Verify a wachive export

Applies to Legal- and Firm-tier PDFs, which carry an INTEGRITY VERIFICATION page.

Every Legal-tier export prints a SHA-256 digest of its canonical message stream. A matching digest, recomputed independently, demonstrates the message content in the PDF is unaltered since export.

What the hash covers

The hash is a SHA-256 digest of a canonical JSON array of the exported messages. Each element contains, in export order: id, sender, timestamp (epoch milliseconds), text, kind, deleted, edited. The hash covers message data — not embedded media pixels or PDF layout.

How to re-derive it

  1. Obtain the same message range from the source chat using the wachive extension and its “export canonical stream” debug option (Preferences → Advanced), or reconstruct the JSON per the schema above.
  2. Compute SHA-256 over the UTF-8 bytes of that JSON string:
    • Linux / macOS: sha256sum canonical.json
    • Windows: Get-FileHash canonical.json -Algorithm SHA256
  3. Compare the digest with the one printed on the PDF’s INTEGRITY VERIFICATION page. A match confirms integrity; a mismatch means the content differs from the source.

Certified time (RFC 3161)

If a Time Stamping Authority was configured at export time, a .tsq request file was saved alongside the PDF. Submit it to the TSA —

curl -H "Content-Type: application/timestamp-query" --data-binary @export.tsq https://your-tsa.example/tsr -o response.tsr

— and archive the .tsr response: it binds the export’s hash to TSA-attested time. Validate it with openssl ts -verify.

Questions

Admissibility is always jurisdiction-dependent; the embedded hash supports integrity verification. For verification questions, use the contact form.