2 min read
Label 309 Is Now CIP-0190
The Proof of Existence standard we wrote for Cardano has been accepted into the official CIP repository as CIP-0190. Here is what that means, what it does not mean, and what comes next.
Announcements
The CardanoWall blog
Announcements, guides, and notes from the CardanoWall team — about the product and the open standard Label 309.
7 min read
Prove One File from a Merkle Batch: The Inclusion Certificate
After many file hashes are published under one Merkle root on Cardano, an inclusion certificate is a small downloadable file that proves one specific file was part of that batch — checkable in your own browser, with no trust in CardanoWall, forever.
The StandardGuides
9 min read
CardanoWall Returns, Built on Label 309
CardanoWall is relaunching as a Proof of Existence service built on Label 309, an open, vendor-neutral record format for Cardano metadata. Hash, sign, seal, and share content, then verify it without trusting our servers.
Announcements
10 min read
What Is Proof of Existence?
Proof of Existence shows that exact data existed no later than a public timestamp — without publishing the private file itself. Here's how it works and what it does and doesn't prove.
The StandardGuides
11 min read
How Label 309 Works
Label 309 writes a Proof of Existence into Cardano transaction metadata: a content hash first, plus optional signatures, sealed payloads, recipient key slots, and Merkle batches. Here is how each layer works and how anyone verifies it.
The Standard
10 min read
Hash, Sign, Seal, Share: The Four Levels of a CardanoWall Proof
CardanoWall builds proofs in four layers: a plain hash timestamp, an optional signature, an encrypted sealed copy, and private delivery to specific recipients. You use only the layers a situation needs.
The StandardGuides
10 min read
What Goes on the Blockchain When You Make a Proof?
CardanoWall publishes a small proof record on Cardano, not your file. A hash-only proof exposes only a digest, while a sealed proof keeps the content encrypted off-chain — here's exactly what becomes public.
The StandardSecurity
9 min read
Is Label 309 Open Source?
Yes. Label 309 is an open Proof of Existence standard: the code is Apache-2.0, the spec is CC-BY-4.0, and anyone can implement it, fork it, run a gateway, and build products without asking CardanoWall for permission.
The StandardDevelopers
10 min read
Your Identity Is a Seed
A CardanoWall identity is one 32-byte Identity Seed. Save that seed and you can restore your signing and receive keys in any Label 309 tool; lose it and you lose future use of that identity.
SecurityGuides
10 min read
What Is a Receive Address?
A receive address is the public address someone uses to send you a sealed Label 309 record. It is safe to share — unlike your private Identity Seed, which it can never reveal.
GuidesSecurity
10 min read
How to Receive a Sealed Record
Share a receive address. Your client scans the public Label 309 feed and locally decrypts the records your keys can open — no server-side mailbox, no recipient list on chain.
GuidesSecurity
10 min read
CardanoWall Desktop: A Local Mail Client for Proofs of Existence
CardanoWall Desktop is an open-source, cross-platform client for Label 309 — local identities, an offline-first record mirror, a sealed inbox, sent-record tracking, and your choice of gateway. Here is how it works.
Guides
10 min read
Do CardanoWall Proofs Work Offline?
Once a Label 309 record, its content, and your keys are synced to your device, CardanoWall Desktop can browse, search, decrypt, and verify them with no network. What it cannot do is fetch data it never cached.
Guides
10 min read
Why Your Keys Never Leave the Device
In CardanoWall, signing, sealing, and decryption all happen locally — the gateway publishes proofs and stores ciphertext but is designed never to receive your private keys.
Security
9 min read
What Is a Label 309 Gateway?
A Label 309 gateway is the publishing service that quotes, uploads, submits, confirms, and indexes Proof of Existence records through a standard API — while your keys stay on your device and proofs verify from public data.
DevelopersThe Standard
10 min read
How to Use CardanoWall Without the Website
The website is one interface, not the whole product. You can publish and verify Label 309 records through a CLI, SDKs, a gateway API, a desktop app, or your own service.
DevelopersGuides
9 min read
Why Publishing a Proof Costs Money
Publishing a CardanoWall proof costs money because the gateway pays real Cardano transaction fees and, for files, real Arweave storage — then adds a service margin to run a hosted service. Verifying stays free and needs no server.
GuidesDevelopers
9 min read
Run Your Own Label 309 Gateway
Yes — a company or developer can run their own Label 309 gateway, fund its Cardano and storage wallets, and publish standard proofs of existence without using CardanoWall as the hosted operator. Here is what that takes.
Developers
9 min read
One Record for Thousands of Files: Merkle Batching
A Merkle root lets one Label 309 record commit to thousands or millions of file hashes, then prove any single item later with a small inclusion proof — without putting every item on chain.
The StandardDevelopers
8 min read
How do you anchor CI/CD build evidence to a public timestamp?
A CI/CD pipeline can hash its build artifacts, SBOMs, logs, and release manifests, batch them into one Merkle root, and publish a single Label 309 proof — an independent public time anchor for later audits.
Developers
9 min read
Proving AI Content Provenance at Scale with Merkle Batching
Hash each AI output, prompt, manifest, or Content Credentials record, batch the hashes into Merkle roots, and publish timestamped Label 309 commitments — proving any single item existed without putting every asset or private prompt on chain.
AI & ProvenanceDevelopers
9 min read
How to Prove Training Data Without Revealing It
Commit a private dataset snapshot to a hash or Merkle root and publish one timestamped proof. The data stays private; later you can selectively prove a file, row, or version was in the committed set.
AI & ProvenanceSecurity
10 min read
Compliance Logs Auditors Can Check Without Trusting the Vendor
Anchor a Merkle root of your compliance evidence on Cardano, and an auditor can later confirm a specific report or log was committed by a public time — without trusting the system that produced it.
Compliance & LegalDevelopers
7 min read
Proof of Reserves with Merkle Roots
A Merkle root anchored with a Label 309 timestamp lets you commit to a snapshot of reserves, liabilities, or evidence and prove inclusion to individual customers — without publishing every account.
Compliance & LegalDevelopers
8 min read
Confidential Disclosure Without Publishing the File
Sealed Label 309 records timestamp encrypted evidence on Cardano and deliver it to specific recipients, so the timeline is public while the plaintext stays confidential.
SecurityCompliance & Legal
9 min read
Whistleblower Evidence: Timestamp It Without Publishing It
A sealed Label 309 record can timestamp encrypted evidence and deliver it to one chosen recipient — but it does not make you anonymous or replace legal and safety advice. Here is what it does and does not do.
Compliance & LegalSecurity
9 min read
Legal Evidence and E-Discovery: Timestamping Documents and Discovery Exports
How to use Label 309 Proof of Existence to prove a document or discovery export existed by a public time and still matches its original bytes — and where that proof stops and legal process begins.
Compliance & Legal
10 min read
Build a Verifiable Security Incident Timeline Without Going Public
How a security team can timestamp and seal incident evidence as it is collected — a durable, independently verifiable timeline that proves what existed when, without publishing sensitive details.
SecurityCompliance & Legal
8 min read
Anchor C2PA Content Credentials to an Independent Timestamp
C2PA describes where media came from; Label 309 anchors the asset or its manifest to an independent public Cardano timestamp. Here is how the two layers fit together.
AI & ProvenanceThe Standard
8 min read
How to Anchor an AI Dataset Manifest with Label 309
Hash a dataset manifest, batch it with a Merkle root, and anchor it on Cardano with Label 309 — so you can later prove what a dataset snapshot contained without publishing the dataset.
AI & ProvenanceDevelopers
8 min read
Creative Proofs for Artists
Hash your source files, drafts, prompts, exports, or whole project folders and publish a timestamped Label 309 proof that they existed by a given time — without making the work public.
AI & ProvenanceGuides
7 min read
Media Authenticity: What a Timestamp Proves and What It Cannot
A Label 309 proof shows that a media file existed by a public time. Authenticity needs more: capture context, provenance, signatures, and human verification. Here is how the timestamp layer fits.
AI & Provenance
9 min read
How to Verify a Label 309 Record
Verify a Label 309 proof from the public Cardano chain, the record bytes, and optional content or recipient keys — without trusting CardanoWall or whoever published it.
DevelopersGuides
9 min read
Publish Your First Proof of Existence on Cardano
Your first Label 309 proof can be a hash-only record: hash a file, get a price quote from a gateway, publish the digest on Cardano, and keep the transaction hash. Here is the full workflow.
GuidesDevelopers
10 min read
Build on the CardanoWall API
How to build your own product on CardanoWall: quote, upload, publish, read, and monitor Label 309 records through the same gateway API CardanoWall itself runs on.
Developers
7 min read
Use the CardanoWall CLI in CI/CD and Scripts
Run Proof of Existence from a script: the cardanowall CLI puts JSON on stdout, diagnostics on stderr, gives you stable verification exit codes, takes secrets safely, and publishes through any Label 309 gateway.
Developers
10 min read
How to Build a Product on a Label 309 Gateway
A Label 309 gateway is the publishing engine behind a Proof-of-Existence product: it owns Cardano submission, storage, balances, indexing, and webhooks, so your product can own the user experience instead.
Developers
11 min read
What a Proof of Existence Does Not Prove
A Proof of Existence shows that exact bytes existed by a public time. It does not, on its own, prove ownership, truth, authorship, who was first, legality, or admissibility.
The StandardGuides
7 min read
Proof of Existence vs a Timestamp Authority: which trust model do you need?
Both bind data to a point in time, but a Timestamp Authority roots trust in a named provider's key, while a Label 309 Proof of Existence roots it in public Cardano consensus. Here's how to choose.
The StandardCompliance & Legal
8 min read
Proof of Existence vs C2PA: how do they fit together?
C2PA describes the provenance of a media asset; Label 309 anchors a timestamped commitment to its bytes on Cardano. Here is what each one proves, and why most workflows want both.
The StandardAI & Provenance
7 min read
Proof of Existence vs Sigstore: do you need both?
Sigstore signs software artifacts and logs the event publicly; Label 309 adds an independent blockchain time anchor over your whole release evidence. They solve different problems and work well together.
The StandardDevelopers
9 min read
Proof of Existence vs OpenTimestamps: which timestamping fits your work?
OpenTimestamps is excellent for bare, Bitcoin-anchored timestamps. Label 309 adds a Cardano-native proof record with signatures, sealing, recipients, and Merkle batching — here is how to choose.
The Standard
9 min read
How CardanoWall Stores Your Identity
CardanoWall stores your identity as encrypted vault ciphertext, never plaintext seeds. Here is exactly what the server holds, what only your passkey can open, and why your seed is the real backup.
Security
8 min read
How Passkeys Protect Your Identity Vault in CardanoWall
A passkey does not become your CardanoWall identity — it unlocks an encrypted vault that only your authenticators can open. Here is how WebAuthn PRF makes daily access easy without making CardanoWall a seed custodian.
Security
7 min read
Why the Identity Seed Still Matters When You Have a Passkey
Yes, you still need to save your Identity Seed even with a passkey. The passkey is a convenience unlock; the seed is the portable identity that works across CardanoWall, the CLI, SDKs, and any Label 309 tool.
SecurityGuides
8 min read
Where CardanoWall Keeps Your Keys in the Browser
In the browser, CardanoWall keeps unlocked keys in session memory and writes only encrypted vault ciphertext to IndexedDB — never plaintext Identity Seeds or private keys.
Security
7 min read
Public Computer Mode: Using CardanoWall on a Shared Device
Public computer mode stops CardanoWall from writing identity data to the browser, so a shared device keeps no trace after you leave. It does not make a compromised machine safe while you are signed in.
SecurityGuides
7 min read
Synced Passkeys vs Hardware Keys for Your Identity Vault
Synced passkeys roam across your devices; hardware keys stay device-bound and physically controlled. CardanoWall can use either to unlock your identity vault when WebAuthn PRF is supported — and the Identity Seed stays your real backup either way.
Security
7 min read
What Happens If You Remove a Passkey in CardanoWall?
Removing a passkey re-encrypts your current CardanoWall identity vault to the remaining factors and hard-deletes the old ciphertext — real revocation going forward, but it cannot undo access that already happened.
Security
8 min read
What CardanoWall Can See (and What It Can't)
CardanoWall sees account, billing, and public proof data. By design it does not see your plaintext Identity Seed, your private keys, or the plaintext of a sealed file.
Security
8 min read
How the CardanoWall Address Book Works
CardanoWall's address book saves verified contacts so you can seal a record to someone by name instead of pasting a long receive address every time.
Guides
6 min read
Create Your CardanoWall Address Book
Save trusted contacts in CardanoWall — their signing key, receive addresses, a name, and how you verified them — so you can seal a file to the right person without pasting a key under pressure.
Guides
6 min read
Verify a Recipient Before You Seal a File
A receive address is a public key, not a name. Before you seal a sensitive file, confirm the recipient's address through a trusted channel — encryption can work perfectly and still send to the wrong person.
SecurityGuides
6 min read
Whitelist Mode: Focus Your Inbox on Trusted Senders
Whitelist mode is a per-identity CardanoWall inbox filter that shows records from your trusted contacts first. It does not change the Label 309 record format or block anyone on Cardano.
GuidesSecurity
7 min read
Public Profiles and Receive Addresses on CardanoWall
A CardanoWall public profile gives one identity a shareable page with its receive addresses — but a sender should still verify the profile through a trusted channel before sealing a file to it.
Guides
7 min read
Shared Team Identities: One Identity, Many People
A team can share a CardanoWall identity by sharing its Identity Seed — but that hands every holder full signing and decryption power, with no partial or per-person revocation.
GuidesSecurity
8 min read
Active, Deactivated, Deleted: What Each Identity State Means
Deactivating or deleting a CardanoWall identity changes how your account uses it, but it never changes the cryptographic validity of records already published on Cardano.
GuidesSecurity