Verify a document
Were you sent an invoice, a certificate or a contract produced with Crixaa? Check here whether it is exactly as it was issued.
Drop a PDF here, or choose one
The file stays on your device. Only its checksum is sent.
Your document is not uploaded
The checksum is computed by your own browser. What reaches us is 64 characters of hexadecimal — a fingerprint that cannot be turned back into the document. We never receive the file, its contents or its name, which matters because the documents most worth checking are the ones you would least want to hand to a stranger.
What a match proves
That the file you hold is byte-for-byte the one Crixaa produced, and the date it was produced. Changing anything at all — an amount, a name, a date, a page — changes the fingerprint, including edits that look identical on screen.
It does not vouch for whether the contents were correct when issued, and it is not a statement about the sender. It answers one question precisely: has this file changed since we made it.
Why a document might not match
A failed check is not automatically evidence of tampering. Opening a PDF and saving it again in another application rewrites the file, as do some mail gateways and document scanners. The result is a different fingerprint from an innocent cause.
If you expected a match and did not get one, ask the sender for the file exactly as Crixaa produced it, and check that. If that does not match either, take it seriously.
Checking it yourself
You do not have to trust this page. The fingerprint is a standard SHA-256, so you can compute it with tools you already have and compare the value shown above:
shasum -a 256 document.pdf # macOS / Linux
certutil -hashfile document.pdf SHA256 # WindowsIf you generate documents through the API, the same digest is returned on every generate call and included in the document.generated webhook, so you can record it yourself at the moment of issue and compare later without involving us at all.