Get Keepword running

Check a proof

Anyone can check a Keepword evidence file. It takes no account and no server, and you don’t have to trust Keepword, the witnesses or whoever sent you the file.

1. Get the keepword program

Every release on git.keepword.net comes with static keepword binaries for Linux on x86_64 and arm64, and a SHA256SUMS file to check them against. Download the archive for your machine and the checksums, then:

sha256sum --check --ignore-missing SHA256SUMS
tar -xzf keepword-v*-x86_64-unknown-linux-musl.tar.gz
sudo install keepword-v*-x86_64-unknown-linux-musl/keepword /usr/local/bin/

Or, with Rust installed, build it from crates.io:

cargo install keepword

2. Verify the evidence file

keepword verify --bundle evidence.json

Each check prints what it proves, and the end of the report says what the bundle does and doesn’t show. Add --esplora https://blockstream.info/api to check the Bitcoin anchor against a block explorer.

Run a node on a server

On Debian, Ubuntu, Fedora, RHEL-likes, Arch, openSUSE or Alpine, with systemd or OpenRC:

git clone https://git.keepword.net/keepword/keepword.git
cd keepword
sudo sh scripts/install.sh --domain witness.example.org --caddy

The clone works from the GitHub mirror too: git clone https://github.com/keepword-net/keepword.git

That one command:

• builds Keepword in release mode and installs it to /usr/local/bin;
• creates a keepword system user and a sandboxed service that runs as it;
• creates the node’s key, configuration and empty log;
• fetches the IP-to-ASN table and schedules a weekly refresh;
• detects the node’s network and country from its public address;
• puts the peer API behind Caddy with automatic TLS, and checks that it answers.

Re-run it to upgrade: it rebuilds and restarts, and never touches the key or the data. To join the public network, add --peer https://seed1.keepword.net, as Run a witness explains.

Back up /var/lib/keepword/witness.key. It is the witness’s identity, and its log can only be checked against it.

Day to day

# watch a page yourself, every six hours
sudo keepword watch add https://example.org/terms --every 6h
# ask the whole network to watch it, hourly for a week
sudo keepword request https://example.org/terms --every 1h --for 7days
# every capture and change, then what independent witnesses agree on
sudo keepword history https://example.org/terms
sudo keepword verdict https://example.org/terms
# the node's state, ending with warnings about anything misconfigured
sudo keepword net status
journalctl -u keepword -f

The web UI shows captured content, so it only listens on localhost. Open it through an SSH tunnel with ssh -L 8480:127.0.0.1:8480 your-server, then visit http://localhost:8480.

Use the container

Build the image from a checkout and run it behind a TLS reverse proxy on the host:

docker build -t keepword .
docker run -d --name keepword --restart unless-stopped \
    -v keepword-data:/data \
    -p 127.0.0.1:8480:8480 -p 127.0.0.1:8481:8481 \
    -e KEEPWORD_ENDPOINT=https://witness.example.org \
    -e KEEPWORD_PEERS=https://seed1.keepword.net \
    -e KEEPWORD_BEHIND_PROXY=1 \
    keepword

Or use docker compose -f packaging/docker/compose.yaml up -d. The /data volume holds the key, so back it up. Run commands with docker exec keepword keepword ….

Build from source

With Rust 1.90 or newer, try everything on your own machine:

cargo build --release
alias keepword=./target/release/keepword

keepword init --asn 3320 --country DE        # creates ./keepword-data
keepword capture https://example.org/privacy
keepword watch add https://example.org/privacy --every 6h
keepword serve --watch                        # web UI on http://127.0.0.1:8480

When the page changes, the next capture says so, and shows what changed:

$ keepword capture https://example.org/privacy
attestation 7c1e…
  ...
CHANGED since 3f2a90c1b7d4: silent edit: +1 -1 lines

--- before
+++ after
@@ -3,4 +3,4 @@
 h1: Privacy policy
-p: We never sell your data.
+p: We may share your data with partners.

To prove it to someone else, export an evidence file. They can check it anywhere:

keepword export https://example.org/privacy --at 2026-05-01 -o evidence.json
keepword verify --bundle evidence.json