Need help with aletheia?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

276 Stars 18 Forks GNU Affero General Public License v3.0 76 Commits 0 Opened issues


Fight fake news with cryptography & human nature

Services available


Need anything else?

Contributors list

# 12,841
71 commits
# 218,045
1 commit



Fight fake news with cryptography & human nature

Just as journalism has taken a critical financial hit, fake news is multiplying across social networks faster than facts. The public doesn't know which stories are real any more because anyone with a laptop can forge audio & video in record time. We need to empower the institutions we trust with the ability to tie their reputations to the journalism they produce.

Aletheia uses cryptographic signatures + DNS to leverage existing networks of human trust in individual journalists & institutions to help link those people to the work they produce with a view to change our expectations of what constitutes journalism: if it's not verified, it's just some stranger on the internet.

To this end, Aletheia combines cryptographic signatures with human nature's concept of social trust. It helps you sign all the files you produce so that they can later be verified as coming from you. At that point, math has guaranteed the file's origin, it's only our personal (or professional) reputations that can be called into question.

This is further outlined in this blog post on the subject. This project is inspired by this Radiolab story covering how surprisingly easy it is to create believable audio & video fakes.



This is a typical file

A basic file

Aletheia uses your private key to sign the relevant portion of the file:

Signing with a private key

That signature is inserted into the file header, along with the URL for the public key:

Writing the headers

The final result is a slightly larger file, now with a means of verifying its origin.

A basic file


When it comes time to verify the file, you need only extract the public key URL:

Extract the public key URL

...and fetch that key from the creator's site:

Fetch the public key

Finally, we use this public key to verify the file:

Verify all the things!

Aletheia will do all of this for you in two commands:

, and

If you'd like to get started, you can install Aletheia from PyPi now. If however you're looking for a more technical explanation, keep reading.

A technical explanation

The process is relatively simple: source organisations & individuals can publish their public key somewhere on the internet and use their private key to sign the media they distribute. Social networks and individuals can then reference this signature to verify the origin.

Generate a private & public key

Generating a private & public key is necessary for the signing & verification process, but this only needs to be run once.

$ aletheia generate
Generating private/public key pair...

All finished!

You now have two files: aletheia.pem (your private key) and (your public key). Keep the former private, and share the latter far-and-wide. Importantly, place your public key at a publicly accessible URL so that when you sign a file with your private key, it can be verified by reading the public key at that URL.

Sign a file

$ aletheia sign file.jpg

Here, the

  1. Gets the image data (sans metadata)
  2. Generates a signature by combining it with our private key
  3. Converts the signature to text
  4. Writes the new signature to the file along with the location of our public key.

Verifying a file

$ aletheia verify file.jpg

Much like signing,

is doing all the work for you:
  1. It extracts the signature & URL from the file
  2. Fetches the public key from the URL & caches it
  3. Attempts to verify the signature on the file with said public key.

Project Status

Aletheia is working, and ready to be deployed on sites running Python, or ones happy to use the Python-based command-line script. In order for it to be widely adopted however, more needs to be done. Here's what we have so far:


We now have a working Python library that can generate keys as well as support the following file formats:


Format Supported Notes
JPEG 👍 Requires Exiftool
GIF 👍 Requires Exiftool
PNG 👍 Requires Exiftool
MP3 👍 Requires FFmpeg
MKV 👍 Requires FFmpeg
WEBM 👍 Requires FFmpeg to verify. FFmpeg 3.4+ is required for signing.
MP4 👍 Requires FFmpeg
Markdown 👍

Help Wanted

Support for additional formats.

The lowest-hanging fruit are finished, so now the priorities are the other popular web formats like

, and maybe
-- assuming these formats have a metadata layer into which we can include a signature.

Porting the Python library to additional languages

Python is great, but it's not for everyone. Ideally, it would great if developers in languages like Ruby, Javascript, PHP, Java, Rust, Clojure, Go, and C# could use Aletheia in their chosen environment.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.