Why this exists
Open-source findings get challenged on process, not just substance. If you can show what you saw, when you saw it, and that a captured file hasn't changed since, your work holds up. This tool records an ISO-8601 timestamp and a SHA-256 hash for every entry, and can fingerprint a screenshot or downloaded file so you can later prove the bytes are identical. Pair it with the Pivot Hub as you work a case, and export the log when you're done.
How it works
Type a source URL and an observation, then Add entry — the timestamp and hash are computed for you. To fingerprint a file, choose it and the tool hashes the raw bytes locally with the browser's Web Crypto API; the file itself never leaves your device. Your log is saved in this browser's local storage so it survives a refresh, and Clear log wipes it. Export any time as Markdown (readable), CSV (spreadsheet), or JSON (machine-readable), including your case name and investigator for the record; Import .json appends a previous export. Hashes are reproducible: a note entry's SHA-256 is computed over source|observation|timestamp, a file entry's over the raw bytes, and every entry also carries a chain hash over the previous entry's chain hash, so Verify log (or anyone holding your export) can detect a changed, removed or reordered entry. Timestamps are ISO 8601 in UTC (the trailing Z).
Which free tools capture the page itself?
This logger records what you saw and hashes files you give it, but it does not save web pages. Two free, open-source browser tools do. Capture the page with one of them, then choose the saved file above so its SHA-256 hash and timestamp go into your log.
- SingleFile (AGPL-3.0, by Gildas Lormeau) saves a complete page as one HTML file, in Chrome, Firefox, Edge or Safari SingleFile on GitHub (read 16 Oct 2026). The Firefox add-on was at version 1.31.1, updated 13 Oct 2026 Firefox Add-ons (read 16 Oct 2026). Its optional "add proof of existence" setting links each page's SHA-256 into a blockchain, and other options upload pages to Google Drive or GitHub SingleFile on GitHub (read 16 Oct 2026). Leave those off for sensitive cases and hash the file here instead, which keeps it on your device.
- ArchiveWeb.page (AGPL-3.0, from Webrecorder) records pages as you browse, in Chrome or a desktop app ArchiveWeb.page (read 16 Oct 2026). It exports WARC or WACZ web-archive files, which replay in ReplayWeb.page ArchiveWeb.page docs (read 16 Oct 2026). Archives stay in the browser unless you choose to share them over IPFS, a peer-to-peer network ArchiveWeb.page privacy policy (28 May 2026). Hash the downloaded WACZ here.
A simple routine: capture the page, hash the saved file, then add a note with the source URL and what it shows. If the page changes later, capture and log it again, so each version has its own entry.
16 Oct 2026 — added SingleFile and ArchiveWeb.page as capture options that pair with this log.
Frequently Asked Questions
How does this help with chain of custody?
Each finding gets an automatic ISO-8601 timestamp and a SHA-256 hash of the entry, giving a tamper-evident record of what you saw and when. Hash an uploaded file to fingerprint a screenshot or artifact, and export the log as documentation you can attach to a case.
Is my evidence uploaded anywhere?
No. Everything runs in your browser, hashing is done locally with the Web Crypto API, files never leave your device, and the log lives only in this browser's local storage. There's no account and no server.
What is a SHA-256 hash?
A fixed 64-character fingerprint of any input; identical input always gives the same hash, and any change gives a completely different one. Recording a file's hash at collection lets you later prove it hasn't been altered.