Documentation

Everything you need to seal files, verify them, and integrate XSeal.

Getting started

1. Open the home page and choose a file under “Seal a file.”
2. Your browser computes the file’s SHA-256 fingerprint and XSeal signs it with a UTC timestamp. The file never leaves your device; only the fingerprint, file name and size are stored.
3. Save the returned Seal ID; you’ll need it (with the file) to verify later.
4. Create a free account to keep every seal in your dashboard.

On your dashboard, a Get the most from XSeal checklist shows the next steps: seal your first file, seal a batch, seal a new version and, on the Business plan, create an API key. Each step ticks itself off once you have done it. Hide checklist removes it from that browser.

How sealing works

A seal binds three things together: the file’s SHA-256 digest, a UTC timestamp, and XSeal’s signature over them. Because SHA-256 is collision-resistant, any change to the file produces a different digest, so a later verification can tell authentic from altered.

Verifying a file

Go to Verify a file, choose the file and enter its Seal ID. Your browser recomputes the hash and XSeal checks it and the signature against the seal, then reports authentic (the file matches the seal) or altered (it does not).

Sharing a public certificate

Every seal has a public certificate page at /certificate/<Seal ID>, the link appears right after you seal a file, and as a “View public certificate” button on each seal in your dashboard. The page shows the file name, SHA-256 hash, size, sealed timestamp and signature, and XSeal re-verifies the signature when the page loads. Anyone with the link can review the certificate and check their own copy of the file (hashed in their browser, never uploaded) to confirm it is unchanged; no account required. The page reveals the hash and metadata, never the file itself.

Sharing a seal: link, QR code and badge

Open a seal in your dashboard to find its Seal Integrity panel. Copy verification link copies the public verification page, /verify/<Seal ID>, which anyone can open without an account. Under Check your copy on that page, the recipient chooses the file they received and sees at once whether it is the sealed version; the file is fingerprinted in their browser, not uploaded. Show QR code displays a QR code that opens the same page, ready for a printed document or a slide. Download Badge (SVG) saves an “XSeal Verified” badge to embed in a README, an email signature or a PDF. These tools are only available to the seal's owner; the pages they point to are public. To share without opening the seal first, use Copy link on its row in the dashboard list: it copies the same verification link.

The confidence score

Every verification page shows a 0 to 100 confidence score with its breakdown under “What makes up this score?”. It adds up independent checks: a cryptographically valid signature (40 points), a recorded SHA-256 hash (15), a trusted timestamp (15) and who sealed it (15 for a registered account, 0 for an anonymous seal). A valid seal made from an account scores 85, an anonymous one 70. The score says how much evidence backs the seal; the authentic or altered verdict comes from the hash and signature check itself.

Bulk sealing (multiple files at once)

Open Bulk seal to seal up to 20 files in one action. Each file gets its own real certificate, exactly like a single seal, plus one combined, signed manifest covering the whole batch — its combined hash is the SHA-256 of every member seal's hash, sorted, so it proves the whole set is unchanged whatever order the files were chosen in. Every manifest has its own public page at /manifest/<manifest ID>, which re-verifies the signature and recomputes the combined hash on load, the same way a single certificate page does. Signed-in bulk seals count against your plan's monthly quota; anonymous bulk sealing is allowed but capped at 20 files per batch.

Sealing a new version of a document

When a document changes, seal the revision as a new version instead of a separate seal. Open the original seal in your dashboard, choose the Revised file and press Seal new version. The new seal records which seal it replaces, and the Versions list on each seal's page shows the whole history in order, so you can prove both what the document said at each point and the order of the changes. Each version is a full seal with its own certificate and counts towards your monthly limit. If you delete an earlier version, the next one becomes the start of the chain.

Verifying independently with the public key

XSeal signs every certificate with an Ed25519 key. Fetch the service's public key at /verify/public-key and check a signature yourself, so you never have to trust this site at verification time. The signature is computed over the canonical JSON array [issuer, sealId, sha256, filename, sizeBytes, sealedAt]; verify the base64 signature from a downloaded certificate against that message with the public key, for example in Node:

import { verify } from "node:crypto";
// cert = the "certificate" object from your downloaded xseal-<id>.json
const message = JSON.stringify([
  cert.issuer, cert.sealId, cert.sha256, cert.filename, cert.sizeBytes, cert.sealedAt,
]);
const ok = verify(null, Buffer.from(message), publicKeyPem, Buffer.from(signatureB64, "base64"));

Sealing API (Business plan)

Business accounts can seal and verify programmatically. Authenticate with a Bearer API key, POST a file’s SHA-256 hash to the sealing endpoint, and XSeal returns the Seal ID, timestamp and signature as JSON. See the API reference for authentication, every endpoint and copy-paste curl examples.

Manage keys under API keys in your dashboard: give a key a name and press Create API key. The full key is shown once, so copy it straight away; XSeal keeps only a hash of it and cannot show it again. Each key lists its prefix, when it was created and last used, and how many seals it made this month. Revoke a key at any time and requests using it stop working immediately.

Plans & billing

Sealing a file and verifying are free to try. Paid plans raise your monthly sealing limit, and the Business plan unlocks the sealing API; verification is always free. See pricing for the current plans. Paid plans are billed by Website Holding as merchant of record. Self-serve card checkout is not live yet: choose a plan on the pricing page while signed in, your request is recorded, and the team enables the plan on your account. Your dashboard shows your plan and how many seals you have left this month. From 80% of your monthly allowance, the dashboard and the confirmation under each new seal also say how many seals are left, the date the allowance resets (the 1st of next month, UTC) and what the next plan includes. To change or cancel a plan, contact support.

Your account & settings

A free account stores your seal history so you never lose a Seal ID. From your dashboard you can review every seal, open a seal's detail page, download its certificate, and delete seals you no longer need. Find by file locates a seal from the file itself: your browser computes the SHA-256 hash and only the hash is searched, so the file is never uploaded. To change your email or password, or to close your account and remove your data, contact support.

Data & privacy

XSeal stores only hashes and metadata, never file contents; see the privacy policy for details. For anything not covered here, the support team is happy to help.

Frequently asked questions