Verify a package

Nothing is uploaded.Your browser does the checking.

For whoever was handed a sealed package: a detective, an evidence technician, a prosecutor, defense counsel or a court. Whoever holds a sealed package can check it.

Emergency

Someone in danger right now? Nothing here slows you down. Call the business; under the Standard it can release the record at once. Document the purpose and your authority as your jurisdiction's law and your agency's policy require.

Holding a package? Four steps.

  1. Keep the file as received.

    That file is your master. Record its SHA-256 in the case file with the date and your name, then work only from copies. Keep a written record of each check and its result.

  2. Drop it here.

    Your browser checks every file against the package's index and checks the signatures on the index and the manifest. Nothing leaves your device.

  3. Check the key with the issuer.

    The issuer is the system named on the package. Call the business or its provider, on a number you already know, never one the package prints, and read them the first and last eight characters of the key fingerprint this page shows.

  4. If a check fails, stop.

    Do not treat that file as authentic. Keep everything as it is. Tell the business, and write to standard@fusiontrace.io with the package ID and the line that failed.

Verify a sealed package.

The package file as it was delivered. Any other file, or an archive that is not a sealed package, gets its SHA-256 instead.

Drop a sealed package here, or choose it Checked on this device. Nothing is sent anywhere.

The signature check is still being tested against reference packages. Until that testing is published, rely on the file hashes, and check the key fingerprint with the issuer by phone.

How verification works

What the checks mean.

  1. The archive opensA sealed package is a ZIP with every file stored uncompressed, so every file's bytes are exactly the bytes that were hashed.
  2. Every file agrees with its SHA-256The package's artifact index lists each file with its hash. Your browser recomputes all of them. One changed byte in any indexed file changes its hash, and that file fails its check. The certificate page inside the package and the archive's own headers are not covered.
  3. Nothing extra was addedAny file the index does not name, and does not list as permitted unindexed, is reported. The permitted list is shown with the result.
  4. The index and the manifest agree with their digests and signaturesEach carries its own SHA-256 and an Ed25519 signature over that digest, made with the key whose public half is printed in the package.
  5. The key fingerprintThe page shows the fingerprint of the signing key. Compare it with the key the issuer publishes, from a source outside the package, such as the business itself. The certificate page inside the package is not covered by the seal, so it cannot vouch for the key on its own.

A pass means the package is intact and agrees with its own seal: the indexed files have not changed since the package was sealed. It does not show how a file came off the recorder. Ask the business who preserved each file, and how. This page never claims more than it checked. Nothing on this site is legal advice or a statement about admissibility in any court.

No server sees your package.

Once this page has loaded, the checks run with no connection at all.

Hashes verify in any up-to-date browser. The Ed25519 signature check needs a recent one, and the page says so when it cannot run it. Archives over 4 GB, or in ZIP64 form, cannot be opened by this page.

Try the demonstration package

Film No. 02

Prove nothing changed.

For investigators and prosecutors. How a sealed package shows that nothing changed after sealing.

Runtime (1 minute 32 seconds)English captions

Transcript and every film

Check a FusionTrace Certified™ certificate.

Every certificate carries an ID. Enter it to see the certificate's status now. The ID is sent to this site's server in the body of the request, never in a web address.

Certification is by invitation through the FusionTrace Academy™. The Steward scores every exam and issues every certificate. A certificate shows the status on the day it was issued. This check shows the status now. It never reports a certificate that does not exist.