Hash values and the s.63(4) certificate.

What section 63(4) requires

When an electronic record is produced as evidence, section 63(4) asks for a certificate in the form set out in the Schedule to the Act. Part A is filled in by the party producing the record. Part B is filled in by an expert. Both record the hash value of the record and the algorithm used to compute it.

What the Supreme Court said

In Pune Bar Association v Union of India (2026 SCC OnLine SC 1297, judgment of 22 May 2026), a bench of three judges of the Supreme Court declined to strike down the hash value requirement. It described a hash value as "synonymous with an electronic fingerprint" that "provides a sure way of identifying and verifying digital data". The Court also observed that, besides a notified Examiner of Electronic Evidence, a person with special skill and expertise in computer science and cyber forensics may be treated as an expert if the court is satisfied on unimpeachable material, and left the wider scope of Part B open for an appropriate case.

What a hash value is

A hash function reads a file and produces a fixed-length string. SHA-256, the most common, produces 64 characters of 0-9 and a-f. The same file always gives the same value; change a single byte and the value changes completely. Two different files giving the same SHA-256 value is not something anyone has ever produced.

How to compute one

• In your browser: Keel Fingerprint, which never uploads the file.
• On Windows: certutil -hashfile "file.pdf" SHA256
• On a Mac: shasum -a 256 file.pdf
• On Linux: sha256sum file.pdf

All four give the same value for the same file.

What a hash shows, and what it does not

A matching hash shows that a file has not changed since the value was noted. It does not show that what is inside the file is true, who made it, or when it was made. That is why the certificate also asks who produced the record and how, and why Part B needs an expert.

Where Keel fits

Keel's inspection packs list each entry's SHA-256 hash value and the algorithm, in a form a party can enclose as the hash report the certificate refers to. The hash value of the record actually produced, such as a PDF of the pack, is computed on that file; Keel Fingerprint does it in your browser. The rest of Part A (the device, and who controlled it), Part B, and the decision whether to admit the record are for the party, the expert and the court. Keel gives its server particulars to a firm on request.

General information, not legal advice. Have your advocate review any certificate before it is filed.