From your device all the way to cryptographic eternity.
Follow every step that turns what you capture — document, photo, video or audio — into evidence with verifiable integrity, timestamped by a qualified third party and durably preserved. It all starts on your device, and nothing ever leaves it unencrypted.
You select one or more files — photo, video, audio, document. BlockProve offers two modes: "Proof only" (only the cryptographic fingerprint is publicly anchored, the file stays in your private vault) and "Full archive" (the encrypted file itself is preserved on the blockchain, recoverable from anywhere, even 200 years later). In both cases, the file never leaves your device unencrypted.
All selected files are bundled into a single ZIP archive. Inside, in a files/ folder, every original document is preserved. A metadata.json file is automatically generated and included in the archive: it holds all the contextual information of the proof.
The archive is built locally in a background thread (Dart Isolate) so the UI never freezes. No data travels over any network at this stage.
When you signed up, BlockProve generated a 12-word mnemonic phrase (BIP-39 standard, identical to Bitcoin/Ethereum wallets). From this phrase, the encryption key is derived via Argon2id — an algorithm deliberately memory-hard, making brute-force attacks unprofitable even with an entire datacenter. This key never leaves your device. BlockProve does not know it.
Argon2id — winner of the 2015 Password Hashing Competition. Resistant to GPU/ASIC attacks. Deterministic derivation: the same phrase always produces the same key, enabling recovery without any server-side key storage.
The full ZIP archive is encrypted with AES-256-GCM — the standard for military and government encryption. GCM mode (Galois/Counter Mode) is "authenticated": it detects any tampering of the encrypted file, even a single byte. The result is a binary block made of three concatenated parts.
AES-256-GCM. 256-bit key. IV randomly generated on every encryption. GCM tag: guarantees integrity — any corruption is detected on decryption.
Once the archive is encrypted, BlockProve computes the SHA-256 hash of the entire encrypted payload (IV + Tag + content). This 64-character hexadecimal fingerprint is your evidence's unique identity in the entire universe. Computed after encryption, it cannot be linked to the original content by anyone — not even BlockProve, without your key.
Whether there is 1 or 50 files in the archive, there is always a single SHA-256 hash — that of the full encrypted archive.
SHA-256 (Secure Hash Algorithm 256-bit). Collision resistance: 2²⁵⁶ possible combinations. Computed locally over the full encrypted payload (IV ‖ Tag ‖ Ciphertext).
The SHA-256 hash (and only it) is signed with Crystals-Dilithium level 5 — an algorithm selected by the U.S. NIST in 2022 as the official post-quantum cryptography standard. The signature proves it was really you (via your mnemonic phrase) who created this evidence, and that it was not modified. The Dilithium public key is embedded in the proof: anyone can verify the signature without needing to contact you.
Crystals-Dilithium Level 5 — NIST PQC Standard FIPS 204. Security category 5 (quantum equivalent of AES-256). Signature size ~4,600 bytes.
Before anchoring anything on the blockchain, BlockProve requests an RFC 3161 timestamp token from Lleida.net, a Qualified Timestamping Authority (TSA) under the European eIDAS regulation. The TSA receives your evidence's SHA-256 hash, signs it with its official certificate and returns a TSR token (Timestamp Response) — cryptographic proof that this exact hash existed at that exact second. This token is then embedded in the Arweave transaction.
The TSA signs the SHA-256 hash — not the file, not your identity. Privacy is preserved.
Qualified eIDAS timestamp
Provided by Lleida.net — a qualified trust service provider (QTSP) listed on the European Union trusted list.
RFC 3161 (Internet X.509 PKI Timestamp Protocol). The TSR token (DER ASN.1) is stored as base64 in the proof. Independently verifiable with openssl or any RFC 3161 validator.
Everything is now bundled into a JSON proof document and anchored on Arweave — a permanent-storage blockchain guaranteeing data preservation for at least 200 years via an economic endowment mechanism. The transaction receives a unique 43-character TXID: the permanent, immutable address of your evidence.
Arweave — SPoRA consensus protocol (Succinct Proofs of Random Access). The TXID is a permanent address: https://arweave.net/{TXID}. Once anchored, a transaction is irreversible and unmodifiable.
BlockProve generates a PDF certificate gathering all verifiable elements: the SHA-256 fingerprint, the Arweave TXID, the date and time of the eIDAS timestamp, the PQC algorithm used, an excerpt of the public key and signature. This document can be sent to a lawyer, filed in court, or shared with a third party. Each element is independently verifiable, without needing BlockProve.
Six independent layers, each with its own guarantee.
AES-256-GCM
End-to-end confidentiality
SHA-256
Detection of any tampering
Crystals-Dilithium 5
Post-quantum integrity
RFC 3161 eIDAS QTSP
European legal value
Arweave
200+ years preservation
BIP-39 + Argon2id
Key only with the user
All evidence anchored in "Full archive" mode remains accessible via its Arweave TXID. The PDF certificate contains everything needed to verify the proof with standard open-source tools (openssl, arweave-js, any RFC 3161 validator). Encryption and keys rely on open standards. Your evidence does not depend on our existence.
Secure my first file