# Independent verification (IdeaProofNow)

The goal is not that you trust IdeaProofNow forever. The goal is a proof you can check without depending only on our UI.

中文版：[/VERIFY.zh-CN.md](https://ideaproofnow.com/VERIFY.zh-CN.md) · 官方定义：[/en/press](https://ideaproofnow.com/en/press) · [/zh-cn/press](https://ideaproofnow.com/zh-cn/press)

## What a stamp records

1. **SHA-256** of the exact bytes (usually computed in your browser; we store the digest, not the file).
2. **Server time (UTC)** when the stamp completed.
3. An entry in the **public operations log** for that UTC calendar day.
4. A **daily Merkle root** over that day’s digests.
5. **OpenTimestamps** proofs that can mature into a **Bitcoin block** reference (per certificate and/or the day’s root).

## Quick checks on the website (free, no login)

1. Open [https://ideaproofnow.com/verify](https://ideaproofnow.com/verify).
2. Drop a **proof package JSON**, and optionally the same original file.
3. Or enter a certificate ID / drop a file / paste text to recompute SHA-256.
4. Confirm digest, Merkle inclusion, published day root, stamp time, and Bitcoin / OTS status.

Package checks (schema, file hash, Merkle path, day-root match) run **in your browser**. The original file is not uploaded for those checks.

## Offline CLI (zero dependencies)

Download: [https://ideaproofnow.com/verifier/verify-proof.mjs](https://ideaproofnow.com/verifier/verify-proof.mjs)

```bash
node verify-proof.mjs IdeaProofNow-IP-….json
node verify-proof.mjs IdeaProofNow-IP-….json ./original-file.bin
```

Or from this repository:

```bash
npm run verify-proof -- path/to/package.json [path/to/file]
```

The script only uses Node’s built-in `crypto` module.

## Download your evidence package

For certificate `IP-…`:

```text
GET https://ideaproofnow.com/api/proofs/{id}/package
```

This JSON includes:

- certificate metadata + SHA-256  
- server UTC time  
- Bitcoin / OpenTimestamps download URL (when available)  
- **Merkle inclusion path** from your leaf to that day’s root (when the day log exists)

Also download:

- Certificate `.ots`: `/api/ots/{id}`  
- Day-root `.ots`: `/api/transparency/{YYYY-MM-DD}/ots`

Keep a **byte-identical** original next to this package. If the file changes by one byte, the digest will not match.

## Verify a Merkle inclusion offline

Given `leaf`, `path[]`, and `root` from the package:

1. Start with `current = leaf` (hex → bytes).
2. For each step, if `position` is `left`, hash `SHA-256(sibling || current)`; if `right`, hash `SHA-256(current || sibling)`.
3. The final digest must equal `root`.
4. Compare `root` to the published root for that day on `/transparency/{day}` (or the package field).

Leaves for a day are **sorted lexicographically** before the tree is built (see `src/lib/merkle.ts`). Odd nodes are paired with themselves.

## Verify the Bitcoin / OpenTimestamps proof

1. Download the `.ots` file.
2. Use the official OpenTimestamps clients: [https://opentimestamps.org](https://opentimestamps.org)
3. Confirm the digest the proof attests matches your file’s SHA-256 (certificate proof) or the day’s Merkle root (day proof).

## Public log without originals

The operations log publishes certificate IDs, times, and digests — **not** your source file. Machine-readable daily roots: [https://ideaproofnow.com/transparency.json](https://ideaproofnow.com/transparency.json). HTML: [/en/transparency](https://ideaproofnow.com/en/transparency).

IdeaProofNow (ideaproofnow.com) is a SHA-256 file-timestamp product. It is **not** the startup-idea validator at ideaproof.io.

## Philosophy

> Your proof should not disappear if we do.

Create on IdeaProofNow when convenient. Keep the package, the `.ots`, and your original. Verify on our site, with the CLI, or with independent tools.