Seal a document
Upload a file (any type, ≤ 2 MB) or paste document text. The server hashes the exact bytes, stores them at that hash, and records the seal.
Drop a file here or click to choose one.
Any file type · max 2 MB · hashed exactly as uploaded.
— or —
Verify authenticity
Paste the document text (or upload the file) together with its blob id: the server re-hashes the bytes and compares them with the claimed id — that check needs no server storage, so it works on any server instance. A blob id on its own only checks this server instance's register, which is per-instance on serverless.
Drop a file here or click to choose one.
— or —
Verdict
No verification yet. Upload a file or paste a hash and press “Verify now”.
Tamper demo
Takes a sealed sample document, flips exactly one character, and runs the check — watch a genuine hash mismatch produce a TAMPERED verdict.
The vault
Every sealed document, live. Click a row for the full detail. The 3D stack below shows the same real documents — each card is a sealed record, not a mock.
Loading sealed documents…
| Title | Type | Issuer | Sealed (UTC) | Blob id |
|---|---|---|---|---|
| Loading… | ||||
Audit trail
Append-only and hash-chained: every seal and every verification writes one receipt, each receipt hashing the one before it. Re-verify the whole chain in one click.
- Loading…
How it works
The hash is the address — the same idea Walrus is built on.
Hash the exact bytes. SHA-256 of your file is computed; that 64-character hash becomes the document's blob id, and the bytes are stored under that id. Same bytes → same id, always.
Re-hash and compare. Upload a suspect copy: if its hash equals the sealed blob id, it is byte-for-byte the original (AUTHENTIC). One flipped character → a totally different hash → TAMPERED. An unknown hash → NOT FOUND. This comparison needs no server lookup, so it works even when the seal happened on a different server instance.
Chain every receipt. Each seal and verify appends a receipt whose hash covers the previous receipt. Alter any entry and the chain check fails at that exact receipt.
What is real: SHA-256 sealing, content-addressed storage on disk, verify + tamper demo, hash-chained audit log, this UI. What is a stub: the WalrusTestnetAdapter — storing on Walrus testnet needs a funded SUI wallet and a publisher endpoint; neither exists here, so no Walrus blob id is ever faked. The local store uses the same content-addressing, so swapping adapters later changes where bytes live, not how authenticity works.