Verify a sealed message export
Someone handed you a file of text messages and told you it has not been edited. This page checks whether that is true, and tells you when the file was sealed. It is free, it needs no account, and the file never leaves your browser.
Drop an export file here, or click to choose one.
PDF, CSV, or JSON export. You can also drop its .mvseal.json alongside it. Nothing is uploaded.
Who this page is for
You do not need to own Message Archive to use it. Most people who verify a file never bought anything and never will.
- You were sent an exportA former partner, a contractor, a colleague or an executor sent you a file of messages. You want to know whether it has been edited since it was made.
- You are the one being asked to prove itYou produced the export and someone doubts it. Point them at this page rather than asking them to trust you, and let them check it themselves.
- You are a professional receiving recordsA lawyer, mediator, HR investigator, accountant or archivist handed a message export by a client. This gives you an independent check that takes about ten seconds.
How the check works
- Your browser hashes the file with SHA-256 using the built in WebCrypto API. A single changed byte produces a completely different fingerprint.
- It looks the fingerprint up at
/api/seal/<sha>. If a record exists, it shows when our server first received that fingerprint. - It checks the record’s receipt, an Ed25519 signature over
sha|manifestHead|receivedAt|id, in your browser against the public key below. That proves the record came from us and was not edited. - If a public timestamp authority also answered when the seal was made, you can download that RFC 3161 token and verify it with OpenSSL, so the time claim does not depend on trusting us.
Checking it without trusting us
The weakest form of proof is one where the party making the claim also owns the only way to check it. Two parts of this deliberately do not.
The fingerprint is a plain SHA-256 hash, so you can compute it yourself on any machine and compare it with what this page shows. On a Mac or on Linux that is:
shasum -a 256 your-export.jsonThe time attestation, where one exists, is an RFC 3161 token from a public timestamp authority. That authority never sees the file, only the hash, and its signature can be checked against its own published certificate chain with OpenSSL. Neither of those steps involves this website at all.
Public seal key
Ed25519, raw 32 bytes, base64. The same key is embedded in the Message Archive app.
BM9rpTxshftgEKaWHFOi0QORICD4ovNQb/d0JbtQmTI=
Questions
Do I need an account or a licence to verify a file?
No. This page is free and needs no account, no email address and no purchase. Anyone who has been handed a sealed export can check it here, whether or not they have ever used Message Archive.
Is my file uploaded anywhere?
No. Your browser reads the file locally and computes its SHA-256 fingerprint with the built in WebCrypto API. Only that 64 character fingerprint is sent to the seal registry. The file itself never leaves your machine, so the contents of the messages are never transmitted to us or to anyone else.
What does a successful check actually prove?
Two things. That the file is byte for byte identical to the file that was sealed, and the time at which the seal registry first recorded that fingerprint. If a trusted timestamp authority also answered when the seal was made, the time is attested by that third party rather than by us.
What does it not prove?
It does not prove that the archive was complete or truthful at the moment it was sealed. A sealed export is evidence that a file has not changed since a point in time. It is not evidence that the messages inside it are an accurate or full record of what was said. Nothing in cryptography can establish that.
Will this be accepted in a legal matter?
We make no claim about that and we are not a certified forensic tool. What the seal gives you is a tamper evident, independently timestamped file plus a plain statement of what the check does and does not show. Whether that meets the standard in any particular matter is a decision for the people involved in it, not something software can promise.
What is an RFC 3161 timestamp?
RFC 3161 is the internet standard for trusted timestamping. A timestamp authority receives a hash, signs it together with its own clock reading, and returns a token. Because the authority never sees the file and its signature can be checked independently, the token is evidence that the hash existed at that time without anyone having to trust the person holding the file. Message Archive requests a token from DigiCert when a seal is made.
Can I verify the timestamp without trusting this website?
Yes, and that is the point of using a public standard. Where a token exists, the result panel offers it as a download. You can check it with OpenSSL on your own machine using the timestamp authority’s own certificate chain, and never take our word for anything.
What if the fingerprint is not found?
It means the registry has no record of that exact file. The usual reason is that the file was edited after it was sealed, even trivially, because a single changed byte produces a completely different SHA-256 fingerprint. It can also mean the file was never sealed, or that it was re-saved by a program that rewrote it on the way through, such as opening a PDF and saving it again.
Where the sealed files come from
The files this page checks are produced by Message Archive, a Mac app that archives iMessage and SMS history into a local vault and can export part of it under seal. Verifying is free and always will be. The app is $47 a year and you do not need it to be on this page.
Why a screenshot proves nothing or read about exporting messages for a court case.