bits

2026-10-15T00:00:00Z

Text down to its UTF-8 bytes, and bytes back to text.

seal

2026-10-15T00:00:00Z

Text sealed with a passphrase, in the browser.

sum

2026-10-15T00:00:00Z

Checksums of files and text, compared with the ones you were given.

Same bytes

2026-09-27T00:00:00Z

Every release writes a manifest. It lists the sha256 of each published file, one per line, sorted by path, which is the format shasum -c reads. Mirror the site, run it against the manifest, and you find out whether your copy is the one I shipped.

The sha256 of the manifest goes on the colophon, one line per release, because a single hash is short enough to paste into a message or read out loud.

Mostly it catches me. The failure I actually worry about is a deploy that quietly keeps serving the previous build, since from the machine that ran it everything looks correct. A file left over from something I deleted is the same problem in a smaller size.

The other reason is dates. Anyone can put a date on a page and change it later, me included, so the one on this note proves very little by itself. A hash that turned up in somebody else's archive on the day it was published takes more work to rewrite.

shxtrk.dev

bits

seal

sum

Same bytes