PhotoSanitize calculates SHA-256 fingerprints to identify the contents of original and sanitized image files.
SHA-256 is a cryptographic hash algorithm that produces a fixed-length value from a file’s bytes. The value is normally displayed as a 64-character hexadecimal string.
A file fingerprint is useful because it provides a practical way to distinguish exact file versions without depending solely on filenames or visual appearance.
What a SHA-256 value represents
A SHA-256 fingerprint reflects the complete contents of a file. If those contents change, the calculated fingerprint will almost certainly change as well.
For example, suppose a JPEG photograph contains EXIF metadata and you use PhotoSanitize to remove it. The resulting picture may look identical to the original, but the file’s bytes have changed. Its SHA-256 fingerprint will therefore normally be different.
The same applies when an image is recompressed, reconstructed, or visually redacted.
File fingerprints concern byte-level identity, not whether two pictures look the same.
Input and output fingerprints
PhotoSanitize records fingerprints for the input and sanitized output when available. You can inspect them in the Verification tab and in applicable processing reports.
The input fingerprint identifies the original version that was processed. The output fingerprint identifies the file created through sanitization.
These values help establish which files belong to a particular operation, especially when several versions share similar filenames.
For example, a photographer may produce different sanitized outputs using Metadata Only and Rebuild. Even if the pictures look nearly identical, their fingerprints can distinguish the exact files.
Checking integrity after transfer
A SHA-256 fingerprint can also help determine whether an output changed after it was created.
An organization might record the fingerprint of a sanitized photograph before transferring it to another department. The receiving department can calculate the hash of its copy and compare it with the recorded value.
If the fingerprints match, the files have the same contents to the practical assurance provided by SHA-256. If they differ, the file contents are not identical.
This can reveal accidental editing, replacement, corruption, or distribution of the wrong version.
What fingerprints do not prove
A fingerprint does not establish that the image has been sanitized correctly. A photograph containing GPS coordinates can have a perfectly valid SHA-256 fingerprint, just as a sanitized image can.
A fingerprint also does not establish the truthfulness of the scene or the identity of the person who captured the photograph.
The hash is an integrity and identification tool. Verification, provenance inspection, and visual review address different questions.
Retaining fingerprints with files
If you need to preserve a record of sanitized images, retain their filenames, output paths, relevant processing results, and SHA-256 values together.
Avoid editing a sanitized file after its fingerprint has been recorded unless you intend to create a new version and corresponding record. Even a small metadata change can alter the fingerprint.
For organizational evidence retention, fingerprints are most useful when the associated files and reports are stored securely and can be retrieved together.