← Back to app

Integrity Verification

HeyMark is an open-source, privacy-first PDF to Markdown converter. All PDF parsing, OCR, and conversion happen locally in your browser. No file content is ever transmitted to any server.

How to verify using DevTools

• Open HeyMark in your browser, then open DevTools (F12 or Cmd+Option+I).
• Go to the Network tab. Make sure "All" is selected.
• Upload a PDF and perform a conversion.
• Verify that all requests go only to heymark.pages.dev (or your custom domain). There should be zero requests to any third-party origin.

How to verify the app

• On the main app page, click VERIFY in the footer.
• The app fetches /release-hash.json — a manifest listing a SHA-256 hash for every runtime asset (the HTML, app script, styles, the pdf.js and Tesseract workers, the WebAssembly cores, and the OCR language data).
• It then re-fetches each of those files, hashes the raw bytes locally, and compares them to the manifest — reporting how many of the files match and naming any that do not.
• If every file matches, the code and assets running in your browser are byte-for-byte identical to the published release. All hashing happens in your browser; nothing is uploaded.

How to verify manually

• Clone the repository: git clone https://github.com/OliverStills/HeyMark
• Check out the release tag matching the version shown in the footer.
• Run node build-hashes.mjs and confirm the regenerated release-hash.json is identical to the one served by the site.
• The manifest's own SHA-256 is published in the GitHub release notes, so you can confirm the manifest itself has not been altered.

Source code

The full source is published on GitHub. Builds are intended to be reproducible — the binary you run should match what's in the repository.

github.com/oliverstills/heymark ↗

What this page does NOT protect against

• A compromised host OS or browser extension that intercepts data before it reaches this app.
• Physical access to your machine.
• The CDN or hosting provider serving different code than what's in the repository (mitigated by the hash check above).