Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“if you don't forget your master password, you are good”

Checks (re-run on this request)

• ✓ Signature — Ed25519 signature over the record hash, verified against the public key at /.well-known/citatio-signing.json
• ✓ Merkle inclusion — Leaf recomputed through the sibling path to the anchored root
• ✓ Public transparency log — Sigstore Rekor log index 3199173952

Proof data

Record hash (SHA-256)

31307e24f9b5d6eddd185f668594fe5689e68ee6d5e1274d468c5c36b52f374b

Signature (Ed25519, base64)

j41r89nJr91PXmH96kdh/eoM2tpJuFoANaw+4kGM7NINRWftH9KW6UzqSeLSnrmRr6ViOnyOmHkzqmLKgXPaDg==

Merkle root

ffbc979c8901fdf55f43c5151768b18a738fc1c271c9b2dc97349c3fa8ed35d2

Merkle path

["3133abc62a94a683e0b96c4d55cb3980fa5b61107893bd43804bc6379bd62cd2","f57c3b23ccb5be14ab27b779f0b8ae382ae7f6736aeb231cf498efc2a2a849af","96de796cacdbf8280b7847a32d05b50fd1624a39330e2747d23c76bf797c61c8","745bdcc8c649c8fa080e6d7648ea04655ca354f9ff0f0eb5633de5757c2787b5","157490c3348def059e3ec0c871ff9b549142071bbf9c1a299105b14b1cd17fb4","64ab40a257cdbb0b85cb0381582505131a68f8f581cd13c00a53e6ef6c29968a","40c930c4952d4577ebd12ea54030f5c701f5bf2a548c8b8610c7283cba5145e0","2e4c148eee90f5fe54816d6f5d4e1fae09c1172ab2572259c655a37c029caf1d","3de9a46b8ddda904dd211d4997aa23d90b068fb9bb4e800b9586961991aa9c6d","b36edab723caaacf652a98364cb5b5c80ecb3e3db537d01627a6448fe8d1ae7a","93e9ef4d70b0bfde7627411de1f2a7b2718f2effde73028a86eb469cb3475c49","7db894157ed9dabb03cb2365fb7f1c3175f5c464a5f6fd3024b83b95573cd6d5","81757bca5afdb109f23b2b1ab2e08f434f626af25e986d2585973e2409a82e36","2f35432083547a52411b4b8128ab118601abc6a6e158a38894add0923255dc0e"]

Anchored

2026-10-11

Public log entry

search.sigstore.dev, log index 3199173952 · entry 108e9186e8c5677a85d2…

Expected log hash

3bc66074c7b0a853326bf5ba0590a111eee6455dac5c98c791c22eeea9a48920 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.

Canonical record

{"dataset_version":"v1791689192448","kind":"published-quote","locale":"en","page":"brand:nordpass","quote":"if you don't forget your master password, you are good","rating":4,"review_date":"2025-12-08","source":"Google Play","source_url":"https://play.google.com/store/apps/details?id=com.nordpass.android.app.password.manager","v":1}

Verify in the public log

1. Open the Rekor entry (pre-filled with this proof's log index).
2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (ffbc979c8901…), which ties this proof's root to the log entry.
3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.