Verify the code you run.
Every Keylay release is a tagged commit in the public repository. This page publishes each release's SHA-256 fingerprints on infrastructure independent of GitHub, so you can confirm that a copy you downloaded — or the app served at app.keylay.org — is byte-identical to the audited source.
The relay never sees plaintext. Code delivery is the remaining trust.
Keylay's encryption means the relay only ever handles ciphertext. What's left to trust is the code itself: the repository that hosts it and the server that delivers it to your browser. A fingerprint published only on GitHub would be circular — anyone who could tamper with a release could tamper with the number next to it. Publishing here, on separately-controlled hosting, and cross-posting to Nostr (signed by the Keylay key, replicated on relays no one party controls) means an attacker has to falsify every channel at once.
For the strongest guarantee, don't rely on any hosted copy: check out the tagged release, verify its hash against this page and the Nostr note, and serve index.html yourself. The README's "Choosing How to Run Keylay" section walks through it.
Published fingerprints.
v0.9.0 is a protocol change (v2), not a drop-in update. A v0.9 client and a v0.8 client derive different channel identifiers and never find each other — both participants must run v0.9.0 or later. If you self-host index.html, check out the v0.9.0 tag (or later) before your next session; the hosted app at app.keylay.org runs the newest release below.
| Release | Date | Commit | SHA-256 — index.html | SHA-256 — server.js |
|---|---|---|---|---|
| v0.9.0 | 2026-09-23 | 72f7605da6ed7d5c628388fbc66211da336152f4 | 8dcec85f6f4aded0d2709d0fce1f43ac1ef4d4997b2da9d527d5afa55a08bb9b | a509154036990a0415ddd712b30d4b5dd6040ae640f1dc114064687b0736963f |
| v0.8.0 | 2026-08-14 | 99795bd75e3903a78305133be92284cfa7b3e04c | 17751b1f4d2ffe659c8bb741707652199861d64afec217d1c6a4e9a31904d74e | a509154036990a0415ddd712b30d4b5dd6040ae640f1dc114064687b0736963f |
| v0.7.2 | 2026-07-27 | 843d93f015a75a6904977bac2395336f90941641 | 7f4be839c8914a6cef29960e5041147d521c2e8c5ed1628a3aa4c381607fd628 | a509154036990a0415ddd712b30d4b5dd6040ae640f1dc114064687b0736963f |
| v0.7.1 | 2026-07-27 | 47bd621467d13c060e4812a589d2f8f04591ce8a | 132130e679aca8226a20e288ae741ac91d40c02123059bc9e8af424de0e8a98a | a509154036990a0415ddd712b30d4b5dd6040ae640f1dc114064687b0736963f |
Newest release first. The same fingerprints are embedded in each git tag's message, so git tag -v (for signed tags) or git show <tag> shows them from an entirely different source than this page.
The three inlined libraries, and their published hashes.
Keylay inlines three third-party libraries verbatim. Each hashes to a published release, so the whole delivered artifact — the app and its dependencies — is checkable, not just index.html. Details and the one-step check are in PROVENANCE.md.
| Library | Version | Source | SHA-256 |
|---|---|---|---|
| jsQR | 1.4.0 | jsdelivr npm/jsqr@1.4.0/dist/jsQR.js | bc40c8a15196236b2314db0856f72ca0b49980cd5413b8c852a7349f5fee0859 |
| qrcode | 1.5.1 | jsdelivr npm/qrcode@1.5.1/build/qrcode.js | ba588dfaf738bf8980e5da3b680ab1ce3f205af7577454c16f9c0506fe744df4 |
| pako | 2.1.0 | jsdelivr npm/pako@2.1.0/dist/pako.min.js | ede2693a4a6a5126b9d35669062b358ecab6ae7b9b86a1cf302feb45a8514907 |
These change only when a library is updated. Confirm the inlined copies still match with node tools/verify-vendored.mjs.
Three checks, any machine.
1. Verify a downloaded copy
Linux / macOS / Git Bash:
git clone https://github.com/keylaybtc/keylay cd keylay git checkout <tag> # e.g. v0.9.0 sha256sum index.html # must match the table above
Windows (PowerShell or cmd, no git needed for a zip download):
certutil -hashfile index.html SHA256
2. Verify the hosted app
curl -s https://app.keylay.org/ | sha256sum
This must equal the index.html fingerprint of the current release. app.keylay.org serves the tagged file byte-for-byte, with no minification, injection, or HTML transformation — if this check ever fails, treat it as a red flag and say so publicly.
3. Cross-check the channels
The same fingerprint should appear in at least three independent places: this page, the git tag message on GitHub, and the release note on Nostr. Disagreement between any two is a red flag — stop and ask before trusting any copy.
Release signing key
Release tags are GPG-signed. Key: keylay-signing-key.asc — fingerprint B717 F446 F739 999C 0522 8191 D529 6E2A C30F A478. Import it and run git tag -v <tag>.