Check the code we just served you

This check runs entirely in your browser. It downloads the code this site just served you, hashes it here on your device, and compares it against the hashes we publish — and, if you have visited before, against what your own browser recorded last time.

It means four things, each of which is checked above rather than asserted:

• Every file we publish a hash for arrived at your browser unmodified — not altered in transit, not swapped by a cache or a proxy.
• The security headers are present and have not been weakened. In particular the Content-Security-Policy still forbids inline and evaluated script.
• No third-party or inline script is present on this page, and every script element carries an integrity hash.
• If you saved a baseline on an earlier visit, the code you are running today is byte-identical to the code you ran then.

That last point is the one that carries weight, and it is why the button to save a baseline exists. We can rewrite our own pages and our own manifest whenever we like. We cannot reach into your browser and change what you recorded last week.

It does not mean we are honest. The code performing this check is served by the same server it is checking, and so is the list of hashes it checks against. An operator who changed the code, the manifest and this page together, consistently, for everybody, would show you green.

Nobody can engineer that away in a web page — not us, not anyone else in this category. What this page does is narrow the gap: an attacker now has to be consistent across every file, across time, and across every visitor, and a single person who kept a baseline or compared notes would see it. Casual tampering, a compromised asset, a stripped header, a targeted swap aimed at one person: those it catches.

The full reasoning, including what a legal order could reach, is on the security page.