Documentation

Everything you need to seal files, verify them, and integrate XSeal.

Getting started

1. Open the home page and choose a file under “Seal a file.”
2. XSeal computes the file’s SHA-256 hash in your browser and creates a signed seal.
3. Save the returned Seal ID — you’ll need it (with the file) to verify later.
4. Create a free account to keep every seal in your dashboard.

How sealing works

A seal binds three things together: the file’s SHA-256 digest, a UTC timestamp, and XSeal’s signature over them. Because SHA-256 is collision-resistant, any change to the file produces a different digest, so a later verification can tell authentic from altered.

Verifying a file

Go to Verify a file, upload the file and enter its Seal ID. XSeal recomputes the hash and checks the signature, then reports authentic (the file matches the seal) or altered (it does not).

Sharing a public certificate

Every seal has a public certificate page at /certificate/<Seal ID> — the link appears right after you seal a file, and as a “View public certificate” button on each seal in your dashboard. The page shows the file name, SHA-256 hash, size, sealed timestamp and signature, and XSeal re-verifies the signature when the page loads. Anyone with the link can review the certificate and upload their own copy of the file to confirm it is unchanged — no account required. The page reveals the hash and metadata, never the file itself.

Verifying independently with the public key

XSeal signs every certificate with an Ed25519 key. Fetch the service's public key at /verify/public-key and check a signature yourself, so you never have to trust this site at verification time. The signature is computed over the canonical JSON array [issuer, sealId, sha256, filename, sizeBytes, sealedAt]; verify the base64 signature from a downloaded certificate against that message with the public key — for example, in Node:

import { verify } from "node:crypto";
// cert = the "certificate" object from your downloaded xseal-<id>.json
const message = JSON.stringify([
  cert.issuer, cert.sealId, cert.sha256, cert.filename, cert.sizeBytes, cert.sealedAt,
]);
const ok = verify(null, Buffer.from(message), publicKeyPem, Buffer.from(signatureB64, "base64"));

Sealing API (Business plan)

Business accounts can create seals programmatically. Send the file’s SHA-256 hash and metadata to the sealing endpoint with your API key; XSeal returns the Seal ID, timestamp and signature as JSON. Webhooks notify your systems when a seal is created.

Plans & billing

Sealing a file and verifying are free to try. Paid plans raise your monthly sealing limit and unlock the API and webhooks; verification is always free. See pricing for the current plans. Paid plans are billed by Website Holding as merchant of record, renew automatically until cancelled, and can be changed or cancelled from your dashboard.

Your account & settings

A free account stores your seal history so you never lose a Seal ID. From your dashboard you can review every seal, open a seal's detail page, download its certificate, and delete seals you no longer need. To change your email or password, or to close your account and remove your data, contact support.

Data & privacy

XSeal stores only hashes and metadata, never file contents — see the privacy policy for details. For anything not covered here, the support team is happy to help.

Frequently asked questions