<p>Obtain the HTML containing the javascript.</p>
<pre><code>$ wget https://raw.githubusercontent.com/pointbiz/bitaddress.org/master/bitaddress.org.html
--2024-02-16 12:19:23--  https://raw.githubusercontent.com/pointbiz/bitaddress.org/master/bitaddress.org.html
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.108.133, 185.199.111.133, 185.199.109.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 937206 (915K) [text/plain]
Saving to: ‘bitaddress.org.html’

bitaddress.org.html             100%[====================================================&gt;] 915.24K  1.54MB/s    in 0.6s

2024-02-16 12:19:24 (1.54 MB/s) - ‘bitaddress.org.html’ saved [937206/937206]

</code></pre>
<p>Calculate the SHA256 hash</p>
<pre><code>$ openssl dgst bitaddress.org.html
SHA256(bitaddress.org.html)= dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194
</code></pre>
<p>then check this against the published hash</p>
<pre><code>$ wget https://www.bitaddress.org/CHANGELOG.txt.asc
--2024-02-16 12:27:23--  https://www.bitaddress.org/CHANGELOG.txt.asc
Resolving www.bitaddress.org (www.bitaddress.org)... 185.199.108.153, 185.199.110.153, 185.199.109.153, ...
Connecting to www.bitaddress.org (www.bitaddress.org)|185.199.108.153|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 15710 (15K) [application/pgp-keys]
Saving to: ‘CHANGELOG.txt.asc’

CHANGELOG.txt.asc               100%[====================================================&gt;]  15.34K  --.-KB/s    in 0.001s

2024-02-16 12:27:24 (10.0 MB/s) - ‘CHANGELOG.txt.asc’ saved [15710/15710]

$ grep SHA256 *asc
CHANGELOG.txt.asc:bitaddress.org-v3.3.0-SHA256-dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194.html
</code></pre>
<p>But really you need to independently verify the PGP signature using public keys from an independent trusted source.</p>

CC BY-SA 4.0
2024-02-16T12:42:03.953Z
Thank you very much! I can find the public key here:
https://www.bitaddress.org/pointbiz_bitaddress.org.asc
As well as here https://bitcointalk.org/index.php?topic=43496.0 and here https://github.com/king7777/pointbiz.github.io/blob/master/ninja_bitaddress.org.txt
This is what you mean by "independently verify the PGP signature using public keys from an independent trusted source", right?
Ohumeronen
CC BY-SA 4.0
2024-02-16T14:21:44.503Z
Yes, that is what I meant.
RedGrittyBrick
CC BY-SA 4.0
2024-02-16T23:05:20.023Z
I just noticed that the .asc file from the last link differs from the first two. Nonetheless I get a good signature and the same primary key fingerprint for both files. The last file also gives me an additional good signature from "pointbiz <pointbiz@bitaddress.org>". I think these are just two versions from the same key, right?
Ohumeronen
CC BY-SA 4.0
2024-02-16T12:16:48.880Z
2024-02-16T12:30:07.050Z
2024-02-16T12:30:07.050Z
RedGrittyBrick
<p>Can I verify that I used an authentic version of bitaddress.org if I only have the SHA256 hash string I generated from the HTML file?</p>
<pre><code>&gt;&gt; sha1sum bitaddress.org.html
</code></pre>
<p>How can I do this on Linux? After that, can I be certain that only I have access to the private key?</p>
<p>On the website I can read:</p>
<blockquote>
<p>If you are familiar with PGP you can download this all-in-one HTML page and check that you have an authentic version from the author of this site by matching the SHA256 hash of this HTML with the SHA256 hash available in the signed version history document linked on the footer of this site.</p>
</blockquote>

<hash><linux><sha256><verification><bitaddress.org>
Verify Hash from bitaddress.org without the original HTML file
Ohumeronen
# Verify Hash from bitaddress.org without the original HTML file

(Asked by: username_0 on 2024-02-15)

Can I verify that I used an authentic version of bitaddress.org if I only have the SHA256 hash string I generated from the HTML file?

```
>> sha1sum bitaddress.org.html

```

How can I do this on Linux? After that, can I be certain that only I have access to the private key?

On the website I can read:

> If you are familiar with PGP you can download this all-in-one HTML page and check that you have an authentic version from the author of this site by matching the SHA256 hash of this HTML with the SHA256 hash available in the signed version history document linked on the footer of this site.

**Tags:** hash, linux, sha256, verification, bitaddress.org


---

## 1 answers

### Answer by username_1 on 2024-02-16. Score: 1 | Accepted answer

Obtain the HTML containing the javascript.

```
$ wget https://raw.githubusercontent.com/pointbiz/bitaddress.org/master/bitaddress.org.html
--2024-02-16 12:19:23--  https://raw.githubusercontent.com/pointbiz/bitaddress.org/master/bitaddress.org.html
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.108.133, 185.199.111.133, 185.199.109.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 937206 (915K) [text/plain]
Saving to: ‘bitaddress.org.html’

bitaddress.org.html             100%[====================================================>] 915.24K  1.54MB/s    in 0.6s

2024-02-16 12:19:24 (1.54 MB/s) - ‘bitaddress.org.html’ saved [937206/937206]

```

Calculate the SHA256 hash

```
$ openssl dgst bitaddress.org.html
SHA256(bitaddress.org.html)= dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194

```

then check this against the published hash

```
$ wget https://www.bitaddress.org/CHANGELOG.txt.asc
--2024-02-16 12:27:23--  https://www.bitaddress.org/CHANGELOG.txt.asc
Resolving www.bitaddress.org (www.bitaddress.org)... 185.199.108.153, 185.199.110.153, 185.199.109.153, ...
Connecting to www.bitaddress.org (www.bitaddress.org)|185.199.108.153|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 15710 (15K) [application/pgp-keys]
Saving to: ‘CHANGELOG.txt.asc’

CHANGELOG.txt.asc               100%[====================================================>]  15.34K  --.-KB/s    in 0.001s

2024-02-16 12:27:24 (10.0 MB/s) - ‘CHANGELOG.txt.asc’ saved [15710/15710]

$ grep SHA256 *asc
CHANGELOG.txt.asc:bitaddress.org-v3.3.0-SHA256-dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194.html

```

But really you need to independently verify the PGP signature using public keys from an independent trusted source.

> **Comments:**
> **username_0**: Thank you very much! I can find the public key here: https://www.bitaddress.org/pointbiz_bitaddress.org.asc As well as here https://bitcointalk.org/index.php?topic=43496.0 and here https://github.com/king7777/pointbiz.github.io/blob/master/ninja_bitaddress.org.txt This is what you mean by "independently verify the PGP signature using public keys from an independent trusted source", right?  
> **username_1**: Yes, that is what I meant.  
> **username_0**: I just noticed that the .asc file from the last link differs from the first two. Nonetheless I get a good signature and the same primary key fingerprint for both files. The last file also gives me an additional good signature from "pointbiz <pointbiz@bitaddress.org>". I think these are just two versions from the same key, right?  

---

