Usage Guide

Usage Guide

RedoSan Authenticity provides three interfaces: a Node.js CLI, a Simplified Browser Mode (10-step wizard), and a Professional Browser Mode (per-algorithm control). All three share the same underlying algorithms.

---

1. Command Line Interface (CLI)

Interactive Menu

node cli/menu.js

Launches a numbered interactive menu covering all tools (fingerprint, metadata, watermark, pixel injection, audio watermark, timestamp, C2PA, forensic, DID, certificate, converter, document watermark, ID forge, help). The menu is a wrapper that invokes cli/index.js — it is not a redosan subcommand.

Direct Subcommands

All operations are available as direct CLI commands (redosan <command>):

Fingerprint

# All default algorithms (17 cryptographic + 4 perceptual)
redosan fingerprint image.png

# Specific algorithm
redosan fingerprint image.png -a sha256

# JSON output
redosan fingerprint image.png -j

# Save to file
redosan fingerprint image.png -o output.json

Selectable algorithms for -a: sha1, sha256, sha384, sha512, sha3, blake2b, blake3, md5, ripemd160, whirlpool, all (default). The all output additionally includes SHA-224, SHA-512/224, SHA-512/256, BLAKE2s, SHAKE128/256, SHAKE256/512 and the four perceptual hashes (pHash, aHash, dHash, wHash).

Metadata

# Read all metadata
redosan metadata image.jpg

# JSON output
redosan metadata image.jpg -j

# Save to file
redosan metadata image.jpg -o metadata.json

Extracts EXIF, XMP, IPTC, PNG chunk data, file statistics, and GPS coordinates.

Watermark

# Embed watermark
redosan watermark embed -i image.png -s secret.txt -o output.png -a lsb -p password

# Extract watermark
redosan watermark extract -i output.png -o extracted.txt -a lsb -p password

9 core algorithms: LSB, DCT, Neural SS, Latent DCT, Zero-bit, Multi-bit, Forensic, Fragile, Imatag. Detection supports four perceptual hash modes.

Audio Watermark

# Embed watermark into WAV
redosan audio-watermark embed audio.wav -s secret.txt -o output.wav -a lsb -p password

# Extract watermark from WAV
redosan audio-watermark extract output.wav -o extracted.txt -a lsb -p password

# List available algorithms
redosan audio-watermark --help

8 algorithms: lsb, phase_coding, echo_hiding, dsss, qim, dwt, patchwork, dct.

Pixel Injection

# Embed using enhanced_lsb
redosan pixel-injection embed -i image.png -s secret.txt -o output.png -a enhanced_lsb

# Embed using dct
redosan pixel-injection embed -i image.png -s secret.txt -o output.png -a dct

# Extract
redosan pixel-injection extract -i output.png -o extracted.txt

# With password
redosan pixel-injection embed -i image.png -s secret.txt -o output.png -a enhanced_lsb -p password

23 algorithms across 4 categories: Spatial (enhanced_lsb, adaptive_lsb, multi_channel_lsb, random_lsb), Frequency (dct, dwt, dft, hybrid_dct_dwt), Deep Learning (vine, pixel_seal, nullguard, shallow_diffuse, diffusion_based), and Professional (imagewmark, meta_seal, stardustmark, invisimark, elevenlikes) — plus 5 detection/analysis modes (statistical detection, ML detection, blind decoding, robustness testing, quality metrics); auto-detect tries them all.

Timestamp

# Create timestamp
redosan timestamp create image.png -o proof.ots

# Verify timestamp
redosan timestamp verify image.png -f proof.ots

Uses the OpenTimestamps protocol with Bitcoin blockchain anchoring.

C2PA

# Sign with C2PA manifest
redosan c2pa sign image.jpg -o signed.jpg --claim "Created by Me" --title "My Photo" --author "Jane Doe"

# Read C2PA manifest
redosan c2pa read image.jpg

# Verify C2PA
redosan c2pa verify image.jpg

Supports JPEG (APP11 marker) and PNG (c2pa chunk before IDAT).

Forensic Analysis

# Analyze image for tampering
redosan forensic image.png

# JSON output
redosan forensic image.png -j

# Save to file
redosan forensic image.png -o forensic.json

Performs Error Level Analysis (ELA), noise inconsistency detection, JPEG structure analysis, copy-move detection, and metadata anomaly detection.

DID Identity

# Generate Ed25519 keypair
redosan did generate --algo Ed25519 -o identity.json

# Generate P-256 keypair
redosan did generate --algo P-256 -o identity.json

# Sign a file fingerprint
redosan did sign fingerprint.json -o signed.json

# Sign with custom key
redosan did sign fingerprint.json --key identity.json -o signed.json

Creates DID:key documents with Base58-encoded public keys.

Certificate (Digital Passport)

# Generate PDF certificate
redosan certificate image.png -o passport.pdf

# Generate DOCX certificate
redosan certificate image.png -o passport.docx --format docx

# Generate EPUB certificate
redosan certificate image.png -o passport.epub --format epub

# With full metadata
redosan certificate image.png -o passport.pdf --name "Jane Doe" --email "jane@example.com" --fingerprint fingerprint.json --timestamp proof.ots

The certificate includes QR code, fingerprints, timestamps, watermark data, and user identity.

Document Watermark

# Embed watermark in text file
redosan document-watermark embed -i document.txt -m "Hidden message" -o output.txt

# Embed with password and algorithm
redosan document-watermark embed -i document.txt -s secret.txt -o output.txt -a 1 -p password

# Extract watermark
redosan document-watermark extract -i output.txt -o extracted.txt -p password

Algorithms: 1=Zero-Width Character (ZWC), 2=Homoglyph, 3=Whitespace, 0=Auto (default: 1).

Converter

# Convert image format
redosan converter image.png -f webp -o image.webp

# Convert to JPEG
redosan converter image.png -f jpg -o image.jpg

# Convert audio format (via FFmpeg)
redosan converter audio.wav -f mp3 -o audio.mp3

Uses FFmpeg.wasm for audio/video conversion in the browser; Node.js CLI delegates to system FFmpeg.

Upgrade Command

# Upgrade an incomplete OpenTimestamps proof
redosan upgrade proof.ots -o upgraded.ots

This command contacts the OpenTimestamps calendar aggregator to complete a pending timestamp.

Tools Check

# Check availability of external tools
redosan tools

Checks for exiftool, sox, ImageMagick, FFmpeg, and other optional dependencies.

ID Forge (standalone script)

# Generate UUID v4
node cli/lib/id_forge.js uuidv4 5

# Generate NanoID
node cli/lib/id_forge.js nanoid 15 --json

# Generate SWHID from a file
node cli/lib/id_forge.js swhid document.txt

# All supported types: uuidv4, uuidv7, ulid, nanoid, swhid, all
node cli/lib/id_forge.js all 5

Usage: node cli/lib/id_forge.js <uuidv4|uuidv7|ulid|swhid|nanoid|all> [count|file] [--json|--csv]. In the browser, the same generators are available on the ID Forge page.

File Validation

All CLI commands pass through a 6-layer file validation pipeline:

Layer	Check	Bypass
1. Extension	Blocks 60+ dangerous extensions (.exe, .sh, .py, .elf, etc.)	--allow-dangerous
2. Magic Bytes	Validates PNG (89 50 4E 47) and JPEG (FF D8 FF) headers	--allow-dangerous
3. Content Scan	Detects <script>, onerror=, javascript: in file content	--allow-dangerous
4. Document Threats	Scans PDF for embedded JS, OpenAction, oversized files (10MB limit)	--allow-dangerous
5. File Structure	Checks PNG IEND and JPEG EOI markers	--allow-dangerous
6. Pooled Buffer	Uses readFileBytes() that returns raw Buffer (prevents pooled-Buffer reuse attacks)	Always enforced

---

2. Simplified Browser Mode

The simplified mode provides a guided 10-step pipeline:

Step 1: Upload

• Drag-and-drop or click to select an image
• Smart validation: 60+ dangerous extensions blocked, magic bytes verified
• Visual feedback (green border on valid, red on invalid)

Step 2: AI Question

• Describe what the image should contain (for human verification context)
• Optional, can be skipped

Step 3: Fill User Info

• Name: max 25 characters
• Phone: 46-country dropdown with auto-detection via Intl APIs → timezone city map (301 IANA zones); digits-only with warning; per-country maxlength
• Email: regex /^[^\s@]+@[^\s@]+\.[^\s@]+$/, max 20 characters, red warning on invalid
• Website: auto-prefixed https://, regex /^https?:\/\/[^\s/$.?#].[^\s]*$/i, max 30 characters
• Social/Music links: URL validated on input, max 80 characters each

Step 4: Fingerprint

• Automatically runs all 17 hash algorithms + 4 perceptual hashes
• Results displayed in a formatted list

Step 5: Timestamp

• Creates OpenTimestamps proof
• Progress bar displayed during operation

Step 6: Watermark

• Invisible watermark embedding with password
• Algorithm auto-selected based on image properties
• Progress bar with status updates

Step 7: Pixel Injection

• Injects timestamp data into pixel values
• Progress bar displayed during operation

Step 8: C2PA Signing

• Wraps watermarked+pixel-injected image with C2PA manifest
• Must be last step (canvas operations strip C2PA chunks)

Step 9: Digital Passport

• Generates PDF certificate with QR code, all fingerprints, timestamps, user info, C2PA claims

Step 10: Done

• View and download the final signed image
• Download PDF certificate with full provenance chain
• Click result image to open in lightbox overlay
• Clear data button resets all state with confirmation dialog

---

3. Professional Browser Mode

The professional mode provides per-algorithm control in separate sections. Access each tool via the sidebar or directly via its MPA page (23 standalone pages):

Tool	MPA URL	Features
Image Watermark	/Style/pages/watermark/	9 algorithms, embed/extract, password, message
Audio Watermark	/Style/pages/audio-watermark/	8 algorithms, WAV files, embed/extract, capacity estimation
Document Watermark	/Style/pages/document-watermark/	5 techniques, DOCX/PDF/TXT, embed/extract
Fingerprinting	/Style/pages/fingerprint/	21 algorithms (17 crypto + 4 perceptual), download in 7 formats
Pixel Injection	/Style/pages/pixel-injection/	23 algorithms, robustness testing, quality metrics
C2PA	/Style/pages/c2pa/	Sign/read/verify, JPEG + PNG, social/music links
Metadata	/Style/pages/metadata/	EXIF/XMP/IPTC viewer, GPS coordinates
Timestamps	/Style/pages/timestamp/	Create/verify/upgrade OpenTimestamps proofs
Forensic	/Style/pages/forensic/	ELA, noise heatmap, difference detection, copy-move, download report
DID	/Style/pages/did/	Generate Ed25519/P-256/RSA keypairs, sign, verify
Certificate	/Style/pages/certificate/	PDF/DOCX/EPUB passport with QR code
Converter	/Style/pages/converter/	FFmpeg.wasm conversion between all formats
ID Forge	/Style/pages/id_forge/	UUIDv4/v7, ULID, NanoID, SWHID generators
Removal Tools	/Style/pages/removal-tools/	Strip watermarks, fingerprints, metadata, EXIF, thumbnails, GPS
Face Biometric	/Style/pages/face-biometric/	Face registration/verification, WebAuthn vault ([Face Biometric])
Iris Biometric	/Style/pages/iris-biometric/	Iris capture, quality, liveness, template protection ([Iris Biometric])
Voice Biometric	/Style/pages/voice-biometric/	Voice recorder, VAD, ECAPA/WavLM embeddings ([Voice Biometric])
Assistant	Built into sidebar	Raido bilingual chatbot, 80+ intent patterns
Search	Sidebar	Site-wide search across all tools and documentation

---

Internationalization

The browser interface supports 8 languages via a language toggle:

Language	Code	Script
Arabic	ar	RTL
German	de	LTR
English	en	LTR (default)
Spanish	es	LTR
French	fr	LTR
Japanese	ja	LTR
Korean	ko	LTR
Chinese	zh	LTR

All UI text, validation messages, and the Digital Passport PDF are localized. Scientific names in algorithm selectors remain in English regardless of language setting.

Translation data is in Style/lang/:

• i18n-data.js — aggregation file
• i18n-data-{ar,de,en,es,fr,ja,ko,zh}.js — per-language data

The i18n system uses __('key', 'English fallback') pattern. Text that includes HTML uses sanitizeHtml() with a tag whitelist to prevent XSS.

---

Digital Passport Certificate

The Digital Passport is a certificate generated client-side. It is available in PDF, DOCX, and EPUB formats. It includes:

• Header: Tool logo, certificate title, generation timestamp
• Section 1 — File Information: Original filename, file size, image dimensions, MIME type, upload timestamp
• Section 2 — User Information: Name, phone, email, website
• Section 3 — Links: Social media and music platform URLs
• Section 4 — AI Pipeline: AI question/answer context
• Section 5 — Fingerprints: All 17 hash values and 4 perceptual hashes in a table
• Section 6 — Timestamp: OTS hash, timestamp file (basename), verification status
• Section 7 — C2PA: C2PA claim information
• Section 8 — Watermark: Watermark algorithm, message, password hint
• Section 9 — DID: DID document, key information, signature
• Footer: Verification QR code pointing to the GitHub Pages URL

The certificate is downloaded automatically when the pipeline completes or can be generated independently from the Professional mode Certificate tool.

---

Multi-Page Application (MPA) Navigation

Each tool is available as a standalone page at Style/pages/{name}/index.html. The MPA router (mpa-router.js) enables seamless navigation between pages:

• Direct URLs: Bookmark or share direct links to any tool
• AJAX navigation: Clicking internal links fetches the target page via AJAX, preserving the audio player, sidebar state, and all JS state
• popstate support: Back/forward browser buttons work correctly with cached page states
• Content caching: Pages are cached in sessionStorage for instant revisit
• Full-page redirect: Removal tools always navigate as a full page (content policy)

The SPA entry point (index.html) remains fully functional with hash-based routing for users who prefer the single-page experience.

---

Related

• [Home]
• [Installation]
• [Architecture]
• [API Reference]
• [FAQ]