Evidence methodology

How a saved screenshot is recorded

What the capture record contains

Each saved screenshot records the source URL, capture time, image dimensions and the capture options available to the renderer. When a country was requested, the page labels it as a requested location. An observed network exit location is shown separately when it was recorded.

The saved image

The save flow promotes the exact preview bytes into permanent storage instead of rendering the page again. Scheduled captures store the bytes returned by that run directly.

Verify a downloaded file

The SHA-256 fingerprint on a screenshot page identifies the stored image bytes. The “Verify stored image in browser” button fetches the image and calculates its fingerprint in your browser.

To check a downloaded copy independently, run one of these commands and compare its 64-character result with the screenshot page:

  • macOS or Linux: shasum -a 256 /path/to/screenshot.png
  • Windows PowerShell: Get-FileHash C:\path\to\screenshot.png -Algorithm SHA256

For a record outside site-shot.com, copy the fingerprint into the document where you cite the screenshot. That independent record lets a later reader detect a different file.

Limits of the evidence pack

The PDF is built on request from a public screenshot link, so it carries two bounds. Very tall or very large screenshots are not reproduced inside the document, and a screenshot printed across many pages may be truncated; in both cases the PDF says so on a page of its own, in those words, rather than ending without one. The capture record, the fingerprint and the verification instructions are printed either way, and the image itself always remains available at its own link.

Each screenshot link will also build a limited number of packs per day. Past that the request is answered with HTTP 429 and a Retry-After header instead of a document; the same link works again the next day. Nothing about the saved screenshot changes when this happens.

What this does not claim

site-shot.com is not a court, not a certification authority and, unless a capture explicitly says otherwise, does not attach an independent trusted timestamp. A fingerprint by itself does not prove when a file first existed; it verifies file identity against a recorded value.