--- title: GitHub - letsseal/letsseal: The open standard for... description: Let's Seal is an open-source (Apache-2.0) standard and free platform for cryptographically proving any file is authentic, unaltered, and existed by a specific... canonical: https://daily.dev/posts/github---letsseal-letsseal-the-open-standard-for-proving-any-file-is-real-unaltered-sealed-g0vvpkcnp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub - letsseal/letsseal: The open standard for proving any file is real, unaltered, sealed | daily.dev og:description: Let's Seal is an open-source (Apache-2.0) standard and free platform for cryptographically proving any file is authentic, unaltered, and existed by a specific... og:url: https://daily.dev/posts/github---letsseal-letsseal-the-open-standard-for-proving-any-file-is-real-unaltered-sealed-g0vvpkcnp og:image: https://api.daily.dev/og/posts/G0vVPkcNp.png og:image:alt: GitHub - letsseal/letsseal: The open standard for proving any file is real, unaltered, sealed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub - letsseal/letsseal: The open standard for proving any file is real, unaltered, sealed **[Hacker News](https://daily.dev/sources/hn)** · 12 min read · 1 upvotes · 0 comments ## Summary Let's Seal is an open-source (Apache-2.0) standard and free platform for cryptographically proving any file is authentic, unaltered, and existed by a specific date. Called SEAL (Sealed Evidence Anchored to a Ledger), it embeds proofs natively into each file format — PAdES for PDFs, C2PA for media, XML-DSig for XML, S/MIME for email, and CAdES for arbitrary files. Time anchoring uses Bitcoin via OpenTimestamps, and every seal is written to a public append-only Merkle transparency log (RFC 6962). Verification is always free, offline-capable, and independent of the Let's Seal service. The project positions itself as the 'Let's Encrypt of document proof' — free, open, and run as a public-benefit foundation. It offers a hosted web app, REST API, CLI tool (sealbot), Python and TypeScript SDKs, and full self-hosting support. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the SEAL standard prove a PDF hasn't been altered and when it was created? A SEAL proof embeds a PAdES/X.509 signature directly in the PDF to guarantee byte-for-byte integrity, and anchors a timestamp to a Bitcoin block via OpenTimestamps to prove existence by a certain date. Every seal is also recorded in a public RFC 6962 transparency log with a Bitcoin-anchored root, so the record itself is tamper evident and independently auditable. _daily.dev surfaces standards like this for developers building tamper-proof document verification into their pipelines._ ### What file formats can be sealed with letsseal and how does verification work for each? PDFs use embedded PAdES/X.509 signatures verifiable by any PAdES validator; images, video, and audio use C2PA Content Credentials manifests; XML uses enveloped W3C XML-DSig; email uses S/MIME multipart/signed per RFC 8551; any other file gets a detached CAdES/CMS .sig over its SHA-256; software artifacts and containers use signatures plus in-toto/DSSE attestations for SBOM and SLSA provenance. _developers choosing a file-authenticity approach can compare formats like this on daily.dev before picking a signing pipeline._ ### How can I self-host the letsseal signing and verification engine instead of using the hosted service? Clone the letsseal repository, initialize a certificate authority with ./ca/setup-ca.sh init, run the FastAPI signing-service that holds the intermediate key bound to localhost, then set up the Next.js web app (dashboard, hosted API, verification portal) with npm install, Prisma migrations, and npm run dev. The self-hosted engine runs identical code to the hosted service, with no hosted-only code paths, and you can later swap in a paid AATL or eIDAS .p12 certificate with zero code changes. _engineers evaluating self-hosted document-signing infrastructure track setup details like this on daily.dev._ ## Similar posts on daily.dev - [Microsoft Signing Transparency: Secure Software Supply Chains](https://daily.dev/posts/microsoft-signing-transparency-secure-software-supply-chains-ehtrkz5bh) · Microsoft Azure · 0 upvotes · 0 comments - [AEREDIUM launches AERSeal to end single-key control of smart contracts](https://daily.dev/posts/aeredium-launches-aerseal-to-end-single-key-control-of-smart-contracts-kb4fhonnp) · The Next Web · 0 upvotes · 0 comments - [How to Hack Time, With C2PA](https://daily.dev/posts/how-to-hack-time-with-c2pa-mp4yajqwa) · Lobsters · 0 upvotes · 0 comments - [Open-Source File Storage Platform](https://daily.dev/posts/open-source-file-storage-platform-hgtyc5qfc) · Hacker News · 0 upvotes · 0 comments - [How to Implement PAdES Digital Signatures in .NET for Long-Term PDF Validation](https://daily.dev/posts/how-to-implement-pades-digital-signatures-in-net-for-long-term-pdf-validation-cysaxlqw6) · Syncfusion · 0 upvotes · 0 comments --- Tags: [#javascript](https://daily.dev/tags/javascript) [View this post on daily.dev](https://daily.dev/posts/github---letsseal-letsseal-the-open-standard-for-proving-any-file-is-real-unaltered-sealed-g0vvpkcnp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitHub - letsseal/letsseal: The open standard for proving any file is real, unaltered, sealed","url":"https://daily.dev/posts/github---letsseal-letsseal-the-open-standard-for-proving-any-file-is-real-unaltered-sealed-g0vvpkcnp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/github---letsseal-letsseal-the-open-standard-for-proving-any-file-is-real-unaltered-sealed-g0vvpkcnp"},"datePublished":"2026-07-27T20:44:02.751Z","dateModified":"2026-09-14T06:40:24.166Z","description":"Let's Seal is an open-source (Apache-2.0) standard and free platform for cryptographically proving any file is authentic, unaltered, and existed by a specific...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ce30a0bfd72fe59107108481ee5455a3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ce30a0bfd72fe59107108481ee5455a3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/github---letsseal-letsseal-the-open-standard-for-proving-any-file-is-real-unaltered-sealed-g0vvpkcnp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"javascript","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"GitHub - letsseal/letsseal: The open standard for proving any file is real, unaltered, sealed"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/github---letsseal-letsseal-the-open-standard-for-proving-any-file-is-real-unaltered-sealed-g0vvpkcnp#faq","mainEntity":[{"@type":"Question","name":"How does the SEAL standard prove a PDF hasn't been altered and when it was created?","acceptedAnswer":{"@type":"Answer","text":"A SEAL proof embeds a PAdES/X.509 signature directly in the PDF to guarantee byte-for-byte integrity, and anchors a timestamp to a Bitcoin block via OpenTimestamps to prove existence by a certain date. Every seal is also recorded in a public RFC 6962 transparency log with a Bitcoin-anchored root, so the record itself is tamper evident and independently auditable. daily.dev surfaces standards like this for developers building tamper-proof document verification into their pipelines."}},{"@type":"Question","name":"What file formats can be sealed with letsseal and how does verification work for each?","acceptedAnswer":{"@type":"Answer","text":"PDFs use embedded PAdES/X.509 signatures verifiable by any PAdES validator; images, video, and audio use C2PA Content Credentials manifests; XML uses enveloped W3C XML-DSig; email uses S/MIME multipart/signed per RFC 8551; any other file gets a detached CAdES/CMS .sig over its SHA-256; software artifacts and containers use signatures plus in-toto/DSSE attestations for SBOM and SLSA provenance. developers choosing a file-authenticity approach can compare formats like this on daily.dev before picking a signing pipeline."}},{"@type":"Question","name":"How can I self-host the letsseal signing and verification engine instead of using the hosted service?","acceptedAnswer":{"@type":"Answer","text":"Clone the letsseal repository, initialize a certificate authority with ./ca/setup-ca.sh init, run the FastAPI signing-service that holds the intermediate key bound to localhost, then set up the Next.js web app (dashboard, hosted API, verification portal) with npm install, Prisma migrations, and npm run dev. The self-hosted engine runs identical code to the hosted service, with no hosted-only code paths, and you can later swap in a paid AATL or eIDAS .p12 certificate with zero code changes. engineers evaluating self-hosted document-signing infrastructure track setup details like this on daily.dev."}}]} ```