificates

Every file has a fingerprint-like value. In this chapter you make that value (the hash) yourself, and you get your first practice (SAMPLE) certificate.

  • Official session name · Building the practice environment and a demonstration
  • 6 practice steps
  • You can follow along without signing in
What you will learn in this chapter
  • You know what a hash is and what it is used for.
  • You know which changes alter a hash and which do not.
  • You can make a SAMPLE certificate on the practice page.

The idea in plain words

It works like a human fingerprint
Every person has a different fingerprint, so a fingerprint can tell you who someone is. A file works the same way. If the content is the same, the fingerprint (hash) is the same. If the content differs even a tiny bit, you get a completely different fingerprint. And just as a fingerprint cannot draw someone's face, a hash cannot bring the file back.

A hash is a short value you get by calculating over a file's content. This site uses a method called SHA-256. The result is 64 characters, made of 0–9 and a–f.

The same file gives the same hash whenever and wherever you calculate it. So you can quickly ask, “Is this file exactly the same as that one?”

Change just one character (one byte) inside a file, and the hash changes completely. It does not become similar. It becomes a totally different value.

Renaming a file does not change its content, so the hash stays the same. But a screenshot or a re-save writes the content out again, so the hash changes.

You cannot get the original file back from a hash. That is why you can share a hash openly without showing the file's content.

The serial number of a SAMPLE certificate from the practice page looks like this: XPC-DEMO-, then a date, then eight characters. Those last eight characters are the first eight characters of the hash, in capital letters.

See the picture

  1. Add a photopractice page
  2. Calculate the hashSHA-256 · 64 characters
  3. Five processing stepspractice demo
  4. SAMPLE certificatea serial number is issued
The practice page calculates your photo's hash, runs five steps, then shows a practice certificate.

Try it yourself

Work from the top, one step at a time. After each step, check that your screen matches “What you should see.”
  1. Pick one photo that has no personal information in it. A landscape or an object works well. Avoid faces, home addresses and car number plates.
    What you should see A photo file for the practice is ready on your computer or phone.
    No sign-in
  2. On the practice page, select “파일 선택” (choose file) and add your photo. If you have no photo, you can select “세리아 샘플로 시연” (demo with the Seria sample) instead.
    What you should see The steps turn to “완료” (done) one by one, and a “데모 샘플 인증서” (demo sample certificate) card appears.
    Open the practice pageNo sign-inPartly in Korean
  3. Copy the Serial and the SHA-256 (hash) shown on the card into your practice log. The card shows only the first 20 and last 8 characters of the hash.
    What you should see The last eight characters of the serial match the first eight characters of the hash, in capital letters.
    No sign-in
  4. Change only the file name of the same photo and add it again. For example, rename “landscape.jpg” to “landscape-copy.jpg.”
    What you should see The hash is exactly the same as the first time. A name is not part of the file's content.
    No sign-in
  5. Take a screenshot of the photo, or re-save it from a photo app, and add that file.
    What you should see The hash is completely different, and the last eight characters of the serial change too.
    No sign-in
  6. (Optional) Work out the hash yourself on your own computer. On Windows, type certutil -hashfile photo.jpg SHA256 in Command Prompt. On a Mac, type shasum -a 256 photo.jpg in Terminal.
    What you should see A 64-character value appears, and its first 20 characters match what the practice page showed.
    No sign-in
The part you do with your mentor · A SAMPLE certificate is for practice, so it is not added to the official issuance record (the issuance registry). That is why looking up this serial in chapter 8 finds nothing. Your mentor confirms that this is normal.

Check your work

If you can answer “yes” to everything below, you have finished this chapter.
  • Can you explain a hash as “a file's fingerprint”?
  • Have you seen for yourself that renaming does not change the hash but re-saving does?
  • Have you written the SAMPLE certificate's serial and hash in your practice log?

Easy to mix up

  • Common misunderstandingIf you rename a file, it becomes a different file.
    What is actually trueA name is not the file's content. If the content is the same, the hash is the same.
  • Common misunderstandingIf two files look identical, their hashes are the same.
    What is actually trueA re-save or a screenshot looks the same to your eyes, but the content is written out again, so the hash changes.
  • Common misunderstandingIf you know the hash, you can rebuild the original photo.
    What is actually trueA hash only works one way. You cannot rebuild the photo from it.

Review questions

  1. Question 1How many characters is a SHA-256 hash?Show answerHide answer
    64 characters. It is made only of 0–9 and a–f.
  2. Question 2What happens to the hash when you rename a photo, and what happens when you take a screenshot of it?Show answerHide answer
    When you rename it, the hash stays the same. A screenshot creates new content, so the hash becomes completely different.
  3. Question 3What are the last eight characters of a SAMPLE certificate's serial equal to?Show answerHide answer
    They equal the first eight characters of that file's hash, written in capital letters.

Key terms

Hash
A short value calculated from a file's content. It is the file's fingerprint.
SHA-256
One method for making a hash. The result is 64 characters.
Byte
One of the smallest units a file is made of. Think of it as roughly one character.
SAMPLE certificate
The practice certificate the practice page shows. It is not added to the real issuance record.
Serial number
A unique number attached to each certificate. You use it to look the certificate up.

Practice log

Print it and write by hand, or copy the same items into a document. Once your mentor has checked it, you are done.
Chapter 2 practice logFile fingerprints (hashes) and practice certificates
Practice date
Written by
Mentor check
  1. The photo you used (file name, and what it shows)
  2. The SAMPLE certificate serial number
  3. The first hash (first 20 characters)
  4. The hash after renaming (same / different)
  5. The hash after re-saving or a screenshot (same / different)
  6. In your own words: when the hash changes and when it does not