Screenshots can be faked. Archives are run by one organization.
Keepword is a network of independent witnesses whose records anyone can check.
Run a witness · Install · How it works · Docs · Chat
Paper stays the way it was printed. Web pages can be rewritten at any moment, and the old version simply vanishes:
- 🔏 A company edits its privacy policy overnight. What it promised you yesterday is gone.
- 📰 A news article is quietly "updated", with no note saying what changed.
- 🏷️ A shop shows one price to you and another to someone in a different country.
- 🏛️ An official page disappears, and with it the commitment it made.
When that happens, how do you prove what the page said? A screenshot takes ten seconds to fake. "I saw it with my own eyes" is your word against theirs.
Keepword is a network of computers, called witnesses, run by different people in different countries. Point them at a page you care about, and they:
- Look. Several witnesses on different networks fetch the page. They ignore the noise (ads, cookie banners, "posted 5 minutes ago") and keep what the page actually says.
- Seal. Each witness signs what it saw and stamps it with the time, using public randomness from drand and, a little later, the Bitcoin blockchain. Once sealed, a record can't be changed or backdated. Not by the website, not by you, not even by the witness that made it.
- Compare. When a page changes without saying so, Keepword flags it as a silent edit and shows exactly what changed. When witnesses in different places were shown different versions, it flags a split.
- Prove. Any record can be exported as a small evidence file. Anyone can check it on their own computer, offline, without trusting Keepword, the witnesses, or you.
A privacy policy changes, and nothing on the page says so:
Privacy policy
- We never sell your data.
+ We may share your data with partners.Keepword records it as a silent edit, and the proof checks out anywhere:
$ keepword verify --bundle evidence.json --esplora https://blockstream.info/api
[ok ] signature signed by witness 7b757b5c…
[ok ] log inclusion leaf 1187 of 1204
[ok ] cosignatures tree head cosigned by 16 other keys
[ok ] not before captured after 2026-05-01T09:14:03Z (drand round 28274493, 2s before the claimed time)
[ok ] anchor tree head existed by Bitcoin block 947301
[ok ] body 41233 bytes, hash 4b768329a126
...
VERIFIED: LOGGED + COSIGNED
This bundle shows
- a witness (7b757b5c…) signed that it saw this page at the stated time
- the statement is in that witness's append-only public log
...
It does not show
- that independent witnesses saw the same: `keepword verdict` shows that
...
Every check says exactly what it proves, and what it doesn't.
| You don't have to trust… | …because |
|---|---|
| any single company | Witnesses are run by independent people. A verdict only counts when witnesses on at least three different networks agree, so faking one takes three networks, not three keys. |
| anyone's promise | Every record is signed and goes into a public, append-only log. Other witnesses check each log, so rewriting history gets caught, and the proof of it spreads to everyone. |
| anyone's clock | Public randomness proves a record wasn't made before a moment; Bitcoin proves it existed by a later one. |
| Keepword itself | Evidence files check out on any computer, with no account, no server and no internet connection. |
- Journalists and fact-checkers: "The article said X on Monday, and here's the proof."
- Consumer groups and lawyers: terms of service, prices and policies, exactly as they stood on a given day.
- Researchers: how the web changes, and who gets shown what.
- Anyone who has ever thought "wait, that's not what it said yesterday."
- Not an archive of the whole web. The Internet Archive does that, and does it well. Keepword records the pages people choose to watch, and proves what they said without asking anyone to trust one organization.
- Not a lie detector. It proves what a page said and when, not whether it was true.
- Not finished. It works end to end, and the network is just starting. Using it currently means running a small server and typing a few commands; friendlier ways in are on the way.
- ⭐ Star the repo to follow along.
- 🖥️ Run a witness. The network gets stronger with every witness in a new country or network. A small server and one command is all it takes: keepword.net/network (or the full guide, Starting a network).
- 🔍 Watch a page that matters to you. Install a node and ask the network to keep an eye on it.
- 💬 Come and talk. Keepword's chat is on Matrix: #keepword:keepword.net for questions and ideas, #operators:keepword.net for running a witness, #dev:keepword.net for the code, and #announcements:keepword.net for releases and network news. The Keepword space has them all. keepword.net doesn't take sign-ups, so join with an account on any other Matrix server, such as matrix.org.
- 🛠️ Build with us. Everything is in Rust, tested end to end, and documented at keepword.net/docs. Start with CONTRIBUTING.md.
Questions people ask
Do I need to be technical?
Today, running a witness takes a Linux machine and a terminal, but setup is
a single command. Checking a proof takes the keepword program. A simpler
way for everyone is on the roadmap.
What does it cost? The software is free and open source (AGPL-3.0). A witness runs happily on a small cloud server that costs a few euros a month, or on a machine at home, and needs no domain.
Does it track people? No. Witnesses only fetch public pages that someone asked them to watch. They don't collect anything about visitors.
What if a witness lies?
Its record would disagree with the others, and the network notices: a
verdict needs independent witnesses to agree. When witnesses disagree,
others picked at random (so nobody can choose them) look at the page again,
and only what they can reproduce counts. A witness that rewrites its
public log gets caught by the witnesses that audit it, and the network
stops trusting it. Evidence from a single witness is exactly that, and
keepword verify says so.
Can a website stop it? A site can block witnesses, but that's visible too. And a site that shows witnesses in one country a different page than in another gets flagged for exactly that.
Is it legal? Witnesses fetch public pages, like a browser does. Operators choose what their witness keeps and shares; by default it shares only fingerprints (hashes), never page content. See the design, §7 for the details, and check your local law before running a public witness.
A Keepword node fetches a URL, reduces it to its meaningful content, signs a statement about what it saw, and appends that statement to a Certificate-Transparency-style Merkle log. It keeps watching, and when the page changes it tells you what changed and whether the publisher said so. Every record can be exported as a self-contained evidence bundle that anyone can verify offline, without trusting the node.
Witnesses federate: each log is audited by 16 others, which check its checkpoints with consistency proofs and cosign them. Watch requests are assigned by public randomness, witnesses corroborate each other's network location, and they compare what they saw. When they disagree, witnesses drawn at random from the same countries recheck the page, and only versions they reproduce count. A difference that is confirmed again and again raises a split alert. Captures carry a drand beacon, which proves they happened after a point in time. Logs are anchored in Bitcoin through OpenTimestamps, which proves the captures existed before a later point.
The design, threat model and formats are in Design and threat model.
On a server (Debian, Ubuntu, Fedora, RHEL-likes, Arch, openSUSE, Alpine):
curl -fsSL https://git.keepword.net/keepword/keepword/raw/branch/main/scripts/install.sh \
| sudo sh -s -- --binary --domain witness.example.org --caddyThis installs the latest release's static binary, creates a sandboxed
keepword service with its own user, fetches the IP-to-ASN table and
refreshes it weekly, detects the node's network, and puts the peer API behind
Caddy with automatic TLS. No domain? Pass --public-api 0.0.0.0:8481
instead of --domain and --caddy, and open port 8481: the node is then
reached at http://<its IP>:8481. At home, behind a router? Pass
--relay auto instead: it is reached through a witness that relays for
it. Re-run it to upgrade. To build from source instead (needed for
--render and --notary), drop --binary, or run the installer from a
checkout:
git clone https://git.keepword.net/keepword/keepword.git && cd keepword
sudo sh scripts/install.sh --domain witness.example.org --caddyThe static Linux binaries of the keepword command (x86_64 and arm64) are
attached to each release;
changes are listed in the
changelog. From 2.4.0 on, releases
also publish a container image, git.keepword.net/keepword/keepword. Both are
described in Installing a node. To
start a network or join one, see
Starting a network.
cargo build --release
alias keepword=./target/release/keepword
keepword init --asn 3320 --country DE # creates ./keepword-data
keepword capture https://example.org/privacy
keepword watch add https://example.org/privacy --every 6h
keepword serve --watch # web UI on http://127.0.0.1:8480What a change looks like, proving it to someone else, and every command are in Using Keepword.
Everything else is at keepword.net/docs,
and in docs/:
- Installing a node: the installer, the container, reverse proxies, CDNs and firewalls
- Using Keepword: every command, the data directory, the main settings, headless rendering and TLSNotary
- Starting a network: the founding witnesses and the settings they share
- Configuration: every setting, with comments
- Design and threat model: the formats, the network and the roadmap
- Development: the code's layout, the checks and the tests
- Changelog
Keepword is free software under the GNU Affero General Public License v3.0. You may use, study, change and share it. If you run a modified version as a service for others, you must offer them its source code under the same license.