Skip to content
Skip to content

Work out a file's SHA-256 fingerprint on your own computer, then find the same code in manifest.json and in evidence/chain.jsonl.

The check needs a text editor and a tool that is already on your computer. It needs nothing from us. You need a full export or a documents download for the file, and the evidence for the chain.

  1. 1 Pick any file under clients/. Work out its fingerprint on your computer.
  2. 2 Open manifest.json in a text editor and search for the file's name. The sha256 beside it must be the code you just worked out.
  3. 3 Open evidence/chain.jsonl and search for the same code. You find it on the entry that recorded receiving that document, with the date and the client's id.
Mac:      shasum -a 256 "<the file>"
Windows:  certutil -hashfile "<the file>" SHA256

When all three agree, the file is exactly what arrived on that date. A file that was opened and saved again can give a different code, so check the downloaded file itself.

A document that was erased has no file to check. Its entry stays in the chain, and manifest.json lists it with the date it was erased.

To check the chain itself, README.txt in the export explains how your IT person or an auditor can work out every entry's fingerprint again. Each entry must carry the fingerprint of the entry before it. Each anchor in anchors.json must match its entry in chain.jsonl, as daily anchors explains. A change to any entry shows as a mismatch from that entry onward, as the proof chain explains.