Independent verification — every command below was run against the live registry before this page shipped

Don't trust us. Check.

Every page on this site says the registry is "verifiable without trusting HashCare." A claim like that is worthless unless a stranger can actually do it. Here is the whole recipe — four commands, no account, no Bitcoin node — and the exact output you should see. If any step ever fails to match, that is the registry telling on us.

1Fetch the public hash list

The registry's hashes are public by design (they contain no data). This endpoint returns every anchored fingerprint. The key below is a public read-only key — it is meant to be in this page.

curl -s -X POST "https://uhizqukdctkvluluheux.supabase.co/rest/v1/rpc/anchor_root_data" \
  -H "Content-Type: application/json" \
  -H "apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InVoaXpxdWtkY3Rrdmx1bHVoZXV4Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzM4NzQ1ODQsImV4cCI6MjA4OTQ1MDU4NH0._AxT5pBEi1GZ167JPJpHeg_k1E0Bbtzyj3UPKdTFEug" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InVoaXpxdWtkY3Rrdmx1bHVoZXV4Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzM4NzQ1ODQsImV4cCI6MjA4OTQ1MDU4NH0._AxT5pBEi1GZ167JPJpHeg_k1E0Bbtzyj3UPKdTFEug" \
  -d '{}' > hashes.json
# → a JSON array of 64-hex strings, one per anchor

2Recompute the root yourself

The published method: SHA-256 over the newline-joined, ascending-sorted hash list. Compare your number to ours.

python3 -c "import json,hashlib; h=json.load(open('hashes.json')); \
print(hashlib.sha256('\n'.join(sorted(h)).encode()).hexdigest())"
# yours ↑   vs   ours ↓
curl -s https://hashcare.com/roots/latest.json
# {"date": "…", "generated_at": "…Z", "anchor_count": N, "root_sha256": "…", "hash_list": "DATE.hashes.txt", …}
# They must be identical — then you have independently confirmed what the registry contained at generated_at.

The live endpoint reproduces the latest root only, and only until the next anchor is made: it returns the registry as it is right now, not as it was on any past date. So every root also ships the exact list it commits to, which makes any published date checkable offline, forever. The check is the same join as above — the definition is the joined list, not the file's bytes, so trailing whitespace cannot change the answer.

curl -s https://hashcare.com/roots/2026-08-20.hashes.txt | python3 -c \
"import sys,hashlib; print(hashlib.sha256(chr(10).join(sys.stdin.read().split()).encode()).hexdigest())"
# 766ae410a0794efa89e88d678b78114c4da11be3f21226cc24d3ff95c085d37d  — equals root_sha256 in 2026-08-20.json
# We publish the file with no trailing newline, so a plain `shasum -a 256` of it matches too, and CI asserts
# that. But a stray newline would only break the shortcut, never this recompute.
curl -s https://hashcare.com/roots/index.json     # every published date, its anchor count, and whether its hash list is published

3Read the Bitcoin proof

Each day's root has an OpenTimestamps proof file. ots info reads it without contacting anyone and lists the Bitcoin block(s) that attest it. (Install once: pip install opentimestamps-client.)

curl -s -O https://hashcare.com/roots/2026-08-17.ots        # any date listed in /roots/index.json
ots info 2026-08-17.ots
# … verify BitcoinBlockHeaderAttestation(962951)
#     # Bitcoin block merkle root 393eb7f6…
# A block number = the root existed before that block was mined. "PendingAttestation" lines are extra
# calendars still upgrading; one BitcoinBlockHeaderAttestation is sufficient. Very recent days may show
# only pending — Bitcoin confirmation typically lands within a day.

4Check the block — no node required

Reconstruct the raw root bytes from the published JSON, then run verify with --no-bitcoin. It prints exactly what to check on any public block explorer.

curl -s https://hashcare.com/roots/2026-08-17.json | python3 -c \
  "import json,sys; open('root.bin','wb').write(bytes.fromhex(json.load(sys.stdin)['root_sha256']))"
ots --no-bitcoin verify -f root.bin 2026-08-17.ots
# To verify manually, check that Bitcoin block 962956 has merkleroot 0ddf186f…
# Look up block 962956 on mempool.space or blockstream.info; if the merkle root matches, the proof holds —
# and nothing in this chain required trusting HashCare, its database, or this page.