Verify
Don't take our word for it.
Two questions you can answer yourself, and one report someone else already answered.
1. Is this copy genuine?
Every file in the package has a SHA-256 fingerprint listed in CHECKSUMS.txt. If you compute the fingerprint yourself and it matches, the file is exactly as it was published.
# macOS / Linux shasum -a 256 -c CHECKSUMS.txt # Windows (PowerShell) Get-FileHash Elba.html -Algorithm SHA256
Fingerprints, published here — not just inside the package
A checksum file that ships with the package it vouches for can be rewritten by anyone who rewrote the package. So here are the same fingerprints, on our website, where a tamperer can't reach them. If a number below matches the one you compute locally, that file is the one we published.
| File | SHA-256 | |
|---|---|---|
| Elba-1.1.1.zip | 9aa97fd03834492ac036edb16dfa194920e64a7dad9db54556fbe5c50936639d | |
| Elba.html | 04b12feb09dee35b30047ca6ae5d5e285a202cb4989ab42fb75946ede95e3903 | |
| gift/Elba.html | 04b12feb09dee35b30047ca6ae5d5e285a202cb4989ab42fb75946ede95e3903 | |
| Elba.command | f1f7281d778bcf2ec40dd194cefd6c0e19843b7c5deda3e3d666a2c54df2e259 | |
| Elba.bat | 1ffd31bf9b55f0ae64ca9a4acbd847930acaf0604b28ddeed13f0ec1d56ff970 | |
| README.txt | 57d45dd3b7bd04535a62d159661c93fa841c99047c05213e2478f5ed9115aec7 | |
| VERIFY.txt | 9afec6be5fd472e57a16668c3d44248057c57a4948d5e4a2a723795d1f634173 | |
| CHANGELOG.txt | d32341fa71878192bf1e990f114eff96e38a52b7b61a8fbc8a65cbcff8263c7f | |
| LICENSE.txt | 9d1b0923875df927bec623753a62d7648e18fe938040dcc52b695c85de381173 | |
| THIRD-PARTY-LICENSES.txt | ed6f1183cebd416af3627686c9403f70b98c2a34f4174e100fbe00b8ada4cb04 | |
| Manual/Elba-Manual.md | d8278e356e846c2746d6daed0ff0f6ceeb595aa21b4bf1af849b71e1bad3c9ab | |
| Manual/Elba-Manual-Print-Light.pdf | 2b9caed410df07e6b2bbca59b05e7b33b2c0991929ea96407d2936605d0ca2a2 | |
| Manual/Elba-Manual-Screen-Dark.pdf | 08de26c9fc411c6187d77edc2e22ff71072024e2854175a9e11a649f23b2cf86 | |
| gift/FOR-WHOEVER-YOU-GIVE-THIS-TO.txt | 7aaec960a4aaf4671ff33325ed07080f8e4759a0c8fb2745ee2c33cb46aa6549 | |
| gift/README.txt | 57d45dd3b7bd04535a62d159661c93fa841c99047c05213e2478f5ed9115aec7 |
Release: Elba 1.1.1 · Published by Meanwhile VOF, Amsterdam.
2. Does it really send nothing anywhere?
Elba's central promise is that it makes no network connection at all. No fonts fetched, no analytics, no "checking for updates," nothing. You don't have to believe that. You can read it.
- · Open Elba.html in any text editor.
- · Search for http — you're looking for the absence of any address it might send data to.
- · Search for connect-src — you're looking for the presence of:
connect-src 'none'
This is an instruction to your browser to forbid Elba from opening any network connection whatsoever — and your browser enforces it, whether or not the code behaves. The promise isn't guarded by good intentions. It's guarded by your own browser.
3. What did someone else find?
An honest assessment of Elba 1.1.1, prepared by Claude (Anthropic) at the maker's request. Every file in the package was opened and read; the full source of Elba.html traced line by line; the Manual and the code compared against each other. The maker asked for honesty, not advertisement, and faults are named plainly. Published in full, alongside the software it examines.
Source review · commissioned by the maker · honest by instruction.
On 1 January 2030, Elba's full source becomes public under MIT, and anyone at all will be able to read every line that makes these promises true. Until then, the file in your hands is already open to your own inspection — and so is the price.