All resources

Kovel Verifier · version 0.1.0

Code you can
check yourself

Kovel serves the code that encrypts your matter. A court could order us to serve modified code to one person and forbid us from saying so. We cannot prevent that. What we can do is make it detectable by something you installed before it happened and that we do not control.

How it works

  1. Every deploy, we hash every file your browser can receive and publish the list to a public repository and to the Sigstore transparency log, with a plain-language note of what changed and where.
  2. The extension runs in your browser, before any page script. It records every script the page executes, re-reads the bytes from your own browser cache, and compares them with the published list for that build. Expected hashes never come from kovel.io.
  3. It shows one of three states: verified, does not match with the file named, or not in the log yet. A legitimate deploy shows as a new build with its note, never as an alarm, because we publish before the build goes live.
  4. Keyholder mode: you store your matter passphrase in the extension instead of typing it into the page. The extension releases it only into a verified build. Compelled code cannot ask for what you never typed.

Install (Chrome, Edge, Brave)

  1. Download and unzip the extension.
  2. Open chrome://extensions, turn on Developer mode (top right).
  3. Click Load unpacked and choose the unzipped extension folder.
  4. Open any kovel.io page. The shield icon shows OK, !, or ?. Click it for details and to set your policy.
Download the extensionThe public log

Unpacked extensions do not auto-update, which is deliberate: the verifier changes only when you choose. A Chrome Web Store listing is in progress; the source is in the public log repository so it can be read before it is installed.

This build

build      zK0LE4pv7l2iHjcaUYDeq
commit     a3e9653adaf79bbbdc5e687efaae87f5c92da795
built      2026-10-23T14:54:44.567Z
files      71
manifest   sha256 d68d132cda9e7192e95d135af6fdaa75828f76884bfed294c81af42210e953d5
served at  https://kovel.io/.well-known/kovel-build.json  (convenience copy; verify against the log)
log        https://github.com/AnthonyDavidAdams/kovel-attestations/blob/main/builds/zK0LE4pv7l2iHjcaUYDeq.json
rekor      (not yet published for this build)
change     (no release note attached)

For auditors and firm IT

The same comparison as a command-line tool, for a HAR file exported from a logged-in browser (DevTools → Network → Save all as HAR with content). Run it on a schedule from a real account and Kovel cannot tell the monitor from a client.

git clone https://github.com/AnthonyDavidAdams/kovel-attestations
node kovel-attestations/verify/cli/kovel-verify.mjs session.har
# exit 0 VERIFIED · 2 UNATTESTED · 1 MISMATCH

What this does not do

Detection, not prevention. Stated plainly.

  • Modified code that captures a passphrase can open everything in that matter, past and present. The verifier exists so you find out before you type.
  • It only helps if it was installed before the modification. Install it on day one, not on the day you are worried.
  • It checks code, not data. Substituting a key during attorney key exchange is covered separately by the six-word fingerprint you read back out of band.
  • Builds are hashed as deployed, not reproduced from source. The log proves what we served, not that the source produced it.
  • We will never tell you a page is verified. The extension draws its own badge, outside the page, for exactly that reason.