Verify

Do not take our word for it.

Every page here says nothing is uploaded. That is a claim, and a claim from a website you have never heard of is worth very little on its own. This page is how you check it yourself, in about a minute, without trusting anybody.

The one minute version

1

Open the network tab

Press F12, or Command-Option-I on a Mac, and choose Network. Tick "Preserve log" so nothing disappears on you.
2

Go and use a tool with a real file

Open SEAL or X-RAY, give it an actual document, and let it finish. Use something big enough that an upload would be obvious.
3

Sort by size and look at what left

You will see the page, the stylesheet and the scripts come down. You will not see your document go up, because no request carries it. Filter to Fetch/XHR and there is nothing there at all.
4

Then pull the plug

The stronger test. Load the tool, turn off your wifi, and use it anyway. It works, because everything needed to do the job is already in the tab. Software that was quietly sending your file somewhere cannot do that.

What the browser enforces, whatever we say

The checks above depend on you looking. These do not: they are sent as headers on every response and enforced by your browser, not by us. You can see them in the same network tab, under Response Headers on the document request.

connect-src 'self'

The page is only permitted to make network requests back to obscuraos.com. If a script here tried to send your document to any other domain, the browser would block the request and log a violation. This is the important one, and it is worth being precise about what it does not cover: it still permits a request back to this site's own origin. That part is what the network tab check above is for.

microphone=(), geolocation=()

Disabled outright. This site cannot ask for your microphone or your location, and the browser will refuse on your behalf even if a future version of the code tried. Camera is allowed only for the tools that read a code off the screen, and only when you press the button.

form-action 'self'

A form on this site cannot submit anywhere except back to this site. There is no way to post what you typed to a third party, including by accident.

object-src 'none', base-uri 'self'

No plugins, and the page cannot rewrite the base address that relative links resolve against, which is a common way injected code redirects requests elsewhere.

default-src 'self'

Scripts, styles, fonts and images all have to come from this origin. Nothing here loads a third-party script, so there is no analytics vendor, no tag manager and no advertising code that could read the page around it.

One exception, stated rather than buried: Cloudflare's privacy-preserving page-view counter is permitted, and it records a page address and timing. It never sees a file you opened. If you would rather it did not run at all, a content blocker stops it and nothing on the site breaks.

Check the code you were served

This computes a SHA-256 of the actual files your browser just received from this site, right now, on your machine. It is not reading a published list. It is hashing what you got.

What that proves, and what it does not

It proves what reached you. The useful thing to do with it is compare: run this on a different machine, on a different network, in a different country, or ask somebody else to run it and send you their list. If the hashes match, nobody is being served a special build. A site that behaved one way for auditors and another way for everyone else would not survive that comparison.

It does not prove the code is safe, because a hash says nothing about what the code does. If you want that, the files are plain readable JavaScript served from this origin, they are not obfuscated, and you can open any of them in a browser tab and read them. That is a real afternoon of work rather than a one-minute check, and for most people the network tab and the offline test are the ones that settle it.

If you find something wrong

Write to [email protected]. A claim like the one on the front of this site is only worth making if it is falsifiable, and if it turns out to be false somewhere then that is a bug worth fixing quickly and saying so publicly.

None of this is a certification and there has been no third-party audit. It is the evidence a person can gather themselves in a few minutes, laid out so it is easy to gather. That is a smaller claim than a compliance badge, and it has the advantage of being checkable.