Verify a document

Every document on a drug page is listed with its sha256: a fingerprint of the exact file that was read. If you download the file from fda.gov and compute its sha256, the two values match only if the files are identical, byte for byte. This lets you confirm, without trusting EphemerisX, that a quote came from the document the FDA publishes today.

Before you begin#

You need the drug page open, and a computer with a terminal (macOS, Linux) or PowerShell (Windows). No extra software is required.

Compare the fingerprint#

1. Find the document. On the drug page, scroll to FDA documents read (or add #documents to the address).
2. Copy the full sha256. The table shows the first 12 characters. Hover the value to see all 64 characters.
3. Download the file. Select the document's title to open it on fda.gov, and save the PDF.

4. Compute its sha256. In a terminal, in the folder where you saved it:

   macOS

   shasum -a 256 761248Orig1s000SumR.pdf

   Linux

   sha256sum 761248Orig1s000SumR.pdf

   Windows (PowerShell)

   Get-FileHash .\761248Orig1s000SumR.pdf -Algorithm SHA256

5. Compare. The value printed should equal the one on the drug page. Letter case does not matter.

If the values differ#

• Check the file name. FDA folders hold many similarly named files. Make sure you downloaded the one listed.
• Check the date of the last check under the table. If the FDA replaced the file since then, the next weekly check will notice and the page will say so.
• Use the archived copy. The Copy column links to an Internet Archive copy, which should match the fingerprint if the FDA's copy has changed or been removed.

Find the quoted sentence#

Once the file matches, open it at the cited page. Citations give the PDF page number, which can differ from the number printed on the page. See Verify a quote.