Send a contract link. Get a signature you can prove wasn't changed.
Paste the text, send the link. The signer reads it, types their name and ticks a consent box. You get a certificate with the document's SHA-256 fingerprint and a hash-chained audit trail that anyone can re-check. It runs on your own server, with no per-envelope fee and no account for the signer.
Try the tamper check in your browser sample data
This runs entirely on this page with your browser's own crypto. Nothing is uploaded. The names and text are invented.
After signing, edit the text above and press Verify: the fingerprint will no longer match.
Not signed yet.
Why use this instead of what you do today
| Today | Catch | Sign Keeper |
|---|---|---|
| DocuSign, PandaDoc, Dropbox Sign | Per-user or per-envelope plans; documents and audit trail live in their account | Unlimited requests, one JSON file you own, no fee |
| "Reply YES to confirm" by email | No fingerprint of what was agreed, no recorded consent to e-sign | Exact text hashed, consent wording stored, certificate to keep |
| Print, sign, scan | Slow, easy to lose, no integrity check | Link, ninety seconds, verifiable record |
Honest limits: typed-name (simple) signatures only; no identity verification, templates, field placement, PDF upload, reminders or multi-signer routing; one admin key. For regulated or high-value documents use a qualified provider.
Run it yourself
git clone https://github.com/Duncan-Haywood/oss-monorepo && cd oss-monorepo/ventures/sign-keeper ADMIN_KEY=$(openssl rand -hex 16) PUBLIC_URL=https://sign.example.com COMPANY_NAME=Acme node server.mjs # create: open https://sign.example.com/admin, paste the text, copy the signing link # verify: https://sign.example.com/c/<token>.json
One-click Render deploy and Docker are in the README.
Related tools
Pair with Testimonial Keeper to collect proof after the job and Dunning Engine to chase late invoices. Publishing a release? Changelog Keeper is the same self-hosted shape for release notes.
Questions
Is a typed-name signature legally valid?
In many places, including the US (ESIGN Act and UETA) and the EU/UK (eIDAS/ECA as a simple electronic signature), a typed name with clear intent to sign and a record of it is generally accepted for ordinary contracts. Some documents are excluded (wills, certain family-law and real-estate papers, notices a statute says must be on paper). Sign Keeper is not legal advice; check what your document needs.
Can someone alter a document after it is signed?
Not undetectably. The text has a SHA-256 fingerprint and every audit event hashes the one before it. The certificate page and /c/<token>.json recompute all of it from stored data and report any mismatch. It is tamper-evident, not tamper-proof: whoever controls your server can still delete the file, so keep certificate copies.
What does it store about the signer?
The typed name, the time, the consent wording they ticked and a salted HMAC of their network address that cannot be turned back into the address. Not a raw IP, not a device fingerprint.
How is this different from DocuSign or PandaDoc?
Those add identity checks, templates, bulk send, field placement and qualified signatures. Sign Keeper does one thing: send a link, collect a typed signature with consent, keep a verifiable certificate, on a server you own with no per-envelope fee.