# Capture a web page as evidence that holds up

> A checklist for saving a web page as a credible record: what to capture, how to fix the time with a hash and timestamp, and what makes a screenshot weak.

Checklist by Serghei Pogor, founder of CurlShot (https://curlshot.com/about/serghei-pogor). Published 19 October 2026. Page for people: https://curlshot.com/blog/web-page-as-evidence

To save a web page as a record that stays credible, capture the whole page (a full-page screenshot, a PDF and the HTML source) from its exact address, write down the full URL, the date, the time and the time zone, compute a SHA-256 hash of every file, and keep the originals untouched with a short log of who captured what, how and when. A cropped image with no address and no date is the weakest record there is. This is record-keeping guidance, not legal advice: what a court needs depends on where you are.

## Key facts

- A good record has 5 parts: the full URL, the date and time with time zone, the whole page, a hash of each file, and who captured it and how.
- The chain of custody has 6 steps: before you capture, capture, fix the moment, store, document, present.
- SHA-256 produces a 256-bit value, written as 64 hexadecimal characters. One changed byte in the file gives a different value.
- A hash shows a file has not changed. It does not show when it was made: that takes a timestamp or a record held by someone else.
- The Wayback Machine's Save Page Now saves one page with its images and CSS, not the pages it links to, and some sites cannot be saved.
- A cached response is not a fresh capture. Check for a marker such as an X-Cache header before you rely on the time of a capture.

## What a credible record of a web page contains

This is practical record-keeping guidance, not legal advice. Rules of evidence differ by country and by court, so ask a lawyer what your case needs.

1. **The full address.** The complete URL, with path and query string, as text you can copy. Not just the site name.
2. **Date, time and time zone.** When the capture was made, to the second, with the zone or UTC offset written out.
3. **The whole page.** Top to bottom, not a crop, so the surrounding context is there to read.
4. **A hash of each file.** A SHA-256 value computed right after capture, so any later change to the file shows.
5. **Who captured it, and how.** A name, the tool and its settings, the device or service, written down the same day.

## Chain of custody: six steps from capture to presentation

### 1. Before you capture

Decide what the record has to show, and write the address down before you touch anything.

- Copy the exact URL into a note, including everything after the question mark.
- Note whether you are logged in, and which account, country and language the page is being shown to.
- Do not contact the author or report the content until you have captured it: pages get edited and deleted.

### 2. Capture

Take the whole page in more than one form, each from the same address, minutes apart at most.

- A full-page screenshot (PNG) of the page from top to bottom.
- A PDF of the same page, which keeps the text selectable and searchable.
- The saved HTML source where you can get it, plus a close-up of the key passage that also exists inside the full-page capture.

### 3. Fix the moment

Tie the files to a point in time and make later changes detectable.

- Compute a SHA-256 hash of every file and paste the values into your note.
- Record the date, the time and the time zone of each capture.
- Get a time reference you do not control: a save in a public web archive, or a timestamp from a timestamping service.

### 4. Store

Keep the originals untouched and work only on copies.

- Put the original files in one folder and never open them in an editor that saves over them.
- Keep a second copy somewhere else: another drive or another storage account.
- Annotate, crop and highlight copies only, and name them as copies.

### 5. Document

Write the short log that lets someone else, or you in two years, say how each file came to exist.

- For each file: the URL, date and time, who captured it, the tool and its settings, the hash.
- Every later event: who copied the files, where to, and when.
- Anything unusual: a cookie banner you dismissed, a login you used, a part of the page that would not load.

### 6. Present

Hand over the original files and the log together, and let the reader check them.

- Give the untouched files with their hashes, and marked-up copies separately.
- Show the full page first, then the close-up, so the passage is seen in its place.
- Have the person who made the capture ready to say what they did. Ask a lawyer what form the court or authority in your case expects.

## Which capture method gives the strongest record?

Capture methods ordered from the weakest record to the strongest. The order is practical reasoning about what an opponent can still question, not a legal ranking.

| Step | Method | What it shows | What can still be challenged |
| --- | --- | --- | --- |
| 1 | A cropped phone screenshot | That someone holds an image showing these words. | Which page it came from, when, what surrounded it, and whether the image was edited. |
| 2 | A full-page screenshot with the URL and the time recorded | What the whole page looked like, at a stated address and moment. | Whether the stated time and address are right, and whether the file changed afterwards. |
| 3 | Full-page screenshot, PDF and saved HTML together | The same content in three forms that agree with each other, with text that can be searched. | Still your own word for the time of capture and for the files being unchanged. |
| 4 | The same set, with hashes and an independent timestamp | That these exact files existed by a certain time and have not changed since. | That the files match what the site really served: a hash fixes a file, it does not vouch for its origin. |
| 5 | A capture by an independent third party or a public archive | That someone with no stake in the dispute recorded the page at that address. | Completeness (archives can miss scripts, images or logged-in content) and how the archive works. |
| 6 | A capture recorded by a notary or court officer, where that exists | What an official witness saw at the address, in a form that legal system already knows. | Availability, cost and weight differ by country. Ask a lawyer whether it exists where you are. |

## What to capture for each situation

| Situation | What to capture | Extra context to record | How often |
| --- | --- | --- | --- |
| Online review or comment | The full page with the comment in its thread, and the direct link to the comment if the site has one. | Author name and profile address, the posted date shown by the site, replies, rating, your own view if you replied. | Once at once, and again if it is edited or answered. |
| Marketplace listing or price | The full listing page, plus the basket or checkout page that shows the price actually charged. | Seller name, item number, currency, delivery country, stock status, any discount code applied. | On the day it matters, then at each price change. |
| Terms and conditions | The whole document as a PDF and a full-page screenshot, and the page where the terms are accepted. | Version number or "last updated" date printed in the terms, the language version, the address of each linked policy. | On the day you agree, and whenever the terms change. |
| Social media post (may be deleted) | The post at its own address, the author profile page, and the thread around it. | Handle and numeric account id if shown, post time shown by the platform, whether you were logged in to see it. | Immediately. A second capture later shows whether it was edited or removed. |
| A competitor's ad | The ad where it appeared, with the page around it, and the landing page it leads to. | Search term or placement, device type, country and language the page was shown to, the time of day. | Each time you see it: ads rotate and are targeted, so one capture shows one showing. |
| Your own site at a point in time (compliance) | Each page that carries a regulated statement: prices, disclosures, consent text, terms. | The release or version that was live, who approved it, the device size captured. | On a schedule (daily, weekly or at each release), not after the question arrives. |

## What makes a screenshot easy to attack?

| Weakness | Why it matters | The honest counter |
| --- | --- | --- |
| It could have been edited | Any image can be changed in an editor, and a page can be rewritten in the browser before it is captured. | Hash the files at capture, keep the originals untouched, and hold a second record that you did not make: a public archive save or a third-party capture. |
| The URL is missing | Without the address, nobody can say which page, on which site, the image shows. | Record the full URL as text in your log. A PDF or saved HTML from the same address backs it up. |
| There is no date | A page changes. An undated capture cannot say which version it shows. | Write down date, time and time zone, and add a time reference you do not control. |
| The context was cropped away | A crop can hide a correction, a reply, a "sponsored" label or the sentence before. | Capture the whole page first. Crops are fine as close-ups of something the full capture also shows. |
| It is a personalised or logged-in view | A page can differ by account, country, language, device and consent choice. | Say which view it is. Where the page is public, also capture it from a clean browser that is not logged in, so the record shows what any visitor got. |
| The content is dynamic | Prices, ads, feeds and counters change between two loads of the same address. | Capture more than once, record each time, and never present a cached copy as a fresh capture. |

## How to compute a file hash (SHA-256)

A hash algorithm maps a message of any length to a fixed-length digest; SHA-256 is one of the algorithms NIST approves in FIPS 180-4 [5]. Run one command per file, right after capture, and save the output.

```bash
# macOS
shasum -a 256 capture.png

# Linux
sha256sum capture.png

# Windows (PowerShell)
Get-FileHash capture.png -Algorithm SHA256
```

- **macOS:** `shasum -a 256 capture.png`. Built in. Run on macOS for this article.
- **Linux:** `sha256sum capture.png`. GNU coreutils: computes a 256-bit checksum [7].
- **Windows (PowerShell):** `Get-FileHash capture.png -Algorithm SHA256`. SHA256 is also the default when -Algorithm is left out [6].

A hash shows that a file has not changed since the hash was computed. It does not show when that was, or that the file matches what the site served. Avoid MD5 and SHA-1 for this: Microsoft documents them as no longer considered secure [6], and NIST deprecated SHA-1 in 2011 [5].

A trusted timestamp adds the time. Under RFC 3161, the request to a Time Stamping Authority carries the hash of the file, not the file, and the answer is evidence "that a datum existed before a particular time" [4].

## What the written rules say (United States and European Union)

Three texts, quoted from the official source, each for one jurisdiction only. They are not a statement of what any court will accept.

**Federal Rules of Evidence, Rule 901(a)** (United States, federal courts) [1]

> To satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.

The person offering the capture has to show it is what they say it is. The examples the rule lists include "Testimony of a Witness with Knowledge" and "Evidence About a Process or System".

**Federal Rules of Evidence, Rule 902(14)** (United States, federal courts) [2]

> Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12).

The committee note to this paragraph says such data "are ordinarily authenticated by hash value". Rule 902(13) covers, in similar words, "A record generated by an electronic process or system that produces an accurate result". Both need a certification and advance notice to the other side.

**Regulation (EU) No 910/2014 (eIDAS), Article 41** (European Union) [3]

> A qualified electronic time stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound.

Article 41(1) adds that a time stamp is not to be denied legal effect "solely on the grounds that it is in an electronic form" or that it is not a qualified one. "Qualified" is a defined status with its own requirements in Article 42.

## Public archives: what the Wayback Machine saves, and its limits

- Save Page Now saves the single page you enter, including its images and CSS. It does not save the pages that page links to [9].
- It does not save multiple pages, directories or whole sites [8].
- Some pages cannot be saved: sites that prohibit crawling, password-protected pages, and some sites with SSL settings that break the capture [8][9].
- Pages that rely on JavaScript are harder to archive, so a capture can be incomplete [8].
- The 14 digits in a Wayback Machine address are the capture time, read as yyyymmddhhmmss. The help page does not state the time zone, so do not assume it is yours [8].
- The Internet Archive says the Wayback Machine was not designed with legal use in mind, and that it has an affidavit procedure for requests for certified records [8].

## The master checklist

1. [ ] I copied the full URL as text before capturing.
2. [ ] I noted whether I was logged in, and the country and language of the view.
3. [ ] I have a full-page screenshot of the whole page.
4. [ ] I have a PDF of the same page from the same address.
5. [ ] I saved the HTML source, or noted why I could not.
6. [ ] I wrote down the date, the time and the time zone of each capture.
7. [ ] I computed a SHA-256 hash of every file and saved the values.
8. [ ] I have a time reference I do not control: an archive save or a timestamp.
9. [ ] The original files are stored unchanged, with a second copy elsewhere.
10. [ ] My log names who captured each file, with which tool and settings.
11. [ ] Marked-up versions are copies, named as copies.
12. [ ] I asked a lawyer what form the record has to take in my case.

## What CurlShot does for a record, and what it does not

- **A clean view.** CurlShot opens the address in a real browser on a server, not in your browser. No account of yours is logged in unless you send login details yourself, so the capture shows what a visitor gets.
- **Whole page, two forms.** full_page=true gives one image of the page from top to bottom. format=pdf gives the whole page as a PDF with text you can select and search. Both come from the same url.
- **Fresh by default.** Caching is off unless you send cache=true, so a plain request renders the page again. Every answer carries an X-Cache header: MISS means the page was rendered for this request, HIT means a stored copy was served.
- **A reference per request.** Every answer carries an X-Reference-Id header. Background jobs (async=true) also report created_at and finished_at times.
- **No address bar in the image.** A server-rendered screenshot shows the page, not a browser window around it. The URL is in your request, so keep the request and the response headers with the file.
- **No hash, no trusted timestamp, no notary.** CurlShot does not hash files for you, does not issue RFC 3161 or qualified timestamps, and does not certify or notarise anything. Do those steps yourself.
- **Not long-term storage.** Stored files are removed after a while and their links expire at the expires_at time in the answer. Download each file at once and keep your own copy. See the docs for the details.

```bash
curl "https://curlshot.com/api/v1/screenshot?access_key=YOUR_ACCESS_KEY\
&url=https://example.com\
&full_page=true" \
  --output page.png -D page-png-headers.txt

curl "https://curlshot.com/api/v1/screenshot?access_key=YOUR_ACCESS_KEY\
&url=https://example.com\
&format=pdf" \
  --output page.pdf -D page-pdf-headers.txt

shasum -a 256 page.png page.pdf
```

More: [full-page screenshot](https://curlshot.com/tools/full-page-screenshot), [website to PDF](https://curlshot.com/tools/website-to-pdf), [how to archive pages as PDF](https://curlshot.com/docs/guides/archive-pages-as-pdf), [caching](https://curlshot.com/docs/caching).

## Glossary

- **Authentication (of evidence):** Showing that an item is what the person offering it claims it is. For a capture: that it shows this page, at this address, at this time.
- **Hash:** A fixed-length value computed from the contents of a file. Change one byte of the file and the value changes. SHA-256 gives 256 bits, written as 64 hexadecimal characters.
- **Trusted timestamp:** A signed statement from a timestamping service that binds the hash of a file to a time, as evidence that the file existed before that time. RFC 3161 defines a common protocol for it.
- **Metadata:** Data about a file rather than in it: its name, size, creation time, the tool that made it. File dates change when a file is copied, so they support a record but do not fix it.
- **Chain of custody:** The written history of an item from the moment it was captured: who held it, where it was stored, and every time it was copied or handed on.
- **Full-page capture:** A screenshot of a page from its top to its bottom, not only the part visible in the window before scrolling.

## Questions

### Is a screenshot accepted as evidence in court?

That depends on the country, the court and the case, and no general rule covers them all. In United States federal courts, Rule 901(a) of the Federal Rules of Evidence asks the person offering an item to produce evidence sufficient to support a finding that it is what they claim it is. A capture with its URL, time, hash and a person who can say how it was made gives you more to meet a test like that. Ask a lawyer about your own case.

### What should I record when I capture a web page?

Record the full URL as text, the date, the time and the time zone, who made the capture, the tool and its settings, whether you were logged in, and the SHA-256 hash of every file. Keep the whole page, not a crop, in more than one form: a full-page screenshot, a PDF and the HTML source.

### How do I prove a screenshot has not been edited?

Compute a SHA-256 hash of the file right after capture and store the value somewhere you cannot quietly change, then keep the original file untouched. Anyone can recompute the hash later: the same value means the same file. A hash does not prove the time of capture or that the file matches what the site served, so pair it with a timestamp or a capture held by a third party.

### How do I compute a SHA-256 hash of a file?

On macOS run "shasum -a 256 file". On Linux run "sha256sum file". In PowerShell on Windows run "Get-FileHash file -Algorithm SHA256"; SHA256 is also its default algorithm. Each prints a 64-character hexadecimal value for the file.

### Can I use the Wayback Machine to save a page as evidence?

You can save a page with Save Page Now, and it gives you a record held by someone other than you. The Internet Archive says it saves the single page with its images and CSS, not the linked pages, that some sites cannot be saved, and that the Wayback Machine was not designed with legal use in mind. Use it alongside your own capture, not in place of it.

### What is a trusted timestamp?

A trusted timestamp is a signed statement from a timestamping service that binds the hash of a file to a time. RFC 3161 describes the protocol: you send the hash, not the file, and get back evidence that the data existed before that time. In the European Union, Article 41 of the eIDAS regulation gives a qualified electronic time stamp a presumption of accuracy of the date and time it indicates.

### Does CurlShot provide legal proof or notarised captures?

No. CurlShot renders the page in a real browser on a server and returns a full-page screenshot or a PDF. It does not hash files, issue trusted timestamps, certify or notarise captures, and it is not long-term storage. Record the URL and time, hash the files and keep your own copies.

## Sources

1. Cornell Law School, Legal Information Institute, "Federal Rules of Evidence, Rule 901: Authenticating or identifying evidence": https://www.law.cornell.edu/rules/fre/rule_901 (checked 11 October 2026)
2. Cornell Law School, Legal Information Institute, "Federal Rules of Evidence, Rule 902: Evidence that is self-authenticating": https://www.law.cornell.edu/rules/fre/rule_902 (checked 11 October 2026)
3. EUR-Lex, "Regulation (EU) No 910/2014 (eIDAS), Articles 3, 41 and 42": https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014R0910 (checked 11 October 2026)
4. RFC Editor, "RFC 3161: Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)": https://www.rfc-editor.org/rfc/rfc3161 (checked 11 October 2026)
5. NIST Computer Security Resource Center, "Hash functions": https://csrc.nist.gov/projects/hash-functions (checked 11 October 2026)
6. Microsoft Learn, "Get-FileHash": https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash (checked 11 October 2026)
7. GNU Project, "GNU Coreutils manual: sha2 utilities": https://www.gnu.org/software/coreutils/manual/html_node/sha2-utilities.html (checked 11 October 2026)
8. Internet Archive Help Center, "Using the Wayback Machine": https://help.archive.org/help/using-the-wayback-machine/ (checked 11 October 2026)
9. Internet Archive Help Center, "Save pages in the Wayback Machine": https://help.archive.org/help/save-pages-in-the-wayback-machine/ (checked 11 October 2026)

## Go deeper

- [Full-page screenshot tool](https://curlshot.com/tools/full-page-screenshot)
- [Website to PDF tool](https://curlshot.com/tools/website-to-pdf)
- [URL to PDF API, for archiving from code](https://curlshot.com/tools/url-to-pdf-api)
- [Guide: how to archive pages as PDF](https://curlshot.com/docs/guides/archive-pages-as-pdf)
- [Docs: caching and fresh renders](https://curlshot.com/docs/caching)

## Read next

- [Web page to PDF: paper sizes, margins, print CSS](https://curlshot.com/blog/web-page-to-pdf-paper-sizes.md): Paper sizes in millimetres, inches, CSS pixels and points, how margins and page breaks work in a PDF of a web page, and the print CSS that controls them.
- [Full-page screenshot on every device and browser](https://curlshot.com/blog/full-page-screenshot-every-device.md): Exact keys and menu names to screenshot a whole web page in Chrome, Firefox, Edge, Safari, iPhone, iPad and Android, checked against each vendor.
- [PNG, JPEG, WebP or PDF for website screenshots](https://curlshot.com/blog/png-jpeg-webp-pdf-for-screenshots.md): A decision flow, a comparison table and our own file-size measurements for choosing PNG, JPEG, WebP or PDF when you save a screenshot of a web page.