Quote verification

This proves the quote below is recorded by Citatio exactly as displayed and has not been altered since it was committed and anchored. It documents Citatio's crawl observation; it does not imply endorsement by the source platform. The quote links to the original review.

“I was hacked and chose this manager.”

Checks (re-run on this request)

Proof data

Record hash (SHA-256)
b00a6510837b0a87d71792bbd11cca034bf7bdb2f7a6c20c2966ffbad73a33f9
Signature (Ed25519, base64)
DmIr8xGD2XXhbMxHfbXHswtGCN02Yf2I1Qb9sq1YxwwSoDJiJJAbMuUq1VBfnaV9ftTwGjReTlJxUt7sET6aCA==
Merkle root
92de3fc6370869ec6c1d0482494ff1816d45e719fbf27ec8d8d02933c2b7c658
Merkle path
["b00d8bc827ef59437207e5532790915913b2377b6226fc1f83ea587b1536af7e","e91de81b18dfc2051e8a4de6c608891cb8c04d0fb6dc18d419542ca6e2df7ff6","6a9fa0f4523ab55360cceff88c9e873d3b9a6ee289aa2b82679c8d381604fa9f","50fc9bdc1e0e5325df1803925d8e0e6b17ecbda3630fc504484bc0f29ac69d20","06a8c402544e01f8b91857948e669955bdd80898034346d30832ee865a2a5f8c","afb668b091e23eb8937ed2f7644ad010fd01e31ba24711931adc5a922603d397","784c78a731fea3ca54048b7d0f1b6d9780d71e3f549efe50e34926b411c35f27","c9a538980ffa8c8ab9f25e48126c0aad42266836fff7d00747d41a67933d68ce","48afb922ee248a921df7ff1f5c5f31d11b16d2123f641521162e3a45ac0716e7","306cb1bfd4dc0abdbfc7932e93a714d678c136d8383cd344b10b07cb46e64077","c44bab9c1715054d73e2ae07d998d194dd3e7b006e1b772eba2956e87de6969c","6ad134ff077707cebebcc904fd4992ccec683fcca97d611ed8671333ac1847af","eaec115b999ce4f56ac9da9af02e783a3380be0a3b796355a5f877302796ed54","a7351db54bb74f5f5ac28186d9fd23b3f96813c66df528665fc553ab2f8966d7","c3a054d0149b6ba893c9f6835a95f324a05e1406f9665c11f96203fe902ebfba"]
Anchored
2026-10-06
Public log entry
search.sigstore.dev, log index 3102753131 · entry 108e9186e8c5677a9761…
Expected log hash
5cca28352ab3a467a358005e8b17999e96a5be0f2e71c2152bf575d4cd8c238a The log entry's spec.data.hash.value must equal this value: the SHA-256 of the Merkle root string above. Recompute it yourself from the root to confirm.
Canonical record
{"dataset_version":"v1791264491480","kind":"published-quote","locale":"en","page":"brand:nordpass","quote":"I was hacked and chose this manager.","rating":3,"review_date":"2026-10-02","source":"Apple App Store","source_url":"https://apps.apple.com/us/app/id1486322860?see-all=reviews","v":1}

Verify in the public log

  1. Open the Rekor entry (pre-filled with this proof's log index).
  2. In the entry, compare spec.data.hash.value with the "Expected log hash" above: it is the SHA-256 of the Merkle root string (92de3fc63708…), which ties this proof's root to the log entry.
  3. Decode spec.signature.publicKey.content from base64: it must equal Citatio's published key at /.well-known/citatio-signing.json.
  4. The entry's integratedTime is the independent timestamp: the root, and with it this quote, existed no later than that moment.
  5. Locally, without any Citatio infrastructure: SHA-256 the canonical record (must equal the record hash), verify the Ed25519 signature against the public key, and fold the hash through the Merkle path (sorted-pair SHA-256) to reach the anchored root.