soc-skills
VERIFY · FOR EMPLOYERS & CANDIDATES

Verify a profile package

Paste or upload a package. We recompute its SHA-256 in your browser — a file-integrity check, not a signature.

  • Nothing uploaded
  • No login
  • MIT open source
HOW IT WORKSWhat is a verification package?

A soc-skills verification package bundles one grading result with a SHA-256 hash of its contents. Paste or upload a package below — this page recomputes the hash in your browser and checks that the contents still match it, i.e. the file is unchanged since the hash was made. It is not a digital signature: it does not show that the content is truthful or who made it. Nothing is uploaded anywhere.

Because anyone who edits a package can also recompute its hash, the check is strongest when the candidate published the hash somewhere dated and public before sharing the file — see Public timestamp below.

Package JSON

Public timestamp (optional · free · no account needed to check)

If the candidate posted the package hash in a public GitHub gist, paste the gist link. This page fetches the gist from GitHub's public API and checks that it contains this package's hash. GitHub — not the candidate — records when the gist was created and last edited, so a match shows the hash was public no later than that date.

Verify a package first.
Candidates: how to timestamp your package for free (2 minutes)
  1. Verify your own package above. When it passes, click Copy gist text above (or copy the sha256 value from the file).
  2. Open gist.github.com (free GitHub account), paste the text, and choose Create public gist. Secret gists don't count.
  3. Don't edit the gist afterwards — the page reports the date of the last edit, so editing moves your timestamp later.
  4. Share the gist link next to the package (résumé, LinkedIn, email). Optionally add "anchor": "<gist link>" as a top-level field in the package file — it sits outside the hashed payload, so the hash still matches, and this page fills it in automatically.

Prefer a git commit? A commit in a public repo also works as a record, but commit dates are set by the committer and can be backdated, so this page only checks gists. Advanced users can also stamp the package file with OpenTimestamps (free, Bitcoin-anchored); this page does not check those proofs.

What this verification does and does not prove
  • A matching hash proves the file is unchanged since the hash was made — the contents still match the SHA-256 written in the package. It also shows which rubric version the result claims.
  • On its own it does not prove that the content is truthful, who made the package, the identity of the person assessed, that the underlying evidence was genuine, or when the package was made (the "issued" time is self-asserted). It is not a digital signature: anyone can edit a package and recompute its hash with the public algorithm.
  • A public anchor adds one thing: a GitHub-recorded date by which the hash was public. It still says nothing about whether the profile is accurate — only that this exact file existed, unchanged, by then.
  • It is not a proctored exam or a certification. soc-skills grading is advisory and evidence-based; verify the evidence itself in an interview or work sample.