Verify · free, no key

Check a capture record.

Give a record id or paste a record. You will see what was checked: PageVerified's signature, the content hash, and each outside timestamp with the authority's name and the time it signed.

Check a record

Checking by id works for a signed record made with a public receipt. For any other record, paste it:

Nothing you paste is stored. The check is free and needs no key.

What each check proves, and what it does not

Scroll the table horizontally to see all fields.

The checks
Check	What it proves	What it does not prove
PageVerified's signature	PageVerified's key signed these exact record fields, so none of them has been changed since.	The time in the record is PageVerified's own clock. The signature does not show who wrote the page or that what the page says is true.
Content hash	A file with this SHA-256 is byte for byte the file the record describes.	It says nothing about what the live page shows now, or about who wrote it.
Outside timestamp	An authority that PageVerified does not run signed the SHA-256 of this exact record at the time shown. The record existed by then and has not been changed since.	The authority saw only a hash. It did not see the page, the URL or the file, and it does not vouch for them. This check does not look up whether the authority's certificate was later revoked.

None of these checks is a legal certification. They do not show who wrote a page or that what it says is true.

Outside timestamps

A record's own time is PageVerified's clock. An outside timestamp is a second statement of time from an authority PageVerified does not run. The authority signs the SHA-256 of the signed record, using the RFC 3161 time-stamp protocol. Only that hash is sent. The page, the file and the URL never leave PageVerified.

Outside timestamps are switched on. The hash of each new signed Capture Record is sent to each of these authorities:

The requests are made separately from the capture and never delay it, usually within 15 minutes. If an authority does not answer, the record says it has no outside timestamp yet, and the request is retried, every 15 minutes at first and then less often, for about a week. A record made before outside timestamps were switched on has none. The methodology page describes each method version.

Stored tokens are kept for 365 days, or until the capture is deleted if that is sooner. To keep them longer, save the JSON answer for your record: it holds the tokens and the authorities' root certificates, and it can be checked offline for as long as you keep it.

Check a record offline, without PageVerified

The checks on this page can be run on your own computer with an open-source script. It is one file under the MIT licence, needs Node.js 20 or newer, installs nothing and makes no network calls. This server runs the same code.

curl -s -o pageverified-verify.mjs https://pageverified.com/verify/pageverified-verify.mjs
curl -s -o keys.json https://pageverified.com/.well-known/pageverified-keys.json
curl -s -o record.json https://pageverified.com/api/v1/verify/<record id>
node pageverified-verify.mjs record.json --keys keys.json --file <your copy of the captured file>

Download keys.json yourself and keep it. Without --keys the script reports the signature as not trusted, because a key that arrives inside the file being checked proves nothing.

To check an outside timestamp with OpenSSL instead, let the script write the files and print the commands:

node pageverified-verify.mjs record.json --keys keys.json --export out
cd out
openssl ts -verify -data record.canonical.json -in <authority>.tsr -CAfile <authority>-root.pem
# Verification: OK

record.canonical.json is the record as JSON with its keys sorted and no spaces. Those are the exact bytes PageVerified signed and whose SHA-256 the authority signed. The .tsr file is the authority's answer as it was received. The root certificate is the authority's own; compare its fingerprint with the authority's website before you rely on it.

The same answer as JSON

curl -s https://pageverified.com/api/v1/verify/<record id>

curl -s -X POST https://pageverified.com/api/v1/verify \
  -H "content-type: application/json" \
  -d @record.json

Both are free and need no key. The answer has result (pass, fail or incomplete), a one-sentence summary, and a checks list. Each check has result, detail, proves and does_not_prove. outside_timestamps holds each verified token with the authority's name, the time it signed and its root certificate, so the answer can be saved and checked offline.

Verifier version 1.0.0.