{
  "markdown": "# mydatapass-verify\n\n**Independently verify a MyDataPass export — without trusting us.**\n\n[MyDataPass](https://mydatapass.app) delivers customer data offboarding exports as encrypted, audit-logged packages. This repository contains everything a recipient (or their security team) needs to **decrypt and verify an export with zero MyDataPass involvement**: the package format specification and two standalone verifiers.\n\n## Why this repo exists\n\nOur security model does not rely on secrecy of the format — it relies on the strength of the passphrase and standard, auditable cryptography. Publishing the format and the verification tooling means:\n\n- Your security team can review exactly how packages are encrypted **before** signing anything.\n- Recipients can decrypt and verify integrity **offline**, with no DataPass servers involved.\n- If DataPass disappeared tomorrow, every delivered package would remain fully recoverable with the passphrase and this tooling.\n\n## What's in an export package\n\nA MyDataPass package is a JSON file with four fields:\n\n| Field | Description |\n|---|---|\n| `ciphertext_b64` | AES-256-GCM ciphertext, Base64 |\n| `iv_b64` | 12-byte random nonce, Base64 |\n| `salt_b64` | 16-byte random KDF salt, Base64 |\n| `hash_sha256` | SHA-256 hex digest of the original plaintext |\n\nEncryption: **AES-256-GCM**. Key derivation: **PBKDF2-HMAC-SHA256, 310,000 iterations, 32-byte key**. Full details in [`docs/export-format.md`](docs/export-format.md).\n\n## Verify an export\n\n### Option A — browser, fully offline\n\nOpen [`verify.html`](verify.html) in any modern browser (works from `file://`, no network requests are made). Select the package file, enter the passphrase, and the page decrypts via WebCrypto and checks the SHA-256 digest locally.\n\n### Option B — command line\n\nRequires Python 3.9+ and the [`cryptography`](https://pypi.org/project/cryptography/) package:\n\n```bash\npip install cryptography\npython verify.py package.json --out exported-data.bin\n```\n\nThe script prompts for the passphrase, decrypts, and confirms the plaintext digest matches `hash_sha256`. Exit code `0` means the package is authentic and intact; any tampering with the ciphertext fails GCM authentication.\n\n## What this repo is NOT\n\nThis is **not** the MyDataPass product source code. It is the public, auditable surface: the delivery format, the verification tooling, and our [security model](SECURITY.md). Questions or responsible disclosure: **silvia@mydatapass.pro**.\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n",
  "bytes": 2511,
  "sha": "bb788e1603d1be535110188b91388f94d27e8601d62d4bd1087806df0109149e",
  "repo_slug": "mydatapass/datapass-verify",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_mydatapass_mydatapass_f1d5611d/readme"
}