Sign your work.
Prove it's yours.

Your file is hashed in your browser with SHA-256, and we look for an exact match using just that hash. If no exact match is found, the file is briefly sent to our server to compute a perceptual fingerprint (which finds resized, cropped, or recompressed copies of signed work), then immediately discarded. The bytes of your file are never stored.

On a public Holochain DHT — a distributed hash table maintained by a network of nodes. There's no central server we could shut down, no database we could lose. Signatures are replicated across the network and can be verified by anyone.

No gas fees, no per-transaction cost, no token speculation, no environmental footprint. Holochain is agent-centric — each user has their own chain — making per-action cost effectively zero. We didn't want signing your own work to require buying crypto.

With NFTs you mint a token on a public blockchain, the token is the thing you own, and the file itself usually lives somewhere else — a URL, an IPFS hash.

Sign It comes at it from the other end. When you sign a file, the hash, your signature, and a timestamp go on a public Holochain DHT. The file never has to leave your device — no IPFS, no public mirror, nothing. That record alone is a strong cryptographic claim: "this person made this, on this date, before anyone else." Which is what ownership actually means before trading gets layered on top.

Sign It also uses perceptual hashing alongside cryptographic hashing, which means modification doesn't break the proof. If someone takes your image and crops it, re-encodes it, or trims and remixes your audio and tries to claim it as theirs, your original signature can still be matched against the derivative.

NFTs went straight at tradeability. Sign It is built around proving you made something first — which is why the right time to sign something is before anything goes online, not after.

Your account can't be recovered — that's the cost of true zero-knowledge. Your existing signatures stay on the DHT (they're already public), but you won't be able to sign new files as the same identity. Back up your 24-word recovery phrase somewhere safe.

Yes. Revocation is a separate signed entry that any verifier sees alongside the original. Useful if you signed something by mistake, or if you withdraw consent. The original signature stays visible — revocation is a public statement, not a deletion.

Any file. Sign It works on the SHA-256 hash, so it doesn't care if it's an image, video, PDF, .zip, source code, or anything else. Perceptual hashing (for similar-file detection) currently covers images, audio and video.

When you sign an image, audio, or video file, Sign It computes a perceptual fingerprint — a compact representation of what the content looks or sounds like, not the exact bytes. This fingerprint is split into bands and stored on the Holochain DHT alongside your signature.

When someone verifies a file that has no exact SHA-256 match, Sign It computes the fingerprint of the uploaded file and searches the DHT for similar bands. This means cropped, resized, recompressed, or format-converted copies of your signed work can still be matched back to your original signature.

For images this uses perceptual hashing (pHash). For audio it uses Chromaprint (the same algorithm Shazam-style services use). For video it uses frame-sampled perceptual hashing. The file is sent to the server only for fingerprinting, and is immediately discarded — we never store it.

Ed25519 signatures (the same scheme used by SSH, Signal, and Holochain itself). Keys are generated from your 24-word recovery phrase via HMAC-SHA256 derivation. Vault holds your private key; the public key is your identity on the network.

Each signer creates their own signature on the same file hash. All signatures show up on the same verification page. There's no 'document owner' coordinating signers — anyone with the file can add their signature at any time.

Only if they have your private key (or your recovery phrase). The signature is cryptographically tied to your public key — anyone who finds someone else's public key can verify their signatures, but only the holder of the matching private key can create new ones.

Free for Verify (always). Free tier for signing includes 2 signatures per month for individuals, 250 per month per developer org. Paid tiers scale up — see Premium pricing for individuals or Developer pricing for orgs.

Yes. Drop this two-line snippet into any page, replacing the hash with your file's SHA-256:

<div data-flowsta-hash="abc123..."></div> <script src="https://flowsta.com/sign-it/widget.js" async></script>It renders a card showing signer, timestamp, and content rights. Light and dark themes auto-detect. Full reference: Badge & Widget docs.

Any signed file exposes a machine-readable rights endpoint:

GET https://auth-api.flowsta.com/api/v1/sign-it/content-rights?hash=<sha256>It returns the signer-declared license, AI-training policy, commercial-licensing stance, and contact preference as JSON. If the signer set ai_training: NotAllowed, pipelines should skip the file. Most restrictive policy wins when multiple signers disagree. Full spec: Content Rights API.