Check an evidence pack
Someone handed you a DisclosureProof report or Evidence Pack and you want to know whether to trust it. This page answers two separate questions, and it is worth being precise about which one is which, because only one of them requires trusting us.
Is the evidence unaltered?
The manifest is hashed with plain SHA-256 over a fixed, deterministic serialization. Recompute the hash and compare it with the one printed on the report. Change one byte of any screenshot, finding or timestamp and the hash changes. You do not need us for this, and the command to run it yourself is at the bottom of this page.
Did DisclosureProof seal it?
The seal is an HMAC-SHA256 signature under a key only we hold. That means we can confirm a signature is ours, but you are trusting us to answer honestly, because it is a shared-secret signature rather than a public-key one. We would rather say so than imply more.
Run the check
Paste the contents of evidence_manifest.json from the pack. Everything is optional except one of the two fields, and nothing you paste is stored.
Prefer not to trust this page at all?
The integrity check is a standard SHA-256 over the manifest file exactly as issued. Save it and run:
shasum -a 256 evidence_manifest.json
Compare the output with the manifest hash printed on the report. That check involves no server, no account, and no code of ours. The "Hash it in my browser only" button above does the same thing locally, without sending anything.