Understanding your records
Know what your
export verifies.
A snapshot fingerprint, a PDF fingerprint, and an independent timestamp answer different questions. Here is how to check each one.
Snapshot
Does the stored data reproduce the fingerprint printed on the export?
PDF file
Do the exact bytes of the PDF you received match the original exported file?
Timestamp
Is there verified independent evidence that the snapshot fingerprint existed by a stated time?
Start with the link on the PDF
- Open the verification URL printed on the cover. You do not need a Mellow account.
- Look for Snapshot match, then compare the export date, included sections and message-chain status with the document you received. The page checks the stored snapshot; it does not inspect a file on your device.
- To check the PDF itself, calculate its SHA-256 fingerprint locally and compare it with Expected PDF SHA-256 on the verification page, when available.
Calculate a PDF fingerprint on your computer
Replace the example filename with your PDF. These commands read the local file without uploading it.
Windows PowerShell
Get-FileHash -Algorithm SHA256 -LiteralPath "record.pdf"macOS
shasum -a 256 "record.pdf"Linux
sha256sum "record.pdf"A mismatch means the file bytes differ. Saving, annotating or printing a new PDF can change them; obtain the original before drawing conclusions.
Read timestamp evidence separately
The export’s timestamp section reports whether its independent timestamp was verified. A successfully verified timestamp supports that the snapshot fingerprint existed by the stated time. An unavailable or unverified timestamp must not be treated as verified. A snapshot match alone is not a timestamp check.
Message-chain status describes the chain material included in that snapshot. It does not establish that every statement is true or that every relevant record was selected.
Verify the timestamp on your computer
Ask the export creator for the Timestamp evidence JSON from their completed export. It contains private records. Keep it local and share it only with authorized reviewers.
- Install Node.js 20 or later and OpenSSL 3.x. Review the script before running it. It uses no additional packages and makes no network requests.
- Save both downloads below in the same folder. Keep the certificate filename
digicert-trusted-root-g4.pem. Check its SHA-256 certificate fingerprint against the DigiCert Trusted Root G4 entry in DigiCert’s published root list. Never substitute a root just because it was included in an evidence file. - Open a terminal in that folder and run the command below, replacing the example filenames. The PDF is optional and is checked separately.
node verify-export.mjs "evidence.json" "record.pdf"The timestamp check verifies the snapshot fingerprint, signed timestamp response and request, signer, trusted certificate chain, and preserved revocation evidence. The revocation check refers to the recorded validation time; it is not a current lookup. A failure or incomplete check must not be treated as verified.
A matching PDF result compares its bytes with the separate server-recorded PDF hash. That comparison is not covered by the snapshot timestamp. Evidence files larger than 64 MiB are not supported by this script. Legacy manifests may require their original runtime for fingerprint comparison.
If OpenSSL is installed outside your PATH, set OPENSSL_BIN to its executable location. This command displays the certificate fingerprint for comparison with DigiCert’s list:
openssl x509 -in digicert-trusted-root-g4.pem -noout -fingerprint -sha256Check the manifest independently
The export creator can download the manifest JSON from their export results and share it with an authorized reviewer. That file contains private records. Keep it local and use a secure method if you share it.
Our downloadable script uses Node.js 20 or later, has no package dependencies, and makes no network requests. It calculates the snapshot fingerprint from the JSON you supply. You can inspect its source before running it.
Download verification scriptnode verify-manifest.mjs "manifest.json"Compare the printed fingerprint with the one on the PDF. Optionally add the expected 64-character fingerprint to the command to receive a MATCH or DOES NOT MATCH result.
Manifest format and ordering rules
New exports use mellow-family-export-manifest/v3. The format includes the family-space snapshot, participant names, export time, requester, date range, selected modules, records and chain status.
- Sort each object’s keys in ascending UTF-16 code-unit order, independent of language or locale. Preserve array order exactly.
- Serialize strings, booleans, finite numbers and null using JavaScript JSON.stringify rules. Do not normalize Unicode, rewrite dates, round values, or add insignificant whitespace.
- Omit undefined object properties before storage; undefined array items and other non-JSON values are rejected. Downloaded JSON contains no undefined values.
- Encode the serialized text as UTF-8 with no byte-order mark or trailing newline, then calculate lowercase hexadecimal SHA-256.
Versions 1 and 2 used locale-sensitive key ordering. Their original verification path is preserved; their fingerprints are never silently converted to version 3. The script warns when checking these older formats. A differing locale or runtime may produce a mismatch; compare the PDF fingerprint or contact support for help.
This is Mellow Family’s versioned format, not a claim of compliance with another JSON canonicalization standard. Attachment entries describe files and their recorded checksums; the manifest does not contain attachment bytes.
Verification does not prove the truth of a statement, the identity of a person, or a legal outcome. Courts and other recipients decide how to evaluate the records.
Need help with a result? Contact support@mellow.family. See a sample export.