letsseal
The open standard for proving any file is real, unaltered and sealed
What is it?
What it is
Let's Seal provides the SEAL standard, an open standard for proving any file is real by cryptographically sealing it to guarantee integrity, timestamp, and issuer identity.
Why it exists
To make authenticity a free public infrastructure, eliminating paid document seals and vendor lock‑in, similar to how Let's Encrypt made TLS certificates free.
Who should use it
Developers implementing document sealingIT professionals needing cryptographic proofLegal/finance experts requiring document authenticityOrganizations in regulated industriesIndividuals verifying personal documents
Who should avoid it
Non-technical users without crypto knowledgeThose needing simple document sealing without verificationUsers unable to manage self-hosted infrastructure
How it works
A quick walkthrough in plain English
How letsseal works
Step 1 of 3
You interact with it
Open letsseal, send a request, or connect it to your stack.
Features
Advantages
- Cost-free and open-source (Apache-2.0 license)
- Verifiable authenticity without trusting third parties
- Domain-based identity for issuers enhances trust
- Transparency logs enable public auditing of all seals
- Self-hosting capability for organizations needing control
- Supports diverse use cases across industries (legal, finance, healthcare, etc.)
- No paywalls or proprietary lock-in
- Cryptographic guarantees for integrity, time, and issuer
- Interoperable with existing tools (e.g., OpenTimestamps, C2PA readers)
- Public verification portal (verify.letsseal.org) for instant checks
Disadvantages
- Self-hosting requires technical expertise to set up certificate authorities
- Bitcoin anchoring may introduce latency or cost for time anchoring
- Domain verification process may be a barrier for small organizations
- Limited support for non-SHA-256 hashing in some workflows
- Verification requires manual steps for some file types (e.g., email/S/MIME)
- Transparency log audits may require technical knowledge
- No built-in identity verification beyond domain control
- Potential complexity in integrating with legacy systems
- Reliance on public Bitcoin blockchain for time anchoring
- No automatic revocation checks for revoked certificates in all workflows
Installation
native
git clone https://github.com/letsseal/letsseal.git && cd letsseal # 1. Certificate authority (see ca/) ./ca/setup-ca.sh init # 2. Signing service (holds the intermediate key; bind to localhost) cd signing-service && python -m venv .venv && . .venv/bin/activate pip install -r requirements.txt && uvicorn main:app --port 8081 # 3. Web app: dashboard, hosted API, verification portal, site cd ../web && npm install && cp .env.example .env # fill in the values npx prisma migrate deploy && npm run dev # http://localhost:3000
FAQ
What does a SEAL proof guarantee about a file?
A SEAL proof guarantees that the file has not been altered (integrity), that it existed by a certain date (time anchored to Bitcoin via OpenTimestamps), and that it was sealed by a specific certificate whose issuer identity can be verified as controlling a domain.
How can I verify a sealed document without using the hosted verification portal?
You can verify offline using the reference verifier (python spec/verify.py sealed.pdf sealed.pdf.ots) or standard tools like openssl for S/MIME/CAdES, any PAdES validator for PDF, any C2PA reader for media, XML-DSig validator for XML, or ots verify for the timestamp, checking the public transparency log inclusion proof against the published root.
Which file types can be sealed with Let's Seal and how is the proof embedded?
PDF (PAdES/X.509 signature embedded), images/video/audio (C2PA manifest), XML (W3C XML-DSig envelope), email (S/MIME multipart/signed), any other file (detached CAdES/CMS .sig over SHA-256), and software artifacts/containers (signature plus in-toto/DSSE attestation). The proof rides along inside the file’s native format so the file remains usable by standard tools.
What steps are required to self-host Let's Seal under my own certificate authority?
Clone the repo, run ./ca/setup-ca.sh init to set up the CA, start the signing service (uvicorn main:app) after installing its Python deps, then run the web app (npm install, prisma migrate deploy, npm run dev). All components are self‑hostable and use the same code as the hosted service.
How do I obtain an organisation API key to seal files via the hosted API or self‑hosted endpoint?
After signing up at app.letsseal.org (or configuring your self‑hosted instance), you can create an organisation key in the dashboard; use it as a Bearer token in the Authorization header when calling endpoints like POST /api/v1/seal.
Featured in Videos
YouTube tutorials and walkthroughs for letsseal
Alternatives
Similar projects ranked by category, topics, and text overlap.