Verify a target

What gets sealed

Before a Free Response session starts, the server fetches the target image and hashes its raw bytes with SHA-256. It then draws a random salt, joins the salt and the image hash into one string, and hashes that string again. The result is the commitment. You see the commitment before you draw a single line. The salt and the image hash stay on the server until the reveal.

Why a salt

Without a salt, anyone holding the pool of possible target images could hash each one and match the commitment to a picture before the reveal. The salt makes the commitment useless for that until the server discloses it.

Check it by hand

Every shared session has a proof page that lists the commitment, the salt, the image hash, and a link to the image. On macOS or Linux, the whole check is five commands.

# 1. Download the revealed target image
curl -L -o target.jpg "<image URL from the proof page>"

# 2. Hash the raw image bytes
shasum -a 256 target.jpg
#   -> <imageSha256>

# 3. Build the preimage with the salt disclosed after the reveal
printf '%s' "iof-target-commitment-v1:<salt>:<imageSha256>" > preimage.txt

# 4. Hash the preimage
shasum -a 256 preimage.txt
#   -> <recomputed commitment>

# 5. Compare with the commitment shown before the session started
#    Same 64 hex characters = the image was fixed before drawing began

The preimage format is iof-target-commitment-v1:<salt>:<imageSha256> with plain ASCII colons and no trailing newline. Hex digests are lowercase.

What it proves

A matching commitment shows that this exact image existed, and was bound to this session, before the practitioner recorded anything. The image could not have been picked or generated afterwards to fit the drawing.

What it does not prove

It does not prove the practitioner never saw the image some other way, and it does not prove the session was scored fairly. It is a hash on our server, not a blockchain or a third-party timestamp. Treat it as one honest piece of evidence, not as a guarantee.