quantakrypto
Loading…
Loading…
Recompute a credential's SHA-256 fingerprint and compare it against the published digest. Your browser does the hashing — we never see the string you check, so a matching result is something you established, not something we asserted.
Nothing leaves this tab
The digest is computed by your own browser with crypto.subtle.digest. This page makes no network request with what you paste, and a prefilled link keeps its payload after the # — the part of a URL browsers never send to a server. Load the page, then pull your network cable if you like: it still works.
The exact bytes to hash — no trailing newline, no re-indenting. Copy it from the “what exactly was hashed” panel on any credential page.
Every quantakrypto credential has a canonical string: a single line of JSON holding the seven facts that make the credential what it is — its id, kind, title, holder, issuer, issue date and expiry. When the credential is issued, that exact line of text is run through SHA-256, and the resulting 64-character digest is stored alongside it and submitted to the Bitcoin blockchain via OpenTimestamps.
SHA-256 is a one-way function with no known way to steer it: change one character of the input — swap a name, move an expiry date out by a day — and the digest changes into something completely unrelated. So if the string you were shown hashes to the digest that was published, the two must describe the same credential. You are not taking our word for the contents; you are checking arithmetic that anyone can redo.
This is why the input has to be byte-exact. A credential page shows the JSON indented so it can be read, but the indented version is not what was hashed — its digest will not match. Always copy the compact single-line form, which is what the credential page’s copy button and its “verify this hash” link both hand you.
Status, metadata, backlinks and renewal pointers sit outside the canonical string on purpose. They are mutable bookkeeping: revoking, renewing or superseding a credential must not invalidate a timestamp that truthfully records what was issued and when. A matching hash proves the credential’s contents are intact — check the credential page itself for whether it is still active.