Glossary

Hash: the byte-exact fingerprint of a file

A hash is a fixed-length value computed from every byte of a file by a one-way function such as SHA-256, so that any change to the file produces a different value and two files with the same hash are, for practical purposes, identical byte for byte.

Code-drawn illustration for Hash

Illustration · PNG file

  1. Signature + IHDR
  2. iTXt XML:com.adobe.xmprecord
  3. tEXt parameters
  4. tEXt prompt / workflow
  5. tEXt invokeai_metadata
  6. eXIf
  7. caBX C2PA manifest
  8. IDAT pixels
  9. IEND

AI source type declared

The file labels itself as AI-made.

IPTC DigitalSourceType such as trainedAlgorithmicMedia is read from XMP and shown with its exact value.

Check an image →
AI source type declared: where this record sits inside a PNG file and what the isGenAI report says about it. The picture is a code-drawn illustration.

What a hash proves

SHA-256, defined in NIST FIPS 180-4, produces a 64-hex-character digest. A matching digest proves that two files are the same bytes, metadata included; a single changed pixel or a stripped chunk changes the digest completely. A hash therefore says nothing about who made a file or whether AI was involved; it is the gold standard for identity, not origin.

C2PA uses hashes inside manifests to bind the signature to the content, and signed receipts use them to bind a report to a file.

How isGenAI uses hashes

Every check computes the SHA-256 of the upload and derives a content identifier from it. The checker reports an exact hash match when the same bytes were checked before and when a soft-binding record names that hash. The image SHA-256 checksum tool computes the digest in your browser without uploading, so you can compare a file you received with one the sender has.

Hash versus perceptual hash

A cryptographic hash changes on any edit; a perceptual hash is designed to stay similar across resizing and compression. isGenAI uses both: SHA-256 for identity and a difference hash for near-duplicate matching.

Hashes are also how isGenAI keeps checks reproducible: the content identifier in a report is derived from the SHA-256, so the same file always maps to the same case, and anyone holding the file can confirm which bytes were checked.

How to use this term when checking a file

  1. Upload the original file to the AI image detector or the tool named on the page.
  2. Find the finding that uses this term under “How we checked” and read the source field it names.
  3. Weigh it by kind: a signed record, a declared field, a saved prompt and a matching copy are different strengths of evidence.
  4. Remember that absence of a record is not evidence of a human author.

Compute a SHA-256 checksum

Frequently asked questions

What does a matching SHA-256 prove?

That two files are byte-for-byte identical, including metadata. It proves nothing about origin.

Does re-saving change the hash?

Yes. Any change to the bytes, including stripping metadata, produces a different digest.

How do I compute an image’s hash?

Use the image SHA-256 checksum tool in your browser; the file is not uploaded.

Why does isGenAI report an exact hash match?

Because the same bytes were seen before, or a soft-binding record names this hash. It links your file to that earlier record.

Sources

Definitions follow the published standards linked above; the isGenAI behaviour described is the deployed checker as of October 2026.