Know whether your files changed
Assay seals a folder with a cryptographic hash of every file. When you check it later, it shows exactly what was modified, added, removed or renamed. One small command-line program, no dependencies, open source.
- Status
- Open source
- Licence
- AGPL-3.0
- Language
- Go
- Version
- 0.1.1
Where Assay helps
Is my backup still intact?
Seal a backup when you make it and check it before you need it. You see exactly which files rotted, vanished or were added.
Did someone change the site on the server?
Seal the deployed folder and check it on a schedule. Any edit, new file or deleted file shows up by name.
Can I show that this folder did not change?
A signed seal shows that a dataset, a release or a case file is exactly what you sealed, on the day you sealed it.
How it works
Seal the folder
assay seal ./folder writes a small manifest with a hash of every file. It takes seconds, also for thousands of files.
Check it later
assay check ./folder lists what was modified, added, removed or renamed, and gives an exit code your scripts can act on.
Sign it (optional)
assay keygen and assay seal --key make the seal tamper-proof: swapping the manifest after changing files is then noticed.
What a check looks like
$ assay seal ./backups
Sealed 1204 files -> backups/.assay.json
$ assay check ./backups
Checked 1204 files against backups/.assay.json (sealed 2026-10-16T09:12:44Z, sha256)
modified db/users.sqlite (4.2 MiB -> 4.2 MiB)
added db/users.sqlite-wal
removed logs/2026-10-01.log
renamed notes.txt -> archive/notes.txt
CHANGED: 1 modified, 1 added, 1 removed, 1 renamed, 1200 unchangedThe same run in a script: assay check ./backups --json, or just look at the exit code (0 nothing changed, 1 changes, 2 error).
What Assay does for you
- Modified, added, removed, renamed
- Not just "something differs": you see which files, and a moved file is recognised as a rename.
- Signed manifests
- Sign the seal with an Ed25519 key. Replacing the manifest after tampering with the files then breaks the signature.
- Made for scripts
- Exit code 0 when nothing changed, 1 when something did, and JSON output for your own tooling.
- One small program
- A single binary for Windows, macOS and Linux. No database, no service, no root.
- Readable reports
- Plain text in the terminal, or a self-contained HTML report you can hand to someone else.
- Keeps watching
- Check again every few seconds and see changes as they happen.
Assay or sha256sum?
sha256sum is fine for checking the files you list. It cannot see files that appeared, and it does not know that a file was renamed. Assay looks at the whole folder and tells you what is different.
Tools such as Tripwire and AIDE do a similar job but are built for system administrators. Assay is one small program you can run from a script or by hand.
Assay shows that a file changed, not who changed it. Anyone who can change the files can also seal them again; that is what the signature is for.
Install
On Debian, Ubuntu and derivatives, install it with apt. Updates then come with your normal system updates. Other systems: download an archive from GitHub, or use go install.
sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://sandsoftwaresolutions.github.io/apt/key.asc | sudo tee /etc/apt/keyrings/sandsoftwaresolutions.asc >/dev/null
echo "deb [signed-by=/etc/apt/keyrings/sandsoftwaresolutions.asc] https://sandsoftwaresolutions.github.io/apt stable main" | sudo tee /etc/apt/sources.list.d/sandsoftwaresolutions.list
sudo apt update
sudo apt install assay
# or, with Go 1.22 or newer:
go install github.com/SandSoftwareSolutions/assay@latestStatus
Assay is on GitHub, version 0.1.1, under the GNU Affero General Public License v3 (AGPL-3.0). Archives for Linux, macOS and Windows, Debian packages and checksums are attached to each release.
Frequently asked questions
What is Assay?
A command-line tool that records a hash of every file in a folder and later tells you which files differ from that record.
How is it different from sha256sum?
sha256sum only checks the files you list, so it cannot see new files, and it does not recognise renames. Assay looks at the whole folder and reports modified, added, removed and renamed files.
Can it tell who changed a file?
No. A hash shows that a file changed, not who changed it. Anyone who can change the files can also seal them again, which is why Assay can sign the seal with a key you keep elsewhere.
Which licence does Assay use?
The GNU Affero General Public License v3 (AGPL-3.0), the same as Foundry.
Which systems does it run on?
Windows, macOS and Linux, on both Intel/AMD and ARM processors.
Also from us
A question or an idea?
Send us an email. You talk directly to the people who build the software and get an answer within 2 working days.