> Lesson 3 of PKI in 90 minutes: what hashes and fingerprints are, how digital signatures work, and what a valid signature does and does not prove. Source: https://pkizerotohero.com/course/fingerprints-and-signatures/ · Last reviewed: 2026-10-20 # Fingerprints and signatures About 9 minutesCrash course **In one sentence:** A hash is a short fingerprint of any data; a digital signature made with a private key proves the data is unchanged and was signed by whoever holds that key. ## The situation A supplier emails a PDF with new bank details for their invoices. The logo is right, the tone is right, the contact name is right. Your accounts team is about to update the payment record. How could anyone know that this document really came from the supplier, and that nobody changed a single digit on the way? ## What is going on ### Fingerprints: hashes A [hash function](https://pkizerotohero.com/handbook/glossary/#hash-function) turns any data, a word or a whole film, into a short fixed-size value called a [hash](https://pkizerotohero.com/handbook/glossary/#hash). People also call it a [fingerprint](https://pkizerotohero.com/handbook/glossary/#fingerprint). SHA-256, the most common one today, always produces 256 bits, usually shown as 64 hexadecimal characters. Three properties make hashes useful: - **Same input, same hash.** Anyone can recompute it and compare. - **Any change gives a completely different hash.** Change one comma in a 50-page contract and the hash looks unrelated to the old one. - **One way.** You cannot work back from the hash to the data, and finding two different inputs with the same hash must be infeasible. Older hashes such as MD5 and SHA-1 lost that last property, which is why they are retired for signatures. A hash uses no key, so it is not encryption, and there is nothing to “decrypt”. It also proves nothing about **who** sent the data: anyone who changes the document can simply compute a new hash for it. ### Signatures: proof with a private key A [digital signature](https://pkizerotohero.com/handbook/glossary/#digital-signature) adds the “who”. It builds on the key pair from lesson 2: 1. The document is hashed. Most signature algorithms do this as their first step. 2. A signature algorithm, such as ECDSA, combines that hash with the signer’s **private key** to produce the signature. 3. Anyone with the matching **public key** runs the verification algorithm on the document and the signature. Verification passes only if the document is unchanged **and** the signature was made with the private key that matches that public key. Change one byte and it fails. *Diagram: Signing: the sender hashes the document with SHA-256 and signs the hash with the private key, producing a signature. Verifying: the receiver hashes the received document and verifies it against the signature with the sender's public key. The result is either valid, marked with a tick, or invalid, marked with a cross.* Sign with the private key, verify with the public key. The document itself stays readable. Common mistake Signing is not encrypting with the private key You will read that signing means “encrypting with the private key”. It does not. Signature algorithms such as ECDSA and Ed25519 encrypt nothing, and the signed document stays fully readable. A signature adds proof, not secrecy. ### What a signature proves, and what it does not A valid signature proves two things: the data has not changed since it was signed, and it was signed with one particular private key. It does not prove who owns that key. If a fraudster sends you their own public key labelled with your supplier’s name, their signatures will verify perfectly. Lesson 4 closes that gap with certificates. For the invoice email in the situation, that means a signature would only help if you already had the supplier’s genuine public key. Until then, the safe check is a call to a phone number you already knew, not one in the email. Why it matters to the business Ask your team Which of our documents, software releases and payment instructions are signed, and how does the receiving side know the public key really belongs to us? Do we still accept MD5 or SHA-1 anywhere? ## Try it *Interactive tool: Certificate decoder (runs in the browser at [/tools/decoder/](https://pkizerotohero.com/tools/decoder/))* A certificate is itself a signed document. Find its signature algorithm (a hash plus a signature method, for example ECDSA with SHA-256) and the signature value at the end, then find the certificate’s fingerprint: one short hash that identifies the whole certificate. ## Check Check yourself You change one comma in a 50-page contract and compute its SHA-256 hash again. What happens to the hash? 1. One or two characters change 2. It stays the same, because the meaning did not change 3. It becomes completely different Show answer Answer C It becomes completely different What happened The new hash looks completely unrelated to the old one. Why Hash functions are designed so that any change to the input, however small, changes the output unpredictably. That is what makes a hash a reliable fingerprint. The rule Same data gives the same hash; any change gives a different hash. Check yourself A document carries a valid digital signature. What does that prove? 1. That it was signed with the private key matching the public key you used, and has not changed since 2. That the document is secret 3. That the signer is honest and the content is true Show answer Answer A That it was signed with the private key matching the public key you used, and has not changed since What happened It proves integrity (nothing changed) and that the matching private key made the signature. Why A signature hides nothing and says nothing about honesty. It ties the document to a key, and only to that key. The rule A signature proves which key signed and that the data is unchanged; who owns the key is a separate question. Check yourself A colleague says: 'Signing just means encrypting the document with your private key.' What is the best correction? 1. That is right for all signature algorithms 2. Signing runs a signature algorithm with the private key that produces proof, not secrecy; anyone with the public key can verify, and the document stays readable 3. Signing uses the public key and verifying uses the private key Show answer Answer B Signing runs a signature algorithm with the private key that produces proof, not secrecy; anyone with the public key can verify, and the document stays readable What happened Signing and encrypting are different operations with different goals. Why The 'encrypt with the private key' picture comes from a shortcut sometimes used to explain RSA, where both operations use the same maths. Even there the padding and the purpose differ, algorithms such as ECDSA encrypt nothing at all, and the picture suggests the document is hidden, which it is not. The rule Sign with the private key, verify with the public key. A signature is not encryption. ## Takeaways - A hash is a fixed-size fingerprint: any change gives a new hash, and with no key involved it is not encryption. - Sign with the private key, verify with the public key. A valid signature means “made with that key and unchanged since”. - A signature proves which key signed, not who owns the key. That is the next lesson. ## Go further - Handbook: [Hashes and fingerprints](https://pkizerotohero.com/handbook/hashes/) - Handbook: [Digital signatures](https://pkizerotohero.com/handbook/digital-signatures/) - Next lesson: [Whose key is it?](https://pkizerotohero.com/course/whose-key-is-it/) **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/course/fingerprints-and-signatures/). Last reviewed 20 October 2026Edition 0.9 ## Go deeper in the handbook - [Chapter 5: Hashes and fingerprints](https://pkizerotohero.com/handbook/hashes/) - [Chapter 6: Digital signatures](https://pkizerotohero.com/handbook/digital-signatures/)