Done-for-you email evidence certification
An email thread you need as evidence? We certify the originals.
ProofSnap turns an email thread into court-ready evidence: you save each message as an .eml or .msg file, and within 24 hours you receive a numbered transcript with the full headers, hashed attachments, and an eIDAS qualified timestamp carrying the Article 41(2) presumption in the EU. The package supplies the technical predicate for a FRE 902(14) certification in US federal court. $59.99 per thread.
Contract dispute, unpaid invoice, wrongful termination, fraud, defamation? If the decisive promise was made by email, the printout in your file is the weakest version of it. The original message still carries the proof.
A printed email shows the text and drops everything a court can test. Your certified package keeps the Received chain, Message-ID, thread links and the SPF, DKIM and DMARC results recorded on delivery, and seals them with an eIDAS qualified timestamp (with a legal presumption of accuracy in the EU).
Not sure your files are usable? Email us first and we will check one message before you pay. If we cannot process your files, you get a credit.
We never see what we do not need. We work only from the files you send us, we transcribe only the thread you ask for, and after we hand over your package we delete all your data from our servers.
One-time payment · no subscription · the certified package is yours to keep.
Delivered in 24 hours · eIDAS qualified timestamp included · Verifiable by anyone
Re: Delivery deadline and final invoice
9 messages · 12 Mar to 4 Apr
M. Keller
12 Mar, 09:14
We confirm delivery by 31 March at the agreed price.
J. Sanders
28 Mar, 17:41
The deadline moves to 20 April. No extra cost on your side.
M. Keller
4 Apr, 08:02
We never agreed to that. Please send the original message.
Illustrative example. Each message is numbered, so you can cite Message 7 and point to the exact line the case turns on.
Every package can be verified by anyone, for free, in the open Trust Verifier.
Quick answer
How do I turn an email thread into court-ready evidence?
Save every message of the thread as an original file (.eml or .msg), send the files to ProofSnap, and we deliver a certified package within 24 hours. We order the thread by its own header links, reproduce each message with its headers, extract and hash every attachment, sign the manifest, anchor it in the Bitcoin blockchain and add an eIDAS qualified timestamp. Your original files are preserved untouched. One thread is $59.99.
What it proves: that your message files existed in that exact state no later than the timestamp, and that they have not changed since they were sealed. What it does not prove: who sat at the keyboard. ProofSnap is an evidence tool, not legal advice.
Why a printed email is the weakest version of your proof
Most people bring their lawyer a PDF printout or a screenshot. That is the one form of the message with nothing left to examine. Certification from the original files fixes all four weaknesses.
Printing strips the headers
A print to PDF keeps the visible text and drops the Received chain, the Message-ID and the authentication results. What is left is a picture of words that anyone could have typed.
No provable point in time
A file on your computer has no independent date, and its date can be changed. Certification anchors it with a Bitcoin OpenTimestamps proof and an eIDAS qualified timestamp that carries a legal presumption.
Forwarding destroys the original
A normal forward creates a new message. The original headers turn into body text and the DKIM signature no longer covers what the other side receives. The most common defect we see is a thread supplied as one final message with the earlier ones only quoted inside it.
The mailbox is not forever
Retention policies purge old mail, employers close accounts, providers delete data. Certified files stay yours regardless of what happens to the mailbox they came from, and they carry the chain of custody a raw copy lacks. That is why law firms preserve evidence early rather than at filing time.
From "I have the emails" to court-ready, in four steps
A done-for-you service. You save and send, we do the rest, and you receive the sealed package within 24 hours.
Save the messages as files
One file per message. In Outlook, Gmail, Thunderbird and Apple Mail it takes two clicks, or you can drag the messages into a folder.
See exact steps ↓Upload on the secure page
A secure upload page opens right after payment. Put each thread in its own folder and tell us the case reference.
We certify and deliver
A signed ZIP with your numbered transcript, the preserved originals, extracted attachments, Bitcoin anchor and eIDAS timestamp.
Step 1 in detail
How to save your emails as files
No email client saves a whole thread as a single file. The job is the same everywhere: select all the messages in the thread and save them, one file per message. Here is the exact path in each mail program.
In Gmail
Gmail, one message at a time or all at once
- 1Open the message and click the three dots at its top right.
- 2Choose Download message. You get an .eml file with the headers and every attachment inside.
- 3For a whole thread, select the messages in the list, then More, Forward as attachment, and send them to yourself or to us. Each original travels untouched inside the new mail.
For a very long thread you can also apply a dedicated label to it and export just that label in Google Takeout, which gives you one .mbox file. We can read .mbox files just as well as .eml.
In Outlook
Outlook, on the desktop and on the web
- 1Classic Outlook on Windows: select the messages in the thread with Ctrl and drag them straight into an empty folder on your desktop. Each is saved as a .msg file with its attachments. Selecting them and pressing Ctrl + Alt + F forwards them all as attachments instead.
- 2New Outlook: open the message, click More actions (the three dots) and choose Save as. In Outlook on the web the same command is called Download.
- 3Whatever the route, do not choose Print or Save as PDF. That is the one output with no headers left in it.
Both .msg and .eml work for us. We check on arrival that the files actually carry their headers, and if something is missing we tell you before we certify.
Thunderbird and Apple Mail
Thunderbird: select the messages, right-click and choose Save As. Each is written out as an .eml file. Dragging the selection into a folder does the same thing.
Apple Mail: select the messages and drag them from the message list into a folder in Finder. You get one .eml per message, attachments included.
The one mistake that costs you the evidence
Forward (the normal one): a new message is created, the original headers become body text, and the DKIM signature no longer covers them.
Forward as attachment: the original travels byte for byte inside the new mail, so it stays usable.
Saved files: the safest route, and the one we recommend.
Message size limits stop large threads from being forwarded. If the thread is larger than roughly 20 MB, use the upload page instead.
What you get back
The centerpiece is a readable transcript of the whole thread: every message numbered, in the order the headers themselves establish, each one carrying the technical record a court can test. It ships inside a signed ZIP built to support authentication, and we email you an Evidence Delivery Note.
Every ProofSnap email certification is delivered as a signed ZIP of 12 files: the transcript, your preserved originals, the extracted attachments, each with its own SHA-256 hash, an RSA-4096 signature over the manifest, a Bitcoin OpenTimestamps anchor and an eIDAS qualified timestamp. Everything in it is verifiable by anyone, for free, in the open Trust Verifier.
The email thread transcript (rendered from your files)
A folder of .eml files is not something you hand a judge. We parse each message and produce an Email Thread Transcript PDF: the conversation in sequence, each message numbered so you can cite "Message 7" in a filing, with its header block printed above the text.
Per message: From, To, Cc, Date, Subject, Message-ID, plus the thread links In-Reply-To and References
The Received chain (the route the message actually took through the mail servers) and the SPF, DKIM and DMARC results exactly as the receiving server recorded them
Ordering by the header links, not by the displayed date, because a sending client can write any date it likes
Every attachment listed with its own SHA-256, and flagged as a real attachment, an inline image or only a cloud link
Cover sheet: parties, case reference, date range, message count, source files and their hashes, plus methodology, the time-zone convention used and scope-of-proof notes
Faithful rendering: nothing added, altered, reordered or omitted, and any gap in the thread is documented rather than quietly closed
Inside the signed evidence ZIP
Originals preserved
Your .eml and .msg files are kept byte for byte alongside the transcript, so anyone can re-derive it, re-read the raw headers or re-check the DKIM signature against the sending domain.
Attachments as evidence in their own right
Every attachment is extracted into the package with its own SHA-256 and is never re-encoded, so a contract or a photo can be exhibited separately from the message that carried it.
Two timestamp layers
Bitcoin OpenTimestamps anchor plus an eIDAS qualified timestamp from Disig a.s. We email an Evidence Delivery Note carrying the ZIP SHA-256.
Why the original file matters
What is inside an email that a printout throws away
Each of these lines is written by a mail server, not by the sender, and the DKIM signature among them can be verified independently. That is precisely why they are worth preserving.
The Received chain
Every mail server that handled the message adds a line with its own name, address and time. Read from the bottom up, it is the route the message traveled, and a fabricated route rarely stays consistent across every hop.
Message-ID and thread links
A unique identifier per message, plus In-Reply-To and References that tie each reply to its parent. This is how we prove the sequence of a thread instead of trusting the dates on screen.
SPF, DKIM and DMARC results
The receiving server records whether the sending domain authorized the server that sent the message and whether the cryptographic DKIM signature matched. SPF authenticates the envelope sender domain and DKIM the signing domain; DMARC is what ties either result to the visible From address. The transcript quotes the result verbatim rather than reinterpreting it.
The attachment as it was sent
Attachments are encoded inside the message, so the copy we extract is the one that arrived, not a version re-saved and re-compressed on somebody's desktop. Each gets its own hash.
One honest caveat about DKIM: sending domains rotate their signing keys, so an older message may no longer be re-verifiable against the domain even though it was genuine. Where that happens we record it as not verifiable and never as a failure.
The four hurdles
Four things a court checks before an email becomes evidence
Certification does not decide your case; it is aimed at the second hurdle and helps with the fourth. Knowing which hurdle is which is what stops an exhibit from being thrown out on a technicality.
-
1. Relevance
Does the email make a fact of the case more or less likely? This is your lawyer's argument, not a technical property of the file. No amount of cryptography makes an irrelevant message admissible.
-
2. Authentication, the hurdle emails usually fail
You must show the email is what you say it is: sent by the person it claims to be from, unaltered, and accurately reproduced. Federal Rule of Evidence 901 sets the general standard, and, since December 1, 2017, Rule 902(14) has allowed authenticity to be established by the certification of a qualified person instead of live testimony, which is exactly the path a hashed, certified copy supports. The certification is signed by that qualified person and the proponent serves the notice the rule requires; the package supplies the hashes and the record of the process it certifies.
"Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent also must meet the notice requirements of Rule 902(11)." Federal Rules of Evidence, Rule 902(14), effective December 1, 2017. Source: Cornell Legal Information Institute.
-
3. Hearsay
An authenticated email can still be excluded as hearsay if it is offered to prove that what it says is true. In US practice the usual ways through are a statement by the opposing party and a business record made at or near the time and kept in the regular course of business. Which route fits your thread is a question for counsel.
-
4. The original
For electronically stored information the rules on originals treat any printout or other readable output as the original, provided it accurately reflects the information. The word doing the work is "accurately", and accuracy is precisely what a SHA-256 hash of the preserved source file lets you demonstrate rather than assert.
Outside the United States the framing changes, but the substance does not. In the EU the work is done by integrity plus a reliable date, which is exactly what Article 41(2) of Regulation (EU) No 910/2014 supplies. In England and Wales the other side is deemed to admit the authenticity of a disclosed document unless it serves notice that it wants the document proved at trial. A hash-backed copy is an efficient answer to that notice, so the question again becomes whether your copy is demonstrably faithful. ProofSnap is an evidence tool, not legal advice.
Two layers of proof, and what each one means
Both layers are included in every certification. The qualified timestamp is what carries legal weight in the EU.
Bitcoin OpenTimestamps
The SHA-256 hash of your sealed manifest is anchored in the Bitcoin blockchain: a decentralized, independent, tamper-resistant proof that the files existed no later than a specific point in time. Its weight is for the court to assess.
eIDAS qualified timestamp
Court-grade in the EU
Issued by Disig a.s., a Qualified Trust Service Provider on the EU Trusted List. The presumption is written into the regulation itself.
"A qualified electronic time stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound." Article 41(2), Regulation (EU) No 910/2014 (eIDAS), applicable since 1 July 2016. Source: EUR-Lex.
What certification proves, and what it rests on
What certification proves
- The message files existed in that exact state no later than the timestamp.
- Nothing has been altered since they were sealed, transcript and attachments included.
- The technical record of origin and routing is preserved in full, so an expert can test it later.
- The sequence of the thread is derived from the messages themselves, not from what a screen displayed.
What it rests on
- The full Received chain, the Message-ID and the thread headers, exactly as the mail servers wrote them.
- The SPF, DKIM and DMARC results as the receiving server recorded them, and the DKIM signature itself, which stays verifiable while the sending domain publishes the selector key.
- An eIDAS qualified timestamp from a Qualified Trust Service Provider on the EU Trusted List, plus a Bitcoin OpenTimestamps anchor.
- A SHA-256 hash of every file and of every attachment, in a signed manifest.
We make the content and order of your files verifiable, and fix the point in time at which they existed, and we hand the court the technical record that speaks to origin, so the fight is about what the emails mean rather than whether you produced them faithfully.
Built to support authentication under FRE 901 and self-authentication under FRE 902(13) and 902(14) in US federal court, and to support reliance on the eIDAS Article 41(2) presumption in the EU. ProofSnap is an evidence tool, not legal advice. For your specific case, consult a qualified lawyer.
Pricing
Already have the messages saved? We certify them as they are.
One certification covers one thread and every attachment in it, however many messages it contains.
Email Thread Certification
1 thread · certified in 24 hours
- Your .eml, .msg or .mbox files, certified as they are
- Numbered transcript with the full header block per message
- All attachments extracted and hashed individually
- eIDAS qualified timestamp + Bitcoin anchor
- Signed ZIP + certificate PDF + chain of custody
Right after payment, a secure upload page appears where you send us your files, so nothing sensitive has to go by email. Delivery is within 24 hours, and within two business days for a very large thread with heavy attachments. If we cannot process your files, we will help you produce usable ones or issue a full credit toward a future certification. Not sure what you have? Ask us before you order.
Several threads or a recurring need?
Law firms, investigators and compliance teams that certify correspondence regularly can email support@getproofsnap.com, and we will set up a volume arrangement.
Prefer to do it yourself?
The ProofSnap extension has a self-serve File Certification that seals files you already hold. It hashes and timestamps them, though it does not produce a transcript. We also certify WhatsApp, Signal and Telegram exports.
ProofSnap compared with a printout, a notary or a forensic examiner
Court-grade certification, delivered in 24 hours, at a fraction of a forensic examiner's cost.
| Feature | ProofSnap | Printout or screenshot | Notary | Forensic examiner |
|---|---|---|---|---|
| Full message headers preserved | No | Rarely | ||
| Numbered transcript of the thread | No | No | ||
| SHA-256 hash + signed manifest | No | No | ||
| eIDAS qualified timestamp | No | No | Rarely | |
| Attachments extracted and hashed | No | No | ||
| Works for emails already sent and received | ||||
| Turnaround | 24 hours | Instant | Days | Days to weeks |
| Typical price | $59.99 | Free | $2 to $50 per notarial act | From several hundred dollars |
As for the notary column, the fee is not the point. State law caps the fee for a notarial act, typically somewhere between $2 and $25 depending on the state, and remote online notarization usually costs $25 to $50. What you get for it is an attestation that a printout was made in the notary's presence, which says nothing about the headers or the integrity of the underlying file. In Germany and Austria a notarial record of online content is a different and considerably more expensive instrument.
A separate category worth knowing about: certified-email services seal a message at the moment you send it, by copying the provider on the message. That helps with correspondence you send from now on, not with a message sent months ago. This page is about the correspondence already sitting in your mailbox.
Frequently asked questions
For a website, not an inbox
Need to prove a web page, not an email?
This page is about email threads. If your evidence is a website, a social post, a marketplace listing, a review or an online article, ProofSnap is a Chrome extension that lets you capture it as court-ready evidence yourself, in seconds. Same integrity you get here: a SHA-256 hash, an RSA-4096 signature, a Bitcoin blockchain timestamp and a Provenance Certificate, packaged into an 11- to 15-file evidence ZIP you can verify for free. Prefer not to install anything? Our web page capture service does the same job for a URL you send us.
Standard SnapPack
10 captures · no expiration · one-time purchase
Pay-as-you-go, no subscription. All features: export, metadata, a short video proof, a Provenance Certificate and a blockchain timestamp.
eIDAS SnapPack
EU qualified timestamps (Disig a.s.)
$5.00 / stamp · also 1 stamp for $6.99 or 10 for $49.99
Adds a qualified eIDAS timestamp per capture, with a legal presumption of accuracy across the EU. Whitelabel branding on the evidence PDF.
Subscription
Essential · Professional · Enterprise
Annual plans save 20%
For regular use: monthly capture allowances, File Certification and eIDAS stamps on higher tiers. Includes a 7-day free trial (a credit card is required to start).
Prefer no subscription and no auto-renewal? The Standard SnapPack at $4.99 is a one-time purchase. SnapPacks are bought inside the extension after you install it. See the full ProofSnap pricing and features on getproofsnap.com.
Free to install · capture your first web page as evidence in under a minute.