The Newspaper That Runs Backwards

In the movies, a kidnapper proves a hostage is alive by photographing them with today's newspaper. That proves the photo is no older than the date. The harder trick is the reverse: proving you had a specific thought no later than a date — without revealing it yet. A few lines of math do exactly that, and people have been pulling the same trick, by hand, for four hundred years.

You've seen the shot a hundred times. A grainy photo, a frightened face, and — held up to the camera — a folded newspaper with the date showing. The message is silent and exact: this was taken today. Not last month, not from an archive. You can fake a lot of things, but you can't print tomorrow's news, so the paper drags the photo forward to at least this morning.

It's a tidy little proof. It pins the photo to a floor in time: no older than the date on the paper. And once you notice that shape, you start to wonder about its mirror image — the proof that turns out to be much harder to pull off.

Part 1The reverse problem

Here's the mirror. Suppose you have an idea right now — a prediction, an invention, the answer to a riddle — and you want to be able to prove later that you had it today. But you don't want to say it yet: revealing a prediction can change the outcome, and revealing an invention hands it to whoever reads fastest.

The newspaper photo is no help here, because it works the wrong way. It proves "no earlier than"; you need "no later than." You need to prove priority — that the thought was already in your head — while keeping the thought itself sealed. Say it out loud and you lose the secret. Stay silent and you lose the proof. For most of history you'd have had to pick one.

The escape is a thing cryptographers call a commitment scheme,1 and the everyday version of it now fits in a single function on your laptop.

Part 2The fingerprint machine

That function is a cryptographic hash — the most useful boring object in computing. Feed it anything — a word, a contract, a movie — and it returns a fixed-length string of gibberish called a hash or digest. The one we'll use, SHA-256, always spits out 256 bits: 64 hexadecimal characters, no matter how big or small the input.2

Three properties make it magic, and they're worth naming because the whole trick leans on them:

- It's deterministic. The same input always gives the same hash. cat hashes to `77af778b…` today, tomorrow, and on your machine and mine. - It avalanches. Change one letter and the output is unrecognizable. cat → `77af778b…`, but bat → `ca5bce12…`.3 There's no "close." A one-bit change scrambles about half the output bits. - It's one-way. Given the hash, you can't run the machine backwards to recover the input.4 (The proper name is preimage resistance: given a digest, you can't feasibly find anything that produces it.)

A hash, then, is a fingerprint for data: tiny, fixed-size, unique in practice, and impossible to reverse. Hold that, because the commitment trick is about to fall right out of it.

Part 3Commit, then reveal

Write your sealed thought as a sentence. Hash it. Now publish the hash — just the 64 characters of gibberish — somewhere public and dated. You've said nothing about the content: the hash is one-way, so the world learns your fingerprint and not your secret.

Later — a week, a year — you reveal the actual sentence. Anyone who kept your hash runs it through SHA-256 themselves and checks: does it match the gibberish you posted back then? If it does, you've proven something genuinely hard to fake — that this exact sentence existed, in finished form, at the moment you posted the hash. You couldn't have written the sentence to fit the hash afterward (one-way), and you couldn't have swapped in a different sentence that happens to match (we'll get to why). The hash was a sealed envelope; the reveal opens it; the seal proves it was never re-stuffed.

That's the whole move, and it has the two halves every commitment needs, with names worth keeping:

- Hiding — the commitment (the hash) reveals nothing about the message until you open it. - Binding — you can't open it to a different message than the one you sealed. (This one rests specifically on the hash being collision-resistant — nobody can find two inputs with the same fingerprint — which is a stronger promise than the plain one-wayness from Part 2.)

Both halves, it turns out, come with fine print. The next two sections are that fine print, and skipping them is how people who think they've proven something actually haven't.

Part 4The hash is not a clock

Here's the first thing a cryptographer will say, and they're right to:

“A hash doesn't prove anything about time. You can compute a hash any moment you like. If you show me a hash and a sentence that matches it, you've shown me they go together — not that you had either of them yesterday.”

Exactly so. The hash binds the content; it says nothing about when. All the time-proving work is done by the other half of the recipe — the word publish.

To prove when, you have to pin the hash to a record you can't quietly backdate: post it to a public, timestamped, hard-to-edit place. A dated social-media post. A classified line in an actual newspaper. A transaction on a blockchain (which is, at heart, a giant shared notebook whose pages are extremely hard to reorder after the fact). The formal version of this even has a standard — RFC 3161,5 "trusted timestamping" — where a trusted service signs "I saw this hash at this time." Without that external anchor, your hash proves priority over exactly nothing; you could have made it this morning and sworn it was last year.

No record is magically un-forgeable, and it's worth being honest about that: a blog can be edited, a blockchain can briefly reorganize, a timestamp authority can lie. "Un-backdatable" is really shorthand for "independently witnessed and hard to backdate" — which is exactly why the strongest anchors are the ones lots of people watch at once. So the honest statement of the trick is two-part: *the hash says what, the public record says when.** Notice this is precisely what the hostage photo does, too — the newspaper is* the public, widely-witnessed record, and the captor is just borrowing its date. We're doing the same thing, pointed the other way.

Part 5Seal it properly

The second piece of fine print is sneakier, and it's where amateur "I hashed my prediction" stunts quietly fall apart.

“You said the hash hides the message. But if I can guess your message, I can just hash my guesses and check them against your published hash. "One-way" doesn't help you if the input is easy to guess.”

This is correct and important. Preimage resistance means I can't invert your hash in the abstract — but if your secret is "the Lakers win the 2026 finals,"6 there are only so many plausible sentences, and I can hash all of them and see which matches. A bare hash is only hiding when the input is genuinely unguessable.

The fix is one ingredient: a secret random nonce — a big, unguessable random number (256 bits, say), generated fresh, that you keep to yourself and fold into the message before hashing. You publish only the resulting hash. So instead of `SHA-256("Lakers win…")` you commit to `SHA-256("Lakers win…" + r)` where `r` is your secret number, and at reveal time you publish both the sentence and `r` so anyone can recheck. Now there's nothing to guess: the nonce is enormous and secret, so no attacker can hash their way to your input. Two cautions that matter more than they look: this is not the password kind of "salt" (those are stored in the open — here the value must stay secret until you reveal it), and the two pieces have to be joined unambiguously — a fixed-length nonce, or a length-prefixed / canonical encoding — so that no other message-and-nonce pair could ever produce the same bytes and quietly break the binding.7

And one more honest limit, because it's the most common way these stunts mislead. A single commitment proves you had this thought — not that it was your only thought. A pundit can secretly hash both "Team A wins" and "Team B wins," publish both, and afterward reveal whichever came true, looking like an oracle. So the proof is narrow and precise: whoever knew the nonce had this exact message, sealed, by this date. It is not "I predicted the future," "this was my only call," or even "I'm the one who thought of it" — the bare hash says nothing about who you are or whether you committed to ten other things too. Pinning down identity and "this was my only prediction" is the job of the surrounding protocol — sign the commitment, publish it from a known account, list every commitment in one public registry — not of the hash. If someone shows you a single dramatic reveal with none of that scaffolding, the right question is: what else did you commit to that you're not showing me?8

(One last bit of fine print: the binding half rests on the hash being collision-resistant — no one can find two different inputs with the same digest (SHA-256's collision security is about 128 bits, and no practical collision is known). Its predecessor SHA-1 was not so lucky: in 2017 a team at Google and CWI Amsterdam produced two different PDF files with the same SHA-1 hash — a collision break, exactly the property a commitment leans on. "Use a hash" is not a blank check; use a current one.)9

Part 6People did this with anagrams

None of this is new. Strip away the computer and the commitment scheme is centuries old — and scientists used it constantly, because the race for priority was brutal and you couldn't always prove your discovery before you were ready to defend it.

In the 1670s Robert Hooke published a string of nonsense: ceiiinosssttuv. Years later he revealed what it unscrambled to — ut tensio, sic vis, "as the extension, so the force," the law of elasticity we now call Hooke's Law.10 The scramble was his commitment: the letters were fixed and public (binding — he couldn't later claim a different sentence with other letters), but the meaning stayed sealed (hiding) until he chose to reveal it. Galileo did the same in 1610, mailing out a 37-letter jumble — smaismrmilmepoetaleumibunenugttauiras — that he later opened as "I have observed the highest planet to be triple," his first, blurry glimpse of Saturn's rings.11 He got to stake the claim without handing rivals the discovery.

An anagram is a weaker seal than SHA-256 — the letters leak a little (you know the counts), and a clever rival might unscramble it, as Kepler tried and botched with Galileo's. But the shape is identical to what your laptop does now: commit in public to a scrambled form, reveal the plaintext later, let the world check the two against each other. We didn't invent the idea. We just built a lock that doesn't leak.

Coda: the newspaper runs both ways

Step back and the hostage photo and the published hash turn out to be the same tool, aimed in opposite directions.

The newspaper in the photo proves no earlier than its date — a floor. The published hash proves no later than the moment you posted it — a ceiling. Pin a fact from both sides and you've trapped a moment in time that can't drift in either direction. And the two halves aren't even separate worlds: Bitcoin's very first block, mined on 3 January 2009, has a line buried in it — "The Times 03/Jan/2009 Chancellor on brink of second bailout for banks" — the front-page headline of that day's paper. It's the hostage-photo trick, played straight: strong evidence the block could not have been assembled before that morning.12 The forward newspaper and the backward hash, sitting in the same object.

So the next time you have a thought you want to keep but can't yet share — a prediction, a guess, a not-quite-ready idea — you don't have to choose between proof and secrecy. Fold in a secret random number, hash it, and nail the hash somewhere public, dated, and watched. You won't have proven you're right. You won't have proven it was your only guess, or even that you were the one who thought of it. But you'll have proven the one thing that used to be impossible: that the sealed thought was already yours, on a day the whole world can check.