Code check

Checks that the code alo.ne serves right now matches the code we signed and published, so nobody has quietly swapped it to capture passwords or encryption keys.

Served directly · not through Cloudflare · Legal & privacy →

Run the check

This page downloads every published file fresh and compares it with the hashes in our signed release list on GitHub, which is outside cloudflare control.

JavaScript is off. The automatic check needs it, but you don't: follow the manual steps under "Check it yourself", which only need a terminal with gpg, curl and sha256sum.

What it proves

It proves

The files served to this browser, right now, match the release we signed.

It also catches

Any script the dashboard pages load that isn't in the signed release, including one added on the way by Cloudflare or anyone else. Those show as NOT SIGNED. It can't check the small inline scripts in each page, because they change on every request.

It doesn't prove

That a targeted attacker isn't serving different files to a different browser or connection. Run it from the same browser and network you use alo.ne on.

You can trust this page

The script is open source. Read check.js, or use the manual steps below.

Check it yourself

Every release list is signed with our PGP key. The key's fingerprint is published on GitHub, Discord and keys.openpgp.org.

Download the latest signed lists, webchat.txt.asc and dashboard.txt.asc, from our public hashes repo on GitHub, or from the release posts in Discord or Telegram.
Run gpg --verify webchat.txt.asc. It must report a good signature from our key.
Follow the commands inside each list. They download every file and check it with sha256sum -c. Every line must say OK.

If anything doesn't match: don't enter passwords or send encrypted messages through the website, and tell us at support@alo.ne. For XMPP usage, device clients aren't affected as they do not go through cloudflare at all.