‹ Diablo II Forever

Trust, but verify

Verify the chain

Every character's history is a signed hash chain. This page pulls that chain and checks it right here in your browser — recomputing every hash and verifying every signature against a public key baked into this page. Nothing below is taken on trust from a server; if any hash or signature were wrong, this page would say so. View source to read exactly what it does.

Verifying…
fetching the chain and checking every signature in your browser
–
Entries
–
Characters
–
Signatures OK
–
Chain fingerprint

The key this page trusts

Verification is only meaningful against a key you can pin. This one is written into this page's source and published with the realm — compare it anywhere it appears; they must match.

Public key (SHA-256)…
CurveNIST P-256 / ECDSA-SHA256
Realm reported…
Snapshot age…

How this works — and how to reproduce it

Each entry is signed over these exact bytes (\n is a newline), then SHA-256'd:

v1
{realm}
{account/charname}
{version}
{prevHash}
{blobHash}
{nodeId}
{unixTimestamp}
  1. Import the pinned SubjectPublicKeyInfo key (P-256).
  2. For each entry, rebuild those bytes, SHA-256 them, and confirm it equals the entry's stated hash.
  3. Verify the entry's ECDSA signature over those bytes with the pinned key.
  4. Confirm each entry's prevHash equals the previous entry's hash for that character (first = genesis, or the hash a checkpoint attests to).

Checkpoints. A chain grows one entry per save, forever. To keep that bounded, a subject's early entries can be collapsed into a single signed record: "this chain reached version V, and the entry below it hashed to H." It is signed over its own bytes — prefixed cp1 rather than v1, so it can never be replayed as a save — and this page verifies each one against the same pinned key before letting it root anything. Be clear on what that buys: it proves the collapse was authorized by the key-holder, not that the collapsed history was honest. For a checkpointed character the guarantee is "nothing has been rewritten since version V" rather than "since genesis", and the verdict above says so whenever any chain starts from one.

The character saves themselves (the blobs) are encrypted and never leave the realm — this page only ever sees hashes and signatures, which is all verification needs. Run the same checks from any language against /chain.php and you'll get the same answer.