Verify the integrity of any published IIC file

Verify in your browser

Drop any published IIC file below. Verification runs entirely on your device — nothing is uploaded.

Every file listed in the manifest below can be checked here, including the generator, the Wallet viewer and its service worker, and the SHA256SUMS files. Verification is by content: a file renamed by your browser still verifies.

Published release manifest

These are the cryptographic fingerprints of the published IIC releases. Compare locally-computed hashes against these values. The v9.0 entries are retained: a file issued under that release remains verifiable here.

0. v10.0.1 release package — anchored digest

This covers the eleven-file release package. The seventeen-file Complete Package has its own manifest and its own anchor, in section 1 below.

This is the digest committed to Bitcoin and Ethereum for v10.0.1. It is the digest of SHA256SUMS, not of any archive: a ZIP embeds timestamps and compression choices that differ between runs, so its digest cannot be reproduced and proves nothing about the contents. Verify the package with shasum -c SHA256SUMS, then check this value. Anchored on Bitcoin at block 961512 (8 Aug 2026, 00:36:47 UTC) and on Ethereum at block 25704773 (7 Aug 2026, 18:06:47 UTC). The Ethereum leg precedes the Bitcoin leg by six hours; the two chains are batched independently and that ordering is normal. The v10.0 release package was anchored a day earlier, at Bitcoin block 961351 and Ethereum block 25701188. Times are block times in UTC, read from the explorers; OriginStamp certificates render them in local time.

0b. IIC generator v10.0.1 — current

Not downloadable from this site. The generator is supplied under controlled onboarding; this fingerprint lets a recipient confirm the file they hold is the published build. A modified copy no longer matches it and cannot be verified by anyone.

0c. IIC generator v10.0 — superseded

Retained: a card issued by this build remains verifiable, and the fingerprint remains evidence of what was published.

1. Complete Package v10.0.1 — manifest and archive

The Complete Package is not downloadable from this site. It contains the generator and the Wallet, neither of which is published; access is granted through the controlled onboarding process described in the documentation. A request for the archive URL therefore returns 404, by design and not through a broken link. The digests above are published so that anyone who receives the archive through that process can verify it independently, without contacting the issuer.

Two different claims, deliberately separated. The manifest digest is anchored on both chains and each of the seventeen files is verifiable against it with shasum -c SHA256SUMS. The archive digest is not anchored and never will be: a ZIP embeds timestamps and compression choices that vary between runs, so it cannot be reproduced. It is published for one purpose only — to confirm that a copy received through onboarding arrived without corruption.

Neither file is downloadable from this site. The Complete Package contains the generator, which is not publicly distributed. The v9.0 archive was withdrawn for the same reason; its digest remains in the anchor timeline below, where it documents a historic state without inviting a download.

2. User Guide

3. Wallet User Guide

4. Technical Specification

5. Engineering Specification

6. Threat Model

7. Defensive Publication — Multi-Zone Canonical Neutralization (v2)

8. Defensive Publication — In-File Stapled Freshness

Files inside the Complete Package are individually listed in its SHA256SUMS file; the generator file is internet-identity-card-v9.html, SHA-256 17aea67549cdf0214c04e9c89b0849efe08e74d3632efe2bc78d32fbe93f5bfc.

ECDSA P-256 public key (Base64-encoded)

Used to verify the ECDSA signature of the Complete Package ZIP.

Verify from your terminal

Prefer the command line? Compute the SHA-256 of the file you downloaded and compare with the published hash above.

macOS / Linux

# Holding the Complete Package: verify all seventeen files at once,
# then check the manifest against the anchored digest in section 1.
shasum -c SHA256SUMS
shasum -a 256 SHA256SUMS

# Any single published file:
shasum -a 256 internet-identity-card-v10.0.1.html
shasum -a 256 IIC-User-Guide-v10.0.pdf
shasum -a 256 IIC-Technical-Specification-v10.0.pdf
shasum -a 256 IIC-Engineering-Specification-v10.0.pdf
shasum -a 256 IIC-Threat-Model-v10.0.pdf
shasum -a 256 IIC-Wallet-User-Guide-v1.0-r5.pdf
shasum -a 256 IIC-Defensive-Publication-MultiZone-v2.pdf
shasum -a 256 IIC-Defensive-Publication-StapledFreshness.pdf

Windows (PowerShell)

Get-FileHash SHA256SUMS -Algorithm SHA256
Get-FileHash internet-identity-card-v10.0.1.html -Algorithm SHA256
Get-FileHash IIC-User-Guide-v10.0.pdf -Algorithm SHA256
Get-FileHash IIC-Technical-Specification-v10.0.pdf -Algorithm SHA256
Get-FileHash IIC-Engineering-Specification-v10.0.pdf -Algorithm SHA256
Get-FileHash IIC-Threat-Model-v10.0.pdf -Algorithm SHA256
Get-FileHash IIC-Wallet-User-Guide-v1.0-r5.pdf -Algorithm SHA256
Get-FileHash IIC-Defensive-Publication-MultiZone-v2.pdf -Algorithm SHA256
Get-FileHash IIC-Defensive-Publication-StapledFreshness.pdf -Algorithm SHA256

PowerShell has no equivalent of shasum -c. On Windows, check the manifest digest above, then compare each file individually against the values in section 1.

If the computed hash exactly matches the published value above, the file is bit-for-bit identical to the published release (integrity verified).

What this verification provides

A successful match between your locally-computed SHA-256 hash and the published value provides:

• Integrity — the file is bit-for-bit identical to the published release
• Tamper detection — any modification to the file (even a single bit) would change the SHA-256 hash entirely
• Source consistency — the file you have is the same one published by Https Card — Internet Identity Card Ltd

For the Complete Package ZIP, an additional ECDSA P-256 signature can be verified against the published public key. The signature provides cryptographic evidence that the release was issued by the holder of the corresponding private key, assuming the public key has been obtained from a trusted source.

Independent timestamping (BTC + ETH) — anchor timeline

Every release is anchored on the Bitcoin and Ethereum blockchains via OriginStamp, and additionally on Bitcoin via OpenTimestamps. Anchors are cumulative: superseding a release never removes the proof that its predecessor existed. The complete chronology:

Defensive publications

The cryptographic architecture verified here is disclosed as open prior art on Technical Disclosure Commons, released under the Creative Commons Attribution 4.0 license:

• TDCommons #10079 — Cryptographic Identity Document System Using TOTP-Derived Symmetric Keys (12 May 2026)
• TDCommons #10167 — Self-Verifying Single-File Cryptographic Documents with Dual-Passphrase Architecture (19 May 2026)
• TDCommons #10394 — Composite Defense-in-Depth Architecture for Self-Verifying Cryptographic Documents and Their Optional Offline Launchers (8 June 2026)
• TDCommons #10795 — Multi-Zone Canonical Neutralization (v2), anchored BTC + ETH 3 July 2026
• TDCommons #10796 — In-File Stapled Freshness (Zone F), anchored BTC + ETH 3 July 2026
• TDCommons #11121 — Post-Quantum Ready, Offline-Verifiable Digital Identity Credential (hybrid ECDSA P-256 + ML-DSA-65, FIPS 204), published 23 July 2026, anchored BTC + ETH 23–24 July 2026

Important notice

This verification confirms file integrity only. It does not constitute legal recognition, certification, accreditation, or endorsement by any authority. Internet Identity Card ™ is a private software-based identity and verification platform developed by Https Card — Internet Identity Card Ltd. References to electronic signatures, eIDAS, or regulatory frameworks are informational only.