Export your messages to PDF, without handing them to anyone.
CertifiedCopy reads a Messages database in your browser and writes a PDF, CSV, JSON or RSMF of any conversation. The reading, the searching and the PDF are all done by your own computer. Nothing is uploaded, because there is no server to upload it to — unless you ask the notary to witness the finished document, and then that PDF alone goes to it, once.
Free. No account. Works in Chrome, Safari and Firefox.
How it works
chat.db from your Mac, or hand it a whole iPhone backup
folder and it finds the messages itself. Or the sms.db inside an
iPhone backup. The file is opened in the page, the way a photo editor opens a photo.
What every export opens with
The first page of a sample export, laid out by the same code that lays out yours: the file it came from and that file's SHA-256, the messages included, the date range covered, when it was made, the document's own digest, and whether a notary witnessed it.
Rendered at build time from the test fixture — no real conversation.
Why "nothing is uploaded" is a fact here, not a policy
Most tools promise not to misuse the data you send them. CertifiedCopy makes a narrower and more checkable claim: your messages never leave the browser tab. The parser, the SQLite engine and the PDF renderer are compiled to WebAssembly and run on your machine. You can confirm it — open your browser's network panel while you export, and you will see no request carrying your data. Our own test suite asserts exactly that on every change. The one exception is yours to make: tick “witness this document” and the finished PDF is sent once to the notary, which signs the moment it saw it and keeps nothing.
Using an export as evidence
Every PDF opens with a certification page: the file it was produced from, that file's SHA-256 digest, its size, the conversation, the number of messages, the date range actually covered, and the participants. Re-computing the digest over the same file yields the same value; any alteration yields a different one.
That supports the specific thing Federal Rule of Evidence 902(14) contemplates — self-authentication of a digital copy through a certification describing hash verification.
What we do not claim. No tool can make a document admissible. Admissibility is decided by a court under FRE 901, on the whole record. CertifiedCopy produces a copy and describes it accurately. What weight that carries is not ours to promise, and any tool telling you otherwise is overselling.
What a defensible export contains — the difference between FRE 901 and 902(14), why the digest is taken over the source rather than the PDF, and what to preserve before exporting anything.
What it reads
| Source | Where it comes from | Supported |
|---|---|---|
| Mac Messages database | ~/Library/Messages/chat.db | Yes — copy it out first |
| iPhone backup | Choose the backup folder — a backup stores every file under a 40-character hash, and CertifiedCopy derives the right one | Yes |
| Connected iPhone | Over USB or Wi-Fi, with the optional agent below | Detects it; reading a live phone is not finished |
A live chat.db is in WAL mode and incomplete on its own. CertifiedCopy refuses it
rather than reading a partial copy, and tells you how to make a self-contained one:
sqlite3 "file:$HOME/Library/Messages/chat.db?mode=ro" "VACUUM INTO 'messages.db'"Reading a phone
Nothing needs installing. Make a backup with Finder — which most people already do — and drop
the backup folder onto this page. CertifiedCopy finds the Messages database inside it and reads
it in your browser, exactly as it reads a chat.db.
Where the backup already is, and what is inside it — the folder Finder writes to, why nothing in it has a filename, and what a backup never contains.
- Plug the iPhone in and open Finder. The phone appears in the sidebar.
- Choose General, then Back up all of the data on your iPhone to this Mac, then Back Up Now. The first one takes a while.
- Open the app and choose an iPhone backup folder. It lives in
~/Library/Application Support/MobileSync/Backup, one folder per device.
You never have to find a file inside it. A backup stores everything flat under a 40-character
hash of its original path — the Messages database is
3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28, with no extension — and CertifiedCopy
works that name out rather than asking you to.
Why the browser cannot read the phone directly
It is worth saying plainly, because it sounds like something that should be possible. A web
page has to claim a USB interface to talk to a device, and on a Mac every interface
an iPhone exposes already has an exclusive owner — the one carrying backups and messages
belongs to usbmuxd, which macOS starts for you. You can see it yourself:
ioreg -r -c IOUSBHostInterface -w0 | grep -B8 UsbExclusiveOwnerAn interface that already has an exclusive owner cannot be granted to a second one, so the browser's request fails no matter how you answer its permission dialog. The phone may still appear in the picker; being listed and being reachable are not the same thing. Windows works the same way through Apple's driver.
Which is why the route above goes through Finder. Finder is already the program that owns that conversation, it is already on the machine, and the backup it writes is a format this page can read.
The optional agent
If you would rather not use Finder, there is a small agent that makes the backup for you and tells the page when a phone is plugged in. It is optional — everything above works without it, and your messages are read and exported in the browser either way.
curl -fsSL https://certified.sh/install.sh | sh
Read the script first — it is served as plain text so you can. It
downloads one archive, checks its digest, and puts a universal binary in
~/.certifiedcopy, which is also where what it copies is kept: the backup it makes
of a phone, and any sealed copy of this Mac’s own messages. Removing all of it is
rm -rf ~/.certifiedcopy.
The agent answers this site and no other, over TLS, on this machine only — and only once you
have opened the pairing link it prints in your terminal. Pairing is not a small permission, and
it would be dishonest to describe it as one: a paired page reads everything the agent can read
— every conversation, every message, every name it has resolved, the phone on the cable — because
that is how your messages reach the page at all. None of it is uploaded. It is read on this
machine, by this browser, and it stops the moment you delete
~/.certifiedcopy/pairing-token-2 and restart the agent.
Questions
Do my messages get uploaded?
No. There is no server that receives them; the page does the work. If you tick “witness this document” when exporting, the finished PDF — and only then, and only it — is sent to the notary, which signs the moment it saw it and keeps nothing but a count on your account. The privacy page lists everything, with retention.
Does it work without an internet connection?
Yes. It installs as an app and runs offline.
Does the Mac app phone home?
Once a day it asks this site which version is current, so it can tell you when there is a
newer one. That request is a plain GET for
/download/release.json — a public file that is the same for everybody: it carries no
identifier, nothing about you and nothing about your messages. What it unavoidably reveals is
what any request reveals — that some address asked for a file.
It is made by the app on your Mac and never by this page, which is why the page's
content security policy still names only your own machine and the network
panel still shows nothing leaving it. To switch the check off entirely, start the app with
CERTIFIEDCOPY_NO_UPDATE_CHECK=1 — then no request is made at all, rather than made
and discarded.
Is anything stored?
Only if you ask. There is a checkbox to keep a database in your browser between visits, off by default, and one button to forget it.
Ticking it also lets the app keep a ledger of the documents you export from that database: the SHA-256 of each one, when it was made, and which conversations it covered — never any message text. That is what lets you drop a PDF back in later and be told whether it is one you produced. Leave the box unticked and nothing is written at all; forgetting the database clears the ledger with it.
Can it export a date range?
Yes. Pick a start and an end above the conversation and the export covers those days; the certificate states the range you asked for beside the range the document turns out to cover, which differ whenever the conversation does not fill the window.
Can it export more than one conversation at once?
Yes. Tick the conversations in the list and export them as a single PDF, CSV, JSON or RSMF. The certificate names every conversation in the document and counts them, and each CSV row says which conversation it came from. Selecting individual messages within a conversation is not built yet.
What does it cost?
Reading, copying and exporting cost nothing and never will. The notary — witnessing a document and verifying a witnessed copy — has a free tier and paid ones, on the pricing page.