Imagine you signed an electronic contract providing for a monthly payment of ten thousand pounds, and months later the other party produces a copy stating fifteen thousand, claiming it is the version you signed. How do you prove the text has changed? With a paper contract, you might turn to a handwriting expert to examine the ink and paper, and it could drag on for months without resolution. With an electronic contract, the answer is far faster and more precise: the document hash, a unique digital value computed from the file's content at the moment of signing, which changes completely if a single letter or number in it changes.
In this article we explain what a document hash is, how the hash function that produces it works, how it protects a contract's integrity and exposes tampering, how you can verify it yourself without being a technical expert, and what its limits are and what complements it. For each point we cover why it matters, how to apply it, the common mistake, and a practical example, followed by a checklist and frequently asked questions.
First: What Is a Document Hash?
Why it matters: Egyptian Law No. 15 of 2004 ties the evidentiary weight of an electronic signature to conditions that include being able to detect any alteration or substitution in the data of the electronic document. The document hash is the tool that meets this condition most clearly.
What exactly it is: A hash is a long number, usually written as sixty-four letters and digits, computed from the file's content by a mathematical method called a hash function. It has three properties that make it ideal for proving integrity:
| Property | What it means | Effect on contracts |
|---|---|---|
| Consistency | The same file always gives the same hash | It can be recomputed at any time and compared |
| Sensitivity | Any change, even one character, changes the hash completely | A contract cannot be altered without being exposed |
| Irreversibility | The file's content cannot be extracted from the hash | The hash can be published without revealing the contract |
Common mistake: Confusing the hash with encryption. A hash does not hide the content or protect it from being read; it proves that it has not changed. The contract itself remains readable as it is.
Example: If a hash were computed for a contract containing the phrase "ten thousand pounds," and the phrase were then changed to "fifteen thousand pounds," a completely different hash would appear, sharing no observable pattern with the first.
Second: How Does a Hash Function Work, Simply?
Why it matters: You do not need to understand the mathematics, but understanding the idea lets you trust the result and know how to use it.
A simple analogy: Imagine a machine that takes any file, small or large, grinds it up and outputs a number of fixed length. The same file always comes out with the same number, and any change, however slight, produces a completely different number. And the number cannot be turned back into the file, just as juice cannot be turned back into fruit.
- The file is fed into a hash function, the best known in modern applications being SHA-256.
- The function outputs the hash.
- The hash is stored in the contract's record at the moment of signing.
- When needed, the hash of the file in your hands is recomputed.
- If the two hashes match, the file has not changed by a single character.
Common mistake: Assuming that two "similar" files should give similar hashes. A hash never reflects similarity: it is either a complete match or a complete difference.
Third: How Does a Hash Protect the Contract from Tampering?
Why it matters: The most dangerous forms of tampering with contracts are not outright forgery but small edits: a digit in an amount, a day in a deadline, or the word "not" in a clause. These changes are hard to spot by eye, but a hash exposes them immediately.
| Type of tampering | Does the hash expose it? |
|---|---|
| Changing a digit in an amount | Yes |
| Adding or deleting a clause | Yes |
| Replacing a page in a long contract | Yes |
| Changing a space or punctuation mark | Yes |
| Pasting the signature onto another contract | Yes, because the other contract has a different hash |
How to apply it: Make sure the hash is computed at the moment of signing, stored where no party can modify it, and fixed with a timestamp from an independent authority. In Wthaiq, each contract's hash is computed and stored in the evidence report with the timestamp, and shown on the public verification page so that any party can match it.
Common mistake: Computing the hash and storing it in a file that one of the parties can modify, which robs it of its value because the stored hash itself could be replaced.
Example: A contractor submitted a copy of a contract stating a longer execution period than the one agreed. The owner opened the verification page and uploaded the submitted copy, and its hash did not match the recorded one. He then uploaded his own copy, and it matched. Which copy was the original was established in minutes.
Fourth: How Do You Verify a Hash Yourself?
Why it matters: The value of a hash is that it can be verified independently, so you do not have to trust any party. Anyone can compute it with available tools.
- Through the verification page of the signing platform: You enter the contract number or scan its code, then upload the file you hold, and its hash is computed and compared with the recorded one.
- Through system tools: Modern operating systems have ready-made commands to compute the SHA-256 hash of any file.
- Through PDF readers: If the file carries an embedded digital signature, the software shows whether the file has changed since signing.
Common mistake: Opening the file and saving it again, then computing its hash. Some programs alter internal data on saving, so the hash changes even though the visible text is the same. The right approach is to compute the hash of the original file as you received it, without re-saving.
Example: An accountant received a contract, opened it in an editing program and saved it by mistake, then found that the hash did not match. He went back to the original file in his email and it matched, and he realized that saving was what had changed it.
Fifth: The Hash Is Part of a System, Not Stand-Alone Evidence
Why it matters: A hash proves that the file has not changed since it was computed, but it does not prove when it was computed or who signed. That is why it needs elements that complement it.
| Question | The element that answers it |
|---|---|
| Did the contract change? | The document hash |
| When did the contract have this content? | The trusted timestamp on the hash |
| Who signed? | The verification code, identity verification and the digital certificate |
| How did the signing take place? | The audit trail |
Common mistake: Relying on the hash alone in a dispute over the signatory's identity. The hash says the file is intact; it does not say who signed it.
Sixth: The Text Hash and the File Hash
Why it matters: In contracts written inside a platform and then issued as a PDF, there may be two hashes: one for the frozen text that the parties signed, and one for the final file. Knowing the difference prevents confusion during verification.
How to understand it: The text hash proves that the words the parties agreed to have not changed, and the file hash proves that the file in your hands is the same one that was issued. Both are useful; what matters is knowing which one you are matching.
Common mistake: Converting the file into another format, such as an image or a compressed file, then matching its hash against the original, and naturally it does not match. A conversion is a new file with a new hash.
Example: A legal adviser printed a contract and scanned it again, then tried to match its hash and it did not match. The right approach is to match the original electronic version; the scanned copy does not carry the same hash no matter how closely it matches in appearance.
Seventh: The Hash and Contract Confidentiality
Why it matters: Many companies fear that verification pages will reveal the content of their contracts. The hash solves this dilemma, because it allows verification without revealing the content.
How it works: The text of a contract cannot be extracted from its hash. Even if the hash is published on a public page, no one knows the contract's content except whoever holds the file itself. When someone uploads a file to match it, only its hash is computed, so they learn whether it matches or not.
Example: A bank receives from its customers contracts signed with other parties, and checks their integrity through the verification page without the platform needing to show it any data beyond what it already has.
Eighth: How to Build on the Hash in Your Procedures
- Make matching the hash a mandatory step before releasing any large payment based on an electronic contract.
- Keep the original copy of every contract without re-saving or converting it.
- Keep the evidence report that carries the hash and the timestamp with the contract.
- Train your finance and legal teams to use the verification page.
- State in the contract that the recorded hash is the parties' reference in case of any difference between copies.
The parties agree that the document hash recorded in the signing evidence record at the moment of its completion is the reference for identifying the original version of this contract, and no copy whose hash does not match the recorded hash shall be relied upon.
Ninth: Addenda and Amendments After Signing
Why it matters: Contracts change in real life: extending a term, adjusting a price, adding a service. But the signed contract itself must not be edited, because any edit breaks its hash and makes it a non-original copy. So how do you amend the agreement without spoiling the evidence?
How to apply it: Do not open the original contract and edit it. Instead, write a separate addendum that refers to the original contract by its number and completion date, specifies the clauses that change and their new text, and is signed in the same way so that it gets its own hash. That way the original contract keeps its intact hash, the addendum has its own hash, and both can be proven together. If the amendment is substantial and comprehensive, it may be better to conclude a new contract that replaces the old one, stating that expressly.
Common mistake: Editing the original file and resending it for signature under the same name, so the archive holds two files with the same name and two different hashes, and a year later nobody knows which one is in force.
Example: A cleaning services company signed an annual contract with an office complex, and the parties later agreed to add two floors in mid-year. Instead of amending the contract, a short addendum was sent that referred to the original contract's number, added the two floors and adjusted the monthly fee. When the parties later disagreed on when the increase began, the addendum had its timestamp and hash, and the original contract had its intact hash, so the matter was settled by referring to both.
This addendum is an integral part of Contract No. (......), whose signing was completed on (......), and it amends only the clauses stated below; all its other clauses remain in force as they are.
Tenth: The Hash Compared with Paper Protections
Why it matters: With paper contracts, companies have been used to measures that protect integrity: signing every page, numbering pages, and stamping the edges. These measures are useful, but they do not reach the precision of a hash.
| Paper measure | What it protects | Its limits |
|---|---|---|
| Signing every page | Reducing the risk of page substitution | Signatures can be imitated, and it does not expose an edit to a line within a page |
| Numbering pages | Exposing missing pages | It does not expose changes to content |
| Stamping the edges | Binding pages together | Hard to examine precisely |
| Document hash | Exposing any change, even one character | Requires keeping the original copy without conversion |
The practical takeaway: A hash does not remove the need for caution, but it moves the integrity question from an error-prone visual judgment to a conclusive digital comparison. Instead of two employees reading two thirty-page contracts line by line looking for a difference, comparing two numbers is enough.
Contract Integrity Checklist
- Is the contract's hash computed at the moment of signing?
- Is it stored where no party can modify it?
- Is it fixed with a timestamp from an independent authority?
- Can you and the other party match it easily?
- Do you keep the original copy without re-saving?
- Does the contract state that the recorded hash is the reference?
Frequently Asked Questions
Can two different files produce the same hash?
In theory this is possible, but with modern functions the probability is so tiny that it is not a practical possibility.
Does a hash prevent a contract from being modified?
It does not prevent it physically, but it exposes it immediately, so the modified contract loses any value as the signed version.
Why did the hash change even though I changed nothing?
Most likely because the file was re-saved or converted to another format, so its internal data changed.
Does a hash reveal the contract's content?
No. The content cannot be extracted from it, which is why it can be shown on a public verification page safely.
Is a hash alone enough as proof?
It proves the integrity of the content. It needs the timestamp to prove time, and verification methods to prove the signatory's identity.
Do I need special software to compute a hash?
No. The signing platform's verification page computes it for you when you upload the file, and modern operating systems have ready-made commands to compute it. What matters is to use the same function used at signing, and to compute the hash of the original file as you received it, not a copy you re-saved or converted to another format.
Conclusion
The document hash is the most precise way to prove that a contract has not changed since it was signed, because it changes completely with any edit, even a single character, and it does not reveal the content. When paired with the timestamp and signatory verification methods, the system of proof is complete. If you want every contract you send to carry a hash that any party can match, start sending your contracts through Wthaiq. Make hash matching a habit in your finance and legal teams before any payment or performance based on an electronic contract. It is a step that takes under a minute, and it protects you from the most dangerous form of tampering and the hardest to spot by eye: the small edit to a number or a deadline. Whoever makes this a habit does not need an expert.
This article is for general awareness and does not constitute legal advice.