How to capture a web page as evidence that holds up
A listing, a post, a price, a set of terms, a comment about you: pages change and disappear. A record that stays credible is built piece by piece, like a case file. Here is every piece, in order.
Not legal advice. This is practical record-keeping guidance. Rules of evidence differ by country and court, so ask a lawyer what your case needs.
- Captured
- 2026-10-11 14:32:07 UTC+02:00
- SHA-256
- 5891b5b522d5df08…e846f6be03
- By, how
- Your name, full-page capture, 1280 px
What a credible record of a web page contains
The full address
The complete URL, with path and query string, as text you can copy. Not just the site name.
Date, time and time zone
When the capture was made, to the second, with the zone or UTC offset written out.
The whole page
Top to bottom, not a crop, so the surrounding context is there to read.
A hash of each file
A SHA-256 value computed right after capture, so any later change to the file shows.
Who captured it, and how
A name, the tool and its settings, the device or service, written down the same day.
Chain of custody: six steps from capture to presentation
A chain of custody is the written history of a record from the moment it was made. Each step below closes one question an opponent could ask: which page, when, unchanged since, kept by whom.
- 1
Before you capture
Decide what the record has to show, and write the address down before you touch anything.
- Copy the exact URL into a note, including everything after the question mark.
- Note whether you are logged in, and which account, country and language the page is being shown to.
- Do not contact the author or report the content until you have captured it: pages get edited and deleted.
- 2
Capture
Take the whole page in more than one form, each from the same address, minutes apart at most.
- A full-page screenshot (PNG) of the page from top to bottom.
- A PDF of the same page, which keeps the text selectable and searchable.
- The saved HTML source where you can get it, plus a close-up of the key passage that also exists inside the full-page capture.
- 3
Fix the moment
Tie the files to a point in time and make later changes detectable.
- Compute a SHA-256 hash of every file and paste the values into your note.
- Record the date, the time and the time zone of each capture.
- Get a time reference you do not control: a save in a public web archive, or a timestamp from a timestamping service.
- 4
Store
Keep the originals untouched and work only on copies.
- Put the original files in one folder and never open them in an editor that saves over them.
- Keep a second copy somewhere else: another drive or another storage account.
- Annotate, crop and highlight copies only, and name them as copies.
- 5
Document
Write the short log that lets someone else, or you in two years, say how each file came to exist.
- For each file: the URL, date and time, who captured it, the tool and its settings, the hash.
- Every later event: who copied the files, where to, and when.
- Anything unusual: a cookie banner you dismissed, a login you used, a part of the page that would not load.
- 6
Present
Hand over the original files and the log together, and let the reader check them.
- Give the untouched files with their hashes, and marked-up copies separately.
- Show the full page first, then the close-up, so the passage is seen in its place.
- Have the person who made the capture ready to say what they did. Ask a lawyer what form the court or authority in your case expects.
Which capture method gives the strongest record?
Capture methods can be ordered by how much is left for an opponent to question. Each step up the ladder removes one doubt. The order is practical reasoning, not a legal ranking: no step guarantees that a court accepts the record.
- 1
A cropped phone screenshot
- What it shows
- That someone holds an image showing these words.
- What can still be challenged
- Which page it came from, when, what surrounded it, and whether the image was edited.
- 2
A full-page screenshot with the URL and the time recorded
- What it shows
- What the whole page looked like, at a stated address and moment.
- What can still be challenged
- Whether the stated time and address are right, and whether the file changed afterwards.
- 3
Full-page screenshot, PDF and saved HTML together
- What it shows
- The same content in three forms that agree with each other, with text that can be searched.
- What can still be challenged
- Still your own word for the time of capture and for the files being unchanged.
- 4
The same set, with hashes and an independent timestamp
- What it shows
- That these exact files existed by a certain time and have not changed since.
- What can still be challenged
- That the files match what the site really served: a hash fixes a file, it does not vouch for its origin.
- 5
A capture by an independent third party or a public archive
- What it shows
- That someone with no stake in the dispute recorded the page at that address.
- What can still be challenged
- Completeness (archives can miss scripts, images or logged-in content) and how the archive works.
- 6
A capture recorded by a notary or court officer, where that exists
- What it shows
- What an official witness saw at the address, in a form that legal system already knows.
- What can still be challenged
- Availability, cost and weight differ by country. Ask a lawyer whether it exists where you are.
What to capture for each situation
What to capture depends on what the page is. In every case the full-page capture comes first, and the detail that makes it usable later is the context a screenshot alone does not hold.
| Situation | What to capture | Extra context to record | How often |
|---|---|---|---|
| Online review or comment | The full page with the comment in its thread, and the direct link to the comment if the site has one. | Author name and profile address, the posted date shown by the site, replies, rating, your own view if you replied. | Once at once, and again if it is edited or answered. |
| Marketplace listing or price | The full listing page, plus the basket or checkout page that shows the price actually charged. | Seller name, item number, currency, delivery country, stock status, any discount code applied. | On the day it matters, then at each price change. |
| Terms and conditions | The whole document as a PDF and a full-page screenshot, and the page where the terms are accepted. | Version number or "last updated" date printed in the terms, the language version, the address of each linked policy. | On the day you agree, and whenever the terms change. |
| Social media post (may be deleted) | The post at its own address, the author profile page, and the thread around it. | Handle and numeric account id if shown, post time shown by the platform, whether you were logged in to see it. | Immediately. A second capture later shows whether it was edited or removed. |
| A competitor's ad | The ad where it appeared, with the page around it, and the landing page it leads to. | Search term or placement, device type, country and language the page was shown to, the time of day. | Each time you see it: ads rotate and are targeted, so one capture shows one showing. |
| Your own site at a point in time (compliance) | Each page that carries a regulated statement: prices, disclosures, consent text, terms. | The release or version that was live, who approved it, the device size captured. | On a schedule (daily, weekly or at each release), not after the question arrives. |
What makes a screenshot easy to attack?
A screenshot is easy to attack when it cannot answer where, when, or whether it changed. Six objections come up again and again. None of them has a perfect answer, so each counter below says what it does and stops there.
It could have been edited
Any image can be changed in an editor, and a page can be rewritten in the browser before it is captured.
Counter: Hash the files at capture, keep the originals untouched, and hold a second record that you did not make: a public archive save or a third-party capture.
The URL is missing
Without the address, nobody can say which page, on which site, the image shows.
Counter: Record the full URL as text in your log. A PDF or saved HTML from the same address backs it up.
There is no date
A page changes. An undated capture cannot say which version it shows.
Counter: Write down date, time and time zone, and add a time reference you do not control.
The context was cropped away
A crop can hide a correction, a reply, a "sponsored" label or the sentence before.
Counter: Capture the whole page first. Crops are fine as close-ups of something the full capture also shows.
It is a personalised or logged-in view
A page can differ by account, country, language, device and consent choice.
Counter: Say which view it is. Where the page is public, also capture it from a clean browser that is not logged in, so the record shows what any visitor got.
The content is dynamic
Prices, ads, feeds and counters change between two loads of the same address.
Counter: Capture more than once, record each time, and never present a cached copy as a fresh capture.
How to compute a file hash (SHA-256)
A hash algorithm maps a message of any length to a fixed-length digest, and SHA-256 is one of the algorithms NIST approves in FIPS 180-4.[5] Run one command per file, right after capture, and paste the output into your log.
# macOS
shasum -a 256 capture.png
# Linux
sha256sum capture.png
# Windows (PowerShell)
Get-FileHash capture.png -Algorithm SHA256“If the hash values for the original and copy are the same, it is highly improbable that the original and copy are not identical.”
How a trusted timestamp adds the time
A trusted timestamp binds the hash of a file to a moment, signed by a service that is not you. RFC 3161 describes the protocol: the request to a Time Stamping Authority carries the hash of the data, not the data, and the authority’s role is “to establish evidence indicating that a datum existed before a particular time”.[4]
So the order matters: capture, hash, then timestamp the hash. The page itself never leaves your hands, and anyone can later recompute the hash and compare it with the stamped one.
What the written rules say (United States and European Union)
Three official texts explain why the URL, the hash and the timestamp matter. Each is quoted from its source and applies in one jurisdiction only. None of them is a statement of what a court will accept in your case.
Federal Rules of Evidence, Rule 901(a)[1]
“To satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.”
The person offering the capture has to show it is what they say it is. The examples the rule lists include "Testimony of a Witness with Knowledge" and "Evidence About a Process or System".
Federal Rules of Evidence, Rule 902(14)[2]
“Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12).”
The committee note to this paragraph says such data "are ordinarily authenticated by hash value". Rule 902(13) covers, in similar words, "A record generated by an electronic process or system that produces an accurate result". Both need a certification and advance notice to the other side.
Regulation (EU) No 910/2014 (eIDAS), Article 41[3]
“A qualified electronic time stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound.”
Article 41(1) adds that a time stamp is not to be denied legal effect "solely on the grounds that it is in an electronic form" or that it is not a qualified one. "Qualified" is a defined status with its own requirements in Article 42.
Public archives: what the Wayback Machine saves, and its limits
The Wayback Machine’s Save Page Now makes a copy of a page that is held by the Internet Archive, not by you. That independence is its value for a record. Its own help pages are plain about what it does not do.
What it does
Its limits
- It does not save the pages the page links to, and it does not save multiple pages, directories or whole sites.[9][8]
- Some pages cannot be saved: sites that prohibit crawling, password-protected pages, and some sites whose SSL settings break the capture.[8][9]
- Pages that rely on JavaScript are harder to archive, so a capture can be incomplete. Open the saved copy and check it.[8]
- The help page does not state the time zone of the 14 digits, so do not assume it is yours. It also says the Wayback Machine was not designed with legal use in mind.[8]
In practice: save the page in the archive and make your own full-page capture, minutes apart. The archive copy supports the time and the address, and your capture holds the complete page.
The master checklist
The master checklist is the one-page version of everything above: 12 lines that a careful record of a web page should be able to tick. Go through it once per page you capture.
0 of 12 done. Ticks are not saved: print the page or copy the list into your case notes.
What CurlShot does for a record, and what it does not
CurlShot covers the capture step: a full-page screenshot and a PDF of the same address, rendered away from your own browser. Fixing the moment, storing and documenting stay with you.
A clean view. CurlShot opens the address in a real browser on a server, not in your browser. No account of yours is logged in unless you send login details yourself, so the capture shows what a visitor gets.
Whole page, two forms. full_page=true gives one image of the page from top to bottom. format=pdf gives the whole page as a PDF with text you can select and search. Both come from the same url.
Fresh by default. Caching is off unless you send cache=true, so a plain request renders the page again. Every answer carries an X-Cache header: MISS means the page was rendered for this request, HIT means a stored copy was served.
A reference per request. Every answer carries an X-Reference-Id header. Background jobs (async=true) also report created_at and finished_at times.
No address bar in the image. A server-rendered screenshot shows the page, not a browser window around it. The URL is in your request, so keep the request and the response headers with the file.
No hash, no trusted timestamp, no notary. CurlShot does not hash files for you, does not issue RFC 3161 or qualified timestamps, and does not certify or notarise anything. Do those steps yourself.
Not long-term storage. Stored files are removed after a while and their links expire at the expires_at time in the answer. Download each file at once and keep your own copy. See the docs for the details.
curl "https://curlshot.com/api/v1/screenshot?access_key=YOUR_ACCESS_KEY\
&url=https://example.com\
&full_page=true" \
--output page.png -D page-png-headers.txt
curl "https://curlshot.com/api/v1/screenshot?access_key=YOUR_ACCESS_KEY\
&url=https://example.com\
&format=pdf" \
--output page.pdf -D page-pdf-headers.txt
shasum -a 256 page.png page.pdf-D writes the response headers of each request to a file, so X-Cache and X-Reference-Id stay with the capture. No coding needed for a single page: the full-page screenshot tool and the website to PDF tool do the same in the browser. For many pages on a schedule, follow how to archive pages as PDF, and read caching before you turn cache=true on.
Glossary: six terms worth knowing
- Authentication (of evidence)
- Showing that an item is what the person offering it claims it is. For a capture: that it shows this page, at this address, at this time.
- Hash
- A fixed-length value computed from the contents of a file. Change one byte of the file and the value changes. SHA-256 gives 256 bits, written as 64 hexadecimal characters.
- Trusted timestamp
- A signed statement from a timestamping service that binds the hash of a file to a time, as evidence that the file existed before that time. RFC 3161 defines a common protocol for it.
- Metadata
- Data about a file rather than in it: its name, size, creation time, the tool that made it. File dates change when a file is copied, so they support a record but do not fix it.
- Chain of custody
- The written history of an item from the moment it was captured: who held it, where it was stored, and every time it was copied or handed on.
- Full-page capture
- A screenshot of a page from its top to its bottom, not only the part visible in the window before scrolling.
Questions people ask
Is a screenshot accepted as evidence in court?
That depends on the country, the court and the case, and no general rule covers them all. In United States federal courts, Rule 901(a) of the Federal Rules of Evidence asks the person offering an item to produce evidence sufficient to support a finding that it is what they claim it is. A capture with its URL, time, hash and a person who can say how it was made gives you more to meet a test like that. Ask a lawyer about your own case.
What should I record when I capture a web page?
Record the full URL as text, the date, the time and the time zone, who made the capture, the tool and its settings, whether you were logged in, and the SHA-256 hash of every file. Keep the whole page, not a crop, in more than one form: a full-page screenshot, a PDF and the HTML source.
How do I prove a screenshot has not been edited?
Compute a SHA-256 hash of the file right after capture and store the value somewhere you cannot quietly change, then keep the original file untouched. Anyone can recompute the hash later: the same value means the same file. A hash does not prove the time of capture or that the file matches what the site served, so pair it with a timestamp or a capture held by a third party.
How do I compute a SHA-256 hash of a file?
On macOS run "shasum -a 256 file". On Linux run "sha256sum file". In PowerShell on Windows run "Get-FileHash file -Algorithm SHA256"; SHA256 is also its default algorithm. Each prints a 64-character hexadecimal value for the file.
Can I use the Wayback Machine to save a page as evidence?
You can save a page with Save Page Now, and it gives you a record held by someone other than you. The Internet Archive says it saves the single page with its images and CSS, not the linked pages, that some sites cannot be saved, and that the Wayback Machine was not designed with legal use in mind. Use it alongside your own capture, not in place of it.
What is a trusted timestamp?
A trusted timestamp is a signed statement from a timestamping service that binds the hash of a file to a time. RFC 3161 describes the protocol: you send the hash, not the file, and get back evidence that the data existed before that time. In the European Union, Article 41 of the eIDAS regulation gives a qualified electronic time stamp a presumption of accuracy of the date and time it indicates.
Does CurlShot provide legal proof or notarised captures?
No. CurlShot renders the page in a real browser on a server and returns a full-page screenshot or a PDF. It does not hash files, issue trusted timestamps, certify or notarise captures, and it is not long-term storage. Record the URL and time, hash the files and keep your own copies.
Sources
- [1]Cornell Law School, Legal Information Institute, Federal Rules of Evidence, Rule 901: Authenticating or identifying evidence. Checked .
- [2]Cornell Law School, Legal Information Institute, Federal Rules of Evidence, Rule 902: Evidence that is self-authenticating. Checked .
- [3]EUR-Lex, Regulation (EU) No 910/2014 (eIDAS), Articles 3, 41 and 42. Checked .
- [4]RFC Editor, RFC 3161: Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP). Checked .
- [5]NIST Computer Security Resource Center, Hash functions. Checked .
- [6]Microsoft Learn, Get-FileHash. Checked .
- [7]GNU Project, GNU Coreutils manual: sha2 utilities. Checked .
- [8]Internet Archive Help Center, Using the Wayback Machine. Checked .
- [9]Internet Archive Help Center, Save pages in the Wayback Machine. Checked .
Read next
- ReferenceWeb page to PDF: paper sizes, margins, print CSSPaper sizes in millimetres, inches, CSS pixels and points, how margins and page breaks work in a PDF of a web page, and the print CSS that controls them.
- How-toFull-page screenshot on every device and browserExact keys and menu names to screenshot a whole web page in Chrome, Firefox, Edge, Safari, iPhone, iPad and Android, checked against each vendor.
- ComparisonPNG, JPEG, WebP or PDF for website screenshotsA decision flow, a comparison table and our own file-size measurements for choosing PNG, JPEG, WebP or PDF when you save a screenshot of a web page.