Tamper-evident seal
Last updated
Definition
A tamper-evident seal on a signed document is a cryptographic mechanism, usually a hash or digital signature, that doesn't prevent changes but makes any post-signing modification mathematically detectable.
Tamper-proof is a myth; tamper-evident is engineering. No file format can stop someone from editing bytes, so the realistic goal is different: make it so that any edit, however small, is provable after the fact. That's what a tamper-evident seal does for a signed record.
How it works
The document's contents are run through a cryptographic hash function like SHA-256, producing a fixed-length fingerprint where changing a single character produces a completely different fingerprint. Record that hash at signing time, ideally inside the document and signed by a certificate, and verification becomes arithmetic: re-hash the document, compare fingerprints, and a mismatch is proof of modification.
Two layers in practice
Strong systems seal twice. First, the submission payload, covering every answer the signer gave plus the signature data, is hashed at signing time, and that SHA-256 lives in the audit trail. Second, the finished PDF is sealed with a PAdES digital signature, so the file itself reports 'modified' in any PDF reader if touched. The first layer protects the data record, the second the human-readable artifact.
Why it decides disputes
When a signer claims 'the document changed after I signed', the question becomes evidence. With a sealed record you re-compute one hash and the dispute is over. Without one, you're arguing testimony against testimony. Sign Sail applies both layers, with the payload hash plus a frozen form-schema snapshot and the PAdES file seal, on every plan.
↗ · Common questions
What's the difference between tamper-proof and tamper-evident?
Tamper-proof claims changes are impossible, which no document technology can honestly promise. Tamper-evident guarantees changes are detectable, which cryptography genuinely delivers. Treat any vendor saying 'tamper-proof' as marketing shorthand for tamper-evident at best.
Can a SHA-256 hash be faked to hide an edit?
Finding a different document that produces the same SHA-256 hash (a collision against a chosen value) is computationally infeasible with current technology. That infeasibility is exactly why recording the hash at signing time is considered strong integrity evidence.
↗ · Related
↗ · More terms
See it in a real signature.
Every Sign Sail plan, the free one included, captures this evidence on every signature.