Evidence log
A signature only matters on the day it is disputed, and on that day whoever runs the signing system has something to gain. So we do not ask you to trust us. Every signing event on Signathing is appended to one public hash chain. Each entry commits to the private details (who, from where, on what device) through a hash without publishing them. The chain head is sealed once a day and that day's page is archived by the Internet Archive, a third party we cannot edit. Change one byte of history and every hash after it breaks.
Entries
517
Chain head right now
888457ecde137b737d858391351b054bc077ad5cc9607dcbcbe3c8db11dc2a87
seq 517 at 2026-10-19T05:49:05.273Z
Sealed days
Each finished UTC day is sealed with the hash of its last entry. The archive link is the Internet Archive's copy of that day's page; the head there must match the head here. Today (2026-10-19) is still open and seals after midnight UTC.
| Day | Entries | Head hash | Archive |
|---|---|---|---|
| 2026-10-18 | 1 to 509 | dfd6ee711229ff8a465b65dd8f07844f9b4d2390cdd477ccbe9618707b17cad1 | snapshot |
Check it yourself
- Pull any slice of the log: /api/evidence/log?from=1&to=1000. Each entry is seq, at, type, fingerprint, detail_hash, prev_hash, hash.
- Recompute hash = sha256(prev_hash + "\n" + seq + "\n" + at + "\n" + type + "\n" + fingerprint + "\n" + detail_hash) and confirm each prev_hash is the hash before it. Entry 1 has 64 zeros as prev_hash.
- Compare the last hash of a day with the sealed head at /api/evidence/days and with the Internet Archive snapshot of that day's page.
- Holding a signed document? Its sender can export an evidence package (dashboard or API) that carries the private preimage of every event. Run the open verifier against it: verify-signathing.mjs (Node, no dependencies).
A second copy lives outside our servers: every sealed day, with all of its entries, is committed to the public repository github.com/jacejb/signathing-evidence-log once a day, so the Internet Archive and GitHub each hold a copy we cannot quietly change.
What the public log never contains: names, email addresses, phone numbers, IP addresses, devices, or the documents. Those live only in the sender's evidence package and the certificate inside the signed PDF. The fingerprint is sha256("signathing-doc:" + document id + ":" + original SHA-256), which only someone holding the certificate can compute.