What SHA-256 Is
SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function that takes any input — a document, a string of text, a set of business registration data — and produces a fixed-length 64-character hexadecimal output called a hash or digest. The same input always produces the same hash. A different input — even a single changed character — produces a completely different hash.
This property makes SHA-256 ideal for tamper detection: if the underlying data changes, the hash changes, and anyone who has stored the original hash can immediately detect the discrepancy.
How AI Verified Uses SHA-256
When a business passport is created in the AI Verified registry, the system generates a SHA-256 hash of the passport's canonical data: the business name, registered domain, registration number, country, and verification timestamp. This hash becomes the passport's permanent identifier — the 64-character string in the URL aiverified.io/v/[hash]/.
Because the hash is derived from the passport data, it serves as both an identifier and an integrity check. Anyone who has the passport data can independently compute the SHA-256 hash and confirm it matches the published hash. If the data has been tampered with, the hashes will not match.
Why Not a Simple ID Number?
A sequential ID number (1, 2, 3...) identifies a record but does not verify its integrity. A SHA-256 hash does both: it identifies the record and provides a cryptographic proof that the record has not been modified since the hash was generated. For a business identity registry, this distinction matters: a registry that uses sequential IDs can be modified without detection; a registry that uses cryptographic hashes cannot.
Verification Without Trusting the Registry
The most important property of SHA-256-based verification is that it allows independent verification without trusting the registry operator. A third party who has stored a business's passport hash can verify the passport at any time by re-computing the hash from the published passport data and comparing it to the stored hash. If they match, the passport is authentic. This verification requires no communication with the AI Verified servers — it is a purely mathematical operation.
Limitations
SHA-256 hashing verifies integrity (the data has not changed) but not authenticity (the data was correct when it was first recorded). A passport that contains incorrect information will have a valid hash — the hash only proves the data has not changed since the passport was created, not that the original data was accurate. This is why AI Verified combines cryptographic hashing with human verification of the underlying business registration data.