Trust / Verification

Do not just trust Kiroku. Verify the record yourself.

Saved-file hashes and third-party RFC 3161 timestamps can be checked without Kiroku's interface or servers. This page publishes the scope, limits, commands, and a working test vector.

Match saved files with SHA-256DigiCert RFC 3161 time proofVerify the ZIP outside Kiroku

capture-manifest.jsonRFC 3161

originals/archive.html

SHA-256

capture-manifest.json

fd3915a6ea7b8132

timestamp-response.tsr

DigiCert RFC3161

independent verification

OpenSSL

Public test vector

A real sample Evidence Pack you can verify

This ZIP was produced from a synthetic verification page containing no customer or third-party data. It includes the production-style file structure, hashes, timestamp request and response, and a verification script.

Download the sample ZIP View ZIP SHA-256 Open the sample source page

This is a synthetic demonstration of the mechanism. It is not evidence of a real-world dispute or event.

kiroku-sample-evidence-pack.zip

Evidence Pack public sample

Timestamp authority: DigiCert RFC3161
TSA time: Jul 30, 2026, 5:06:57 AM UTC
ZIP size: 85.2 kB
ZIP SHA-256: fb0e41d1286058df29830994599fd6e2d4afc7eab276144b6f4045e8f5da3ae1

From capture to verification

The proof lives in the relationship between files, not in a screen claim.

1
1. Preserved files
Kiroku stores the HTML and screenshot and calculates SHA-256 over their exact bytes.
2
2. Capture Manifest
The source URL, capture time, filenames, sizes, and hashes are fixed in one JSON document.
3
3. External timestamp
The manifest hash is sent to DigiCert's TSA, which returns a signed RFC 3161 response.
4
4. Evidence Pack
The originals, manifest, timestamp response, readable PDF, and instructions are placed in one ZIP.

About two minutes

Verify the sample

Run these commands from the extracted pack directory. They use Python 3 and OpenSSL and do not contact a Kiroku API.

Check the downloaded ZIP

Compare the ZIP's SHA-256 with the value published on this page.

openssl dgst -sha256 kiroku-sample-evidence-pack.zip
# expected: fb0e41d1286058df29830994599fd6e2d4afc7eab276144b6f4045e8f5da3ae1

2
Extract the ZIP
Move into the root directory containing START-HERE.txt and the verification files.
```
unzip kiroku-sample-evidence-pack.zip
cd kiroku-sample-evidence-pack
```
3
Verify originals and timestamp
The bundled script checks each original's size and hash, then validates the RFC 3161 response.
```
python3 verification/verify-sample.py
```

Verify directly with OpenSSL

You can validate the timestamp response with a standard command instead of the script.

openssl ts -verify \
  -data verification/capture-manifest.json \
  -in verification/timestamp-response.tsr \
  -CAfile verification/digicert-tsa-ca-bundle.pem

A successful run reports two matching saved files followed by “Verification: OK.”

For high-stakes review, verify the root certificate independently

The sample includes a DigiCert certificate bundle for convenience. In a strict verification workflow, obtain the trust anchor independently from DigiCert's official repository and compare its fingerprint. Blindly trusting a certificate shipped inside the same ZIP is not independent verification.

DigiCert certificate repository RFC 3161 specification

What this can verify

The exact Capture Manifest bytes existed no later than the TSA time
The hashes recorded in the manifest match the files in your possession
The timestamp response validates against a DigiCert chain you trust
If checksums.sha256 is preserved separately, accidental changes after export can be detected

What it does not prove by itself

That statements on the original page were factually true
The identity or intent of the person who saved or published the page
That gated, regional, or dynamic content was captured without omission
Admissibility or evidentiary weight in a particular court or jurisdiction

Treat saved HTML as an untrusted file

Archived HTML can contain links or behavior inherited from the source site. Open sandboxed originals/review.html first and avoid opening originals/archive.html directly. The PDF and screenshot are safer starting points for content review.

Operator and data handling

Trust also requires a visible operator and clear publication boundaries.

Operator

Kiroku.today is operated by Kuuloa LLC in the United States. Its address and entity information are public.

Company overview

Visibility

Free saves are public and may be indexed. Choose a private Pro save before submitting sensitive material.

Rights and removal

Kiroku publishes a removal-request channel for rights holders and the terms governing use of the service.

Removal request

How to use this record

Kiroku preserves and organizes digital records so they are easier to explain and verify later. It does not provide legal advice, notarization, or a guarantee of admissibility. Capture important material early and consult qualified counsel when the stakes require it.

See the Evidence Pack structure Save a web page