Verify the code you run.
Every Keylay release is a tagged commit in the public repository. This page publishes each release's SHA-256 fingerprints on infrastructure independent of GitHub, so you can confirm that a copy you downloaded — or the app served at app.keylay.org — is byte-identical to the audited source.
The relay never sees plaintext. Code delivery is the remaining trust.
Keylay's encryption means the relay only ever handles ciphertext. What's left to trust is the code itself: the repository that hosts it and the server that delivers it to your browser. A fingerprint published only on GitHub would be circular — anyone who could tamper with a release could tamper with the number next to it. Publishing here, on separately-controlled hosting, and cross-posting to Nostr (signed by the Keylay key, replicated on relays no one party controls) means an attacker has to falsify every channel at once.
For the strongest guarantee, don't rely on any hosted copy: check out the tagged release, verify its hash against this page and the Nostr note, and serve index.html yourself. The README's "Choosing How to Run Keylay" section walks through it.
Published fingerprints.
| Release | Date | Commit | SHA-256 — index.html | SHA-256 — server.js |
|---|---|---|---|---|
| v0.7.2 | 2026-07-27 | 843d93f015a75a6904977bac2395336f90941641 | 7f4be839c8914a6cef29960e5041147d521c2e8c5ed1628a3aa4c381607fd628 | a509154036990a0415ddd712b30d4b5dd6040ae640f1dc114064687b0736963f |
| v0.7.1 | 2026-07-27 | 47bd621467d13c060e4812a589d2f8f04591ce8a | 132130e679aca8226a20e288ae741ac91d40c02123059bc9e8af424de0e8a98a | a509154036990a0415ddd712b30d4b5dd6040ae640f1dc114064687b0736963f |
Newest release first. The same fingerprints are embedded in each git tag's message, so git tag -v (for signed tags) or git show <tag> shows them from an entirely different source than this page.
Three checks, any machine.
1. Verify a downloaded copy
Linux / macOS / Git Bash:
git clone https://github.com/keylaybtc/keylay cd keylay git checkout <tag> # e.g. v0.7.1 sha256sum index.html # must match the table above
Windows (PowerShell or cmd, no git needed for a zip download):
certutil -hashfile index.html SHA256
2. Verify the hosted app
curl -s https://app.keylay.org/ | sha256sum
This must equal the index.html fingerprint of the current release. app.keylay.org serves the tagged file byte-for-byte, with no minification, injection, or HTML transformation — if this check ever fails, treat it as a red flag and say so publicly.
3. Cross-check the channels
The same fingerprint should appear in at least three independent places: this page, the git tag message on GitHub, and the release note on Nostr. Disagreement between any two is a red flag — stop and ask before trusting any copy.
Release signing key
Release tags are GPG-signed. Key: keylay-signing-key.asc — fingerprint B717 F446 F739 999C 0522 8191 D529 6E2A C30F A478. Import it and run git tag -v <tag>.