Verify a Report
Every Locke report carries a SHA-256 integrity digest of its evidence. You can check it yourself, offline, without asking us.
Check a Locke report
- Open the report's HTML file in a text editor and copy the contents of the
<script type="application/json" id="locke-evidence">element into a file namedevidence.json. If you saved the report's JSON evidence file, use that. - Run:
python3 -c "import json,hashlib;d=json.load(open('evidence.json'));print(hashlib.sha256(json.dumps(d,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode()).hexdigest())" - Compare the result with the “Integrity digest” in the report's Integrity & verification section. They should match exactly.
A match proves only that the evidence matches the digest. It is not a digital signature, it does not authenticate the report's rendered figures, and it does not show that the device, its clock or its logs were accurate. The report ID is the generation date (UTC) followed by the first eight characters of the digest, so anyone can reproduce it. Reports are generated on your device and make no network requests. How report metrics are calculated: sonomos.ai/support/locke/reports.
Check an older Sonomos Dashboard Report
Reports made by the earlier Sonomos browser extension were registered with our verification server. Upload one of those PDFs to check it. Locke reports aren't registered, so this checker won't find them: use the steps above.
The checker confirms a PDF is byte-identical to a report the earlier extension registered. It does not confirm that the report's contents are accurate. Your PDF is read in your browser and never uploaded: only its fingerprint is sent.
