Why Code Authorship Matters
- IP disputes: Prove you wrote the code before someone else claims it. Timestamped cryptographic proof is admissible evidence.
- Open source protection: Protect your contributions before publishing. If someone forks and claims ownership, you have proof.
- Contract work: Prove delivery dates and authorship to clients with independently verifiable attestations.
- Portfolio verification: Prospective employers or clients can verify your claimed work is genuinely yours.
How It Works
1
Hash your code locally
Compute SHA-256 of your source file, repository archive, or any artifact.
The file content never leaves your machine.
2
Submit the hash
Send the hash, title, and metadata to the Truthlocks API. An attestation is
created with your personal signing key.
3
Anchor to transparency log
The attestation is anchored to an append-only, RFC 6962-compatible
transparency log with an immutable timestamp.
4
Share the proof
Get a shareable proof URL, embeddable badge, or downloadable certificate.
Protect a Single File (CLI / API)
Hash a source file and submit the attestation:Protect an Entire Repository
Create a deterministic archive of your repo and hash it:Examples
CI/CD Integration
Automate code protection in your CI pipeline. Protect every release:GitHub Actions
Add a Badge to Your README
Show verification status directly in your repository:Markdown
ATTESTATION_ID with the ID returned from the mint endpoint.
Verification
Anyone can independently verify your code authorship:- Hash the original file with SHA-256 (same algorithm used during protection).
- Visit the proof URL or call
POST /v1/verifywith the attestation ID. - The system confirms the hash matches, verifies the cryptographic signature, and checks the transparency log anchor.
Security Guarantees
- Zero-knowledge: Only the hash is transmitted — your source code never leaves your machine.
- Tamper-proof: Attestations are anchored to an append-only transparency log. Altering the record would break the Merkle tree.
- Non-repudiable: Each attestation is signed with your personal Ed25519 key. Only you could have created it.
- Independently verifiable: Proof can be verified without Truthlocks involvement — anyone can check the hash, signature, and log anchor.

