Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I converted from using LastPass after they had so many breaches”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
4e25e1071cdb2c836c5fc6fc9d2865be00898cfdc1f463feb9f0f93ac728b169
Signature (Ed25519, base64)
vP46Tu/2SRXDRPWlomEwVynZXegi2RIqx0yUwPn0hKpVOrJ0o/ukjjo8HcMd40LqpKKlf0ny3eO/wq+qTJ4dCA==
Merkle root
199738dc68b66dcf66f6b0cc77e2cba74c3bfda88989684620837b4c4e64818e
Merkle path
["4e26df02360741146c111a764ce9a1f113bcdf4ca84450692f6bdc12f72bc8e0","031880d1ea7e439c3d880aa4d0a2f0c1c14340317c60c4592a346d824a669ee4","5ed56a02b59b8e924cf18c9ecce615c0d01ce5c8543f956f558d558c51ac232d","b5d9cd2fabbc9bff926c66eec5a5bc2e8a5b3f61690a1d1f996d17a33b01a4a9","a3b2f06a50c2bd5d17897f6797fbd08e3ebaa5164ce4e3b6a8ce1034eb867826","bbd10656930501f3ec01258690f8a5e1e10a39a508abd5284281df614c5ea771","9832c140b078aee7da21e363bed4669c10c20770a385d18cbd3f7c30237ef4a6","f9059842f0eff40f75c83d4cd2cc7ce15ff32c03fe790777ea1179043408d3ca","4ff25e61a48ac5bcae362fb44f2c5e835e4661c0ad3bceebd44c184700fde70a","11cb049d89781be490ec7fdc52a0690dca680fff2212edc38ad3eaf4546c9796","4819cbbd871abf60ec554a51473e2bc17ce4d8ef355170e3a704c7ca1cd1c9ef","793a0a113c6896c3097aa5fd875e658514ad3a060dcb3a5d23abdc1b4da18d9b","5dc6942b342fad0953fd3ad3bc002a6e4d6bf8c4ba6db81c1c43744a0d2c9996","ddc8a66e59fc8f0934334cf08e419f621290129e658cbc58d8ec27bafd90b0af"]
Anchored
2026-10-11
Public log entry
search.sigstore.dev, log index 3198797320 · entry 108e9186e8c5677a14ba…
Expected log hash
46227e67415cdf5b62c43420eb8b7a80b35acaa912410c2711787f678b77c9c9 The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791687727006","kind":"published-quote","locale":"en","page":"theme:bitwarden/returns/en","quote":"I converted from using LastPass after they had so many breaches","rating":5,"review_date":"2026-01-03","source":"Apple App Store","source_url":"https://apps.apple.com/us/app/id1137397744?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (199738dc68b6…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.