Does this match what was sealed?

Drop a stamped image below. We read the QR code in the corner, hash the file in your browser, and tell you whether the bytes (or, if the file was re-encoded by a platform, the perceptual hash) still match what the receipt was sealed against.

Drop a sealed image

we read the QR, hash the file in this tab, and tell you in under a second

Nothing is uploaded. Your browser reads the QR code embedded in the image, hashes the file locally, and sends only the 32-byte hash to compare against our records.

Six possible outcomes, ranked strongest to weakest

what /api/verify can return

✓ identical

SHA-256 byte-for-byte match. Same file you sealed. Strongest possible verdict.

✓ recompressed copy

Bytes differ but pHash ≤ 6 AND dHash ≤ 9. Both perceptual algorithms agree this is the sealed image after a platform pipeline re-encoded it (Twitter / WhatsApp / Instagram / Telegram round-trip).

⚠ similar but modified

pHash 7–14 AND dHash 10–16. Cropped, brightness/contrast adjusted, screenshot-of-screenshot, or an edit that touched a region. Same source, but modified.

✗ QR is real, image is not

Both perceptual distances ≥ 25 bits. QR points to a genuine signed receipt, but the image content is unrelated. Lazy-trust attack: someone pasted a real QR onto a fake.

✗ does not match

Falls outside the three perceptual bands above (or the receipt was sealed without perceptual hashes). The image isn't a recognizable derivative of what was sealed.

? receipt not found

QR points to a receipt we have no record of — possibly a hand-edited or fake QR.

Perceptual hashes (pHash + dHash) are not cryptographic — a motivated attacker can construct a colliding image. They're presented alongside the cryptographic SHA verdict as a stronger heuristic for the most common real case (platform recompression), never instead of it.

Don't have a stamped image to test? Seal a screenshot first, then come back here and drop the stamped result.