Skip to main content
Prove you wrote the code. Truthlocks creates cryptographic attestations for source code, APIs, documentation, and other digital assets. Protect your intellectual property with SHA-256 hashing and timestamped proof — all without your source code ever leaving your machine.

Why Code Authorship Matters

  • IP disputes: Prove you wrote the code before someone else claims it. Timestamped cryptographic proof is admissible evidence.
  • Open source protection: Protect your contributions before publishing. If someone forks and claims ownership, you have proof.
  • Contract work: Prove delivery dates and authorship to clients with independently verifiable attestations.
  • Portfolio verification: Prospective employers or clients can verify your claimed work is genuinely yours.

How It Works

1

Hash your code locally

Compute SHA-256 of your source file, repository archive, or any artifact. The file content never leaves your machine.
2

Submit the hash

Send the hash, title, and metadata to the Truthlocks API. An attestation is created with your personal signing key.
3

Anchor to transparency log

The attestation is anchored to an append-only, RFC 6962-compatible transparency log with an immutable timestamp.
4

Share the proof

Get a shareable proof URL, embeddable badge, or downloadable certificate.

Protect a Single File (CLI / API)

Hash a source file and submit the attestation:

Protect an Entire Repository

Create a deterministic archive of your repo and hash it:
Use git archive instead of zipping the directory — it produces deterministic output regardless of filesystem metadata, making the hash reproducible.

Examples

CI/CD Integration

Automate code protection in your CI pipeline. Protect every release:
GitHub Actions

Add a Badge to Your README

Show verification status directly in your repository:
Markdown
The badge dynamically shows verification status and is cached for performance. Replace ATTESTATION_ID with the ID returned from the mint endpoint.

Verification

Anyone can independently verify your code authorship:
  1. Hash the original file with SHA-256 (same algorithm used during protection).
  2. Visit the proof URL or call POST /v1/verify with the attestation ID.
  3. The system confirms the hash matches, verifies the cryptographic signature, and checks the transparency log anchor.

Security Guarantees

  • Zero-knowledge: Only the hash is transmitted — your source code never leaves your machine.
  • Tamper-proof: Attestations are anchored to an append-only transparency log. Altering the record would break the Merkle tree.
  • Non-repudiable: Each attestation is signed with your personal Ed25519 key. Only you could have created it.
  • Independently verifiable: Proof can be verified without Truthlocks involvement — anyone can check the hash, signature, and log anchor.