Menu ▾ ▴

Home

RedoSan

RedoSan Authenticity

A comprehensive, 100% client-side digital authenticity suite — watermark images, audio, and documents; fingerprint files with 21 hash algorithms; inject pixel data with 23 advanced algorithms; sign media with C2PA Content Credentials; create OpenTimestamps proofs; generate Decentralized Identity (DID) keypairs; produce Digital Passport certificates; analyze forensic tamper signals; convert between file formats; register and verify face, iris, and voice biometrics; strip metadata with the removal tools; and generate unique identifiers — all without uploading a single byte to any server.

Overview

RedoSan Authenticity is an all-in-one authenticity verification suite designed for journalists, artists, photographers, musicians, forensic analysts, content creators, and developers who need to prove the provenance and integrity of digital media. Unlike SaaS solutions that require uploading your files to third-party servers, every algorithm runs locally in your browser or via the Node.js CLI. The entire processing pipeline — from fingerprint extraction to C2PA signing — happens on your machine with zero network calls (except OpenTimestamps, which contacts timestamp servers, and first-run model/CDN loads for biometrics).

The project evolved from a Python proof-of-concept into a production-grade JavaScript application with a dual-interface design: a Simplified Mode (10-step wizard) for one-click pipeline execution and a Professional Mode with per-algorithm control. The browser uses an MPA (Multi-Page Application) architecture where each tool has its own standalone page at Style/pages/{name}/index.html, allowing direct linking and deep navigation while the AJAX router keeps audio playback and sidebar state intact.

The suite includes 20+ tools, 6,200+ passing tests across 107 unit test files + 59 E2E suites, 77 CI/CD workflows, and support for 8 languages. The repository maintains zero open alerts across CodeQL, Dependabot, and Secret Scanning.

What's New in v2.0.0

  • npm-ready CLI — package fully prepared for npm publication (bin wiring, metadata, staged-publish workflow with tag/version verification), version aligned to 2.0.0
  • Security hardening — CLI tool names no longer pass through a shell (command-injection fix), perceptual hashes wired into the fingerprint CLI, patched dependencies, Scorecard advisories cleared, two-tier npm-audit policy
  • Contribution readiness — full GPL-2.0 text, Code of Conduct, issue templates, discovery labels, 12 curated good first issue tasks; listed on up-for-grabs.net, CodeTriage, and goodfirstissue.org
  • Community — first external contributions merged, fork-safe PR bots, issue-hygiene automation
  • Quality — 107 unit test files + 59 E2E suites (6,200+ tests), 77 CI workflows, knip/depcheck ignore-policy alignment, two-phase release workflow with changelog + SBOM
v1.9 — Voice Biometric, README Automation - **Voice Biometric** — in-browser voice tool: 3-minute recorder with VAD, ECAPA/WavLM ONNX embeddings, anti-spoof + liveness, encrypted template protection, C2PA audio provenance; cross-origin isolation with proxy-worker fallback - **README auto-update bot** — generated sections (testing stats, workflow tables, release summaries) stay in sync automatically
v1.8 — Iris Biometric i18n, Quality Gates, Release Automation - **Iris Biometric i18n** — full 8-language support for the iris tool plus standalone-page translation loading - **Quality gates** — Lighthouse + performance category gates, Stryker mutation testing, c8 coverage gate, two-tier npm-audit policy - **Release automation** — release-drafter, git-cliff changelogs, SBOM generation, slash-command bot, uptime monitoring - **Tooling** — oxlint pre-commit gate, husky hooks (whitespace / large-file / pre-push / deps refresh), dev tooling centralized in `.tools/Developer_Toolkit`
v1.7.1 — Face Biometric Hardening, i18n, SEO & Security - **Face Biometric hardening** — WebAuthn PRF vault (passphrase replaced), session-scoped consent, anti-spoof + liveness, ArcFace ONNX, auto-register passkey - **i18n keyless fallback** — Google Web Translate + MyMemory fallback for missing keys (no API key required) - **SEO** — canonical URLs, followable MPA links, sitemap + robots for all pages - **Security** — CodeQL XSS fix, SECURITY.md disclosure policy, 0 npm vulnerabilities remaining

See [Changelog] for the full release history.

Feature Matrix

Feature Browser CLI Description
Fingerprinting ✓ ✓ 21 hash algorithms (17 cryptographic + 4 perceptual: pHash, aHash, dHash, wHash)
Image Watermarking ✓ ✓ 9 core algorithms (LSB, DCT, Neural SS, Latent DCT, Zero-bit, Multi-bit, Forensic, Fragile, Imatag) + 4 perceptual detection modes
Audio Watermarking ✓ ✓ 8 algorithms for WAV files (LSB, Phase Coding, Echo Hiding, DSSS, QIM, DWT, Patchwork, DCT)
Document Watermarking ✓ ✓ 5 text techniques for TXT/DOCX/PDF (Whitespace, ZWC, Synonym, Line-Shift, Word-Shift)
Pixel Injection ✓ ✓ 23 algorithms in 4 categories (Spatial 4, Frequency 4, Deep Learning, Professional)
C2PA Provenance ✓ ✓ Read/write/verify C2PA manifests, ECDSA signing, JPEG APP11 + PNG c2pa chunk
OpenTimestamps ✓ ✓ Create/verify/upgrade .ots proofs anchored to Bitcoin blockchain
Metadata Analysis ✓ ✓ EXIF, XMP, IPTC, PNG chunk parsing, GPS coordinates
Forensic Analysis ✓ ✓ Error Level Analysis (ELA), noise heatmaps, JPEG structure analysis, copy-move detection
Decentralized ID (DID) ✓ ✓ DID:key generation (Ed25519, P-256, RSA), Base58 encoding, signing & verification
Digital Passport ✓ ✓ PDF/DOCX/EPUB certificate with QR code, fingerprint/watermark/C2PA evidence, user info
File Converter ✓ ✓ FFmpeg.wasm-based conversion between image/audio/video formats
Face Biometric ✓ — Register & verify face descriptors with WebAuthn PRF vault, anti-spoof + liveness, ArcFace ONNX ([Face Biometric])
Iris Biometric ✓ — In-browser iris capture with quality assessment, liveness/anti-spoof, encrypted templates ([Iris Biometric])
Voice Biometric ✓ — 3-minute recorder with VAD, ECAPA/WavLM embeddings, anti-spoof, C2PA audio provenance ([Voice Biometric])
Removal Tools ✓ — Strip watermarks, fingerprints, metadata, EXIF, thumbnails, and GPS from images/audio
ID Forge ✓ ✓ UUID v4/v7, ULID, NanoID, SWHID generators with bulk mode
AI Pipeline ✓ — 10-step wizard: Upload → AI Question → User Info → Fingerprint → Timestamp → Watermark → Pixel Injection → C2PA → Certificate → Done
Assistant Chatbot ✓ — Raido bilingual (AR/EN) chatbot with 80+ intent patterns

AI Pipeline (Simplified Mode)

The simplified mode provides a guided 10-step wizard that automates the entire authenticity workflow:

  1. Upload — Drag-and-drop file with 68-extension blocklist + magic byte validation
  2. AI Question — Describe what the image should contain (human verification context)
  3. User Info — Name, phone (46-country dropdown with auto-detection), email, website, social/music links
  4. Fingerprint — Computes all 17 cryptographic + 4 perceptual hashes automatically
  5. Timestamp — Creates an OpenTimestamps proof anchored to the Bitcoin blockchain
  6. Watermark — Invisible watermark embedding with password protection (algorithm selected based on image type)
  7. Pixel Injection — Injects the timestamp proof into pixel data using enhanced LSB
  8. C2PA Signing — Wraps watermarked+pixel-injected image with a C2PA manifest (C2PA must be LAST because canvas toBlob() strips C2PA chunks)
  9. Digital Passport — Generates a PDF certificate with the full provenance chain
  10. Done — Download the signed image + certificate with all evidence

Key Design Decisions

  • 100% client-side: No backend, no server uploads, no third-party authentication. All processing occurs in the browser or local CLI.
  • CLI reuses browser algorithms: The Node.js CLI loads browser JS files via vm.runInContext() with browser API polyfills (canvas, crypto.subtle, ImageData), avoiding code duplication.
  • Dual-mode architecture: SPA (index.html, hash routing) + MPA with 23 standalone pages at Style/pages/{name}/index.html. The MPA router (mpa-router.js) enables seamless AJAX navigation and hides stale results on page swap.
  • On-device biometrics: Face, iris, and voice templates are generated, stored encrypted (WebAuthn PRF vault for face), and matched locally — they never leave the device.
  • CDN libraries pinned with SRI: jsPDF, docx, QRious, JSZip, LameJS, FFmpeg.wasm are loaded from CDN with integrity + crossorigin attributes.
  • C2PA is always the last step: canvas toBlob()/toDataURL() strip C2PA chunks, so C2PA signing must be the final pixel-level operation.
  • Domain origin self-check: Every browser JS file wraps its code in an IIFE that verifies window.location matches redo-san.github.io, localhost, or 127.0.0.1. On untrusted domains, the code silently refuses to execute.
  • Service Worker as security layer: The SW blocks 61 dangerous extensions, enforces JS/CSS/HTML/YML/JSON/CDN whitelists, detects embedded URLs at 3 encoding levels, and protects logo files from hotlinking. See [Security].
  • 8-language internationalization: Full UI translation in Arabic, German, English, Spanish, French, Japanese, Korean, and Chinese, with RTL support.
  • Staged npm publishing: The CLI package (redosan-authenticity-cli) is prepared for npm with a staged-publish workflow (OIDC staging + human 2FA approval) — dual-use policy compliance requires staging, not direct publish.

Project Structure

RedoSan-Authenticity/
├── cli/                          # Node.js CLI (Commander.js, 14 commands)
│   ├── index.js                  # Entry point (fingerprint, watermark, metadata,
│   │                             #   timestamp, c2pa, pixel-injection, audio-watermark,
│   │                             #   forensic, did, certificate, document-watermark,
│   │                             #   converter, upgrade, tools)
│   ├── menu.js                   # Interactive numbered menu
│   ├── utils.js                  # Polyfills, file I/O, text extraction, PDF/DOCX helpers
│   ├── commands/                 # CLI command handlers (12 modules)
│   ├── lib/id_forge.js           # ID generation (uuidv4/v7, ulid, nanoid, swhid)
│   └── tests/                    # 107 unit test files + 59 E2E suites (6,200+ tests)
├── Watermark/                    # 9 image watermark algorithms + perceptual detection
├── Audio_Watermark/              # 8 audio watermark algorithms (WAV)
├── Pixel_Injection/              # 23 pixel algorithms (4 categories)
├── Document_Watermark/           # 5 text/PDF/DOCX watermark techniques
├── Fingerprint/                  # 17 cryptographic + 4 perceptual hashes
├── C2PA/                         # C2PA provenance + CBOR
├── Certificate/                  # Digital Passport (PDF, DOCX, EPUB, OTS, utils)
├── Face_Biometric/               # Face detection, WebAuthn vault, registration, matching
├── Iris_Biometric/               # Iris capture, quality, liveness, template protection (11 files)
├── Voice_Biometric/              # Voice VAD, ECAPA/WavLM embeddings, anti-spoof (19 files)
├── Decentralized_Identity_DID/   # DID:key, Ed25519/P-256/RSA
├── Timestamp/                    # OpenTimestamps create/verify/upgrade
├── Metadata/                     # EXIF reader
├── Forensic/                     # ELA, noise, JPEG markers, copy-move
├── ID_Forge/                     # UUID v4/v7, ULID, NanoID, SWHID
├── Converter/                    # FFmpeg.wasm image/audio/video/doc/subtitle
├── Removal_Tools/                # Metadata/watermark/fingerprint stripping
├── Assistant/                    # Raido chatbot (80+ intents, AR+EN)
├── Style/                        # Browser frontend
│   ├── shared.js / shared_validation.js / navigation.js / mpa-router.js
│   ├── i18n.js / search.js / music-player.js / simplified*.js
│   ├── style.css / responsive.css / rtl.css
│   ├── lang/                     # i18n-data.js + 8 language files
│   └── pages/                    # 23 standalone MPA pages
│       └── {name}/index.html     # One per tool + home/about/contact/privacy/search/social
├── vendor/                       # pdf-lib, jspdf, jszip, qrious, opentimestamps
├── .github/workflows/            # 77 CI/CD workflows
├── sw.js                         # Service Worker (threat blocking, whitelists)
├── 404.html                      # Threat-detection themed 404
└── index.html                    # SPA entry point (hash routing, 20+ sections)

Related

Wiki: API Reference
Wiki: Architecture
Wiki: Changelog
Wiki: FAQ
Wiki: Face Biometric
Wiki: Installation
Wiki: Iris Biometric
Wiki: Security
Wiki: Usage Guide
Wiki: Voice Biometric
Wiki: _Sidebar

auth0 logo