LiveVerify Browser Extension

Verify claims on web pages with one click. Select text, right-click, check the hash against the issuer's domain.

Install from Chrome Web Store

Published on the Chrome Web Store — works in Chrome and Edge.

What it does

Select any text on a web page that includes a verify: line
Right-click and choose "Verify this claim" (or press Ctrl+Shift+V)
The extension normalizes the text, computes a SHA-256 hash (Wikipedia · Google search — pick any article or video; they all explain why sending a hash is safe), and checks the issuer's endpoint
Green = verified. Red = fails verification. The issuer's domain is always visible.

Features

Right-click verification — Select text, right-click, verify
Keyboard shortcut — Ctrl+Shift+V (Mac: Cmd+Shift+V)
Auto-detect — Automatically finds and verifies verifiable-text HTML markers on pages
Session history — See your recent verifications in the popup (cleared when you close the browser)
"Show me" button — Scrolls to and highlights verified claims on the page
Authority chain — See who vouches for the issuer's authority
Domain mismatch detection — Warns when a verified claim names a different site than the one you're on
Adjustable intrusiveness — Choose how prominently verification results are displayed

Screenshots

Screenshots will be added before Chrome Web Store submission

Roadmap

Trustworthiness improvements

Tether line from toolbar badge to verified region — A visual line drawn from the extension's badge in the browser toolbar down to the verified claim in the page. This line crosses the boundary between browser chrome and page content — something page JavaScript cannot do. It provides unforgeable visual proof that the extension (not the page) produced the result. Requires a new browser API from Chrome/Firefox/Edge; we plan to propose this to browser vendors.
Off-screen region hints — When verified claims are above or below the current scroll position, directional indicators (↑ ↓) appear on the toolbar badge. Clicking cycles through claims, scrolling each into view.
Shadow DOM isolation — Move all extension-injected UI into a closed shadow root, making it impossible for page JavaScript to modify verification results via DOM manipulation or CSS overrides.

Security hardening

Invisible character stripping — Strip zero-width Unicode characters from selected text before hashing, preventing attackers from poisoning input to break legitimate verification.
Homoglyph detection — Warn when a verify: URL contains mixed-script characters (e.g., Latin + Cyrillic), which could indicate a domain spoofing attempt.
Domain mismatch warnings — For claims designed to appear on third-party sites (reseller authorizations, insurance panel membership, etc.), warn when the verified claim names a different site than the one you're on.

Integration

PDF verification — Verify claims in PDF documents opened in the browser, not just web pages.
Email client integration — Verify claims in web-based email clients (Gmail, Outlook) without leaving the inbox.
Contract exchange protocol — Support for the append-only contract signing protocol, where the browser extension participates in verifying signing receipts.

See the issue tracker for current status and discussion.

Privacy

LiveVerify has no server, no analytics, no accounts, and no tracking. All processing happens in your browser. See the full privacy policy.

Compatibility

Chrome — Full support (Manifest V3)
Edge — Full support (Chromium-based, same extension)
Firefox — Compatible with minor manifest adjustments

Source code

LiveVerify is open source under the Apache 2.0 license. Source code and issues at github.com/live-verify/live-verify.

What's in the extension

The packaged extension contains only the files listed below. No bundler, no minification, no obfuscation — the code that runs in your browser is the code you can read in the repository.

File	Purpose
`manifest.json`	Extension configuration (Manifest V3): permissions, content scripts, keyboard shortcuts, icons
`background.js`	Service worker: handles verification requests, context menu, notifications, authority chain lookups
`content.js`	Content script: scans pages for `verifiable-text` HTML markers, auto-verifies marked regions, highlights results
`popup/popup.html`	Popup UI: verification history for the current session
`popup/popup.js`	Popup logic: renders history, "Show me" scroll-to-claim feature
`settings/settings.html`	Settings page: intrusiveness level, auto-scan toggle
`settings/settings.js`	Settings logic: reads/writes preferences to `chrome.storage`
`shared/normalize.js`	Text normalization and SHA-256 hashing — auto-generated from the canonical `public/normalize.js`
`shared/verify.js`	Verification logic: URL extraction, endpoint fetching, hash comparison — auto-generated from `public/app-logic.js`
`shared/domain-authority.js`	PSL-based registrable domain extraction — auto-generated from `public/domain-authority.js`
`shared/psl.js`	Public Suffix List library (vendored UMD build of psl)
`shared/notification-message.js`	Notification formatting helpers
`icons/icon-16.png`	Toolbar icon (16px)
`icons/icon-48.png`	Extension management icon (48px)
`icons/icon-128.png`	Chrome Web Store icon (128px)
`icons/icon-verified-128.png`	Verified state icon
`icons/icon-failed-128.png`	Failed state icon

Files in shared/ are auto-generated by https://github.com/live-verify/live-verify/blob/main/scripts/sync-shared.js from the canonical sources in public/. They are not hand-edited. The SVG source files for icons are in the repository but excluded from the packaged extension.

Network note: Only shared/verify.js makes external network requests — HTTPS GET calls to issuer verification endpoints and their verification-meta.json metadata. No other file in the package communicates with any server. All other references to get or fetch in the codebase are reads from chrome.storage (local browser storage).