Get a free key

Guide · sha256sum · Get-FileHash

How to verify a capture against its hash and receipt.

Hash the file you hold and compare it with the SHA-256 on the capture's public receipt page, /e/<id>. If the two are equal, your file is byte for byte the file that receipt describes. It takes one command.

Get a free keyPricing

Four steps

The steps

  1. Open the receipt. Go to the capture's receipt page at pageverified.com/e/ followed by the capture ID. Note the SHA-256 artifact digest it shows.
  2. Download the file. Use the Retrieve artifact button on the receipt. The link is good for 24 hours; reload the receipt for a fresh one.
  3. Hash your copy. Run sha256sum on Linux, shasum -a 256 on macOS or Get-FileHash in PowerShell on the downloaded file.
  4. Compare. If your hash equals the digest on the receipt, your file is byte for byte the file that receipt describes.

A real capture you can check now

Exact commands

This receipt is public: https://pageverified.com/e/6c5dbd00-8f1c-4b3a-9456-6d585e615e51. It records a 42,580-byte PNG of https://pageverified.com/pricing with this digest:

748c89348b38d4e14e731d5071e409262a2f644c03461034d8c30e3353c5469c

Download the file with the Retrieve artifact button on the receipt and save it as capture.png. Or copy that button's link and use curl:

curl -s -o capture.png "<link from the Retrieve artifact button>"

Linux

sha256sum capture.png
# 748c89348b38d4e14e731d5071e409262a2f644c03461034d8c30e3353c5469c  capture.png

Or let the tool compare for you. It prints capture.png: OK on a match:

echo "748c89348b38d4e14e731d5071e409262a2f644c03461034d8c30e3353c5469c  capture.png" | sha256sum --check

macOS

shasum -a 256 capture.png

Windows PowerShell

Get-FileHash .\capture.png -Algorithm SHA256

# Prints True on a match. PowerShell shows the hash in capitals; -eq ignores case.
(Get-FileHash .\capture.png -Algorithm SHA256).Hash -eq "748c89348b38d4e14e731d5071e409262a2f644c03461034d8c30e3353c5469c"

What a receipt page shows

Every capture made with a public receipt has a page at /e/<id>. It shows:

  • The source URL.
  • The format and the size in bytes.
  • The capture time in UTC.
  • The SHA-256 artifact digest.
  • The capture ID.
  • A Retrieve artifact button. Its link is signed and expires after 24 hours. Reload the page for a new one.

If the page answers 404, the capture ID is wrong, the capture was made with "public_receipt": false, or the capture did not complete or was deleted.

If the hashes do not match

  • Check that you are comparing against the right capture ID.
  • Download the file again with curl. A browser's "Save page as" can rewrite an HTML file, and that changes its hash.
  • A file that was opened and saved again, converted, cropped or sent through a chat app is a different file and will not match. Only the original download does.
  • If a fresh download from the receipt still does not match the digest on that receipt, tell us.

Optional

Verify a signed Capture Record

A signed Capture Record, from POST /api/v1/capture/record, can be checked without trusting PageVerified's database. Save the whole response to record.json and post it back. The check is free and needs no key:

curl -s -X POST https://pageverified.com/api/v1/capture/record/verify \
  -H "content-type: application/json" \
  -d @record.json

A good record answers {"valid": true, "key_id": "...", "alg": "...", "record": { ... }}. Then hash your file as above and compare it with record.sha256. A bad one answers {"valid": false, "reason": "..."}, where the reason is one of record_missing, signature_missing, record_shape_invalid, record_version_unsupported, unknown_key_id, alg_mismatch, signature_mismatch, record_invalid.

To check a record without calling PageVerified at all: the signature is over the record as JSON with its keys sorted and no spaces, it is base64url encoded, the algorithm is EdDSA or ES256 as named in the record (an ES256 signature is the raw 64-byte r and s values, not DER), and the public keys are at /.well-known/pageverified-keys.json. A record has these fields: v, call_id, url, format, full_page, sha256, bytes, captured_at, renderer, key_id, alg.

The record check page does the same in a browser and links an open-source script that runs the checks offline.

What a match proves

A match proves one thing: the file you hold is byte for byte the file whose hash the receipt shows. The receipt, its hash and its time are PageVerified's own record, and the time is PageVerified's own clock, not an independent one. A match does not prove who wrote the page or that its content is true.

A capture records what PageVerified's renderer saw at the recorded time. It is not a forensic chain of custody, proof of who wrote a page, or a legal certification.

The same on every page

Prices and limits

  • Formats. PNG, PDF or rendered HTML. One format per call.
  • Cost. A PNG or HTML capture costs 1 credit. A PDF costs 2 credits. A capture that fails is not charged.
  • Signed Capture Record. The capture cost plus 4 credits.
  • Free key. 25 credits, with no email and no card. Free keys render at up to 1,280 by 800 pixels, stop full-page captures at 2,400 pixels and allow 10 captures a minute. New free keys are issued in limited numbers; when none are left the API answers 429.
  • Every key. Free or paid, one key can run up to 120 captures an hour. Each key also has a daily share of the shared browser pool. A key capturing at that rate reaches it in under an hour.
  • Paid keys. Viewports from 320 to 2,560 pixels wide and 240 to 2,000 pixels high. Full-page captures stop at 16,000 pixels.
  • Packs. Credit packs are one-time payments in US dollars, bought with card checkout: $19 for 3,000 credits, $49 for 12,000 credits, $149 for 60,000 credits. Nothing renews.
  • Agents. An agent can buy the same packs over HTTP 402 with no person involved, plus $1 for 150 credits. How an agent pays.
  • Storage. The captured file is kept in private storage until you ask for it to be deleted. Download links are signed and expire after 24 hours. By default a capture has a public receipt page, which issues a fresh link each time it is loaded.
  • Time. The capture time is UTC from PageVerified's own server clock. For a signed Capture Record, outside time-stamp authorities later sign the record's hash with their own time, usually within 15 minutes; the record check at /verify shows it.
  • Pages it can capture. Public http and https pages only. It cannot log in, send cookies or set request headers, and private network addresses are refused.
  • What a capture is. A capture records what PageVerified's renderer saw at the recorded time. It is not a forensic chain of custody, proof of who wrote a page, or a legal certification.
  • Not offered. No uptime guarantee and no security or compliance certifications.

The card packs and the cost of every tool are on the pricing page, and more limits are in the API reference. How long data is kept is on the data handling page.