How WorkSealed works

Track a task, build an invoice from the recorded hours, and send your client a package they can check in their browser. WorkSealed seals your work records so your client can check that the tracked hours on the invoice match those records and that the records have not changed.

1. Set up your client and task

Add your client, project, and task, and set the rate for the work. Use task names that your client will recognize, such as “September sales report” or “Website homepage.” This makes the time on your invoice easier to understand later.

No account is needed. Your data stays in files on your Mac. WorkSealed never syncs it or copies it to anyone’s cloud.

2. Start tracking when you begin work

Select the task and start the timer. Stop tracking when you finish. While tracking is running, WorkSealed records the app you use and, if you give permission, the window title. It counts key presses and mouse events to distinguish active time from idle time.

It never takes screenshots or records what you type, your clipboard contents, or your file contents. You can exclude apps or window titles from capture. Window-title permission is optional; tracking still works without it.

3. WorkSealed seals each completed record

Your tracked time is saved as individual work records. A record is completed when it reaches the configured record length or when tracking stops. WorkSealed then creates a digital fingerprint from the record’s time, task, rate, and recorded activity.

Sealed records are never rewritten. If a record is changed later, its fingerprint no longer matches. The app also keeps a signed history of the records and groups that history into sealed audit blocks. This lets the verifier check where a record belongs in the history.

4. Optionally add an independent timestamp

If you enable external timestamping, WorkSealed sends only a digital fingerprint (hash) of each sealed audit block to an independent Time Stamping Authority (TSA). No client names, task names, window titles, or work-log contents are sent to the TSA.

The TSA returns a digitally signed receipt linking the fingerprint to a time. This provides evidence that the block existed by that time. The exchange follows RFC 3161, the internet standard for these timestamps. The TSA can see your IP address and the time of your request.

Timestamping is optional. With it off, you can still track work, seal records, and create verifiable invoices. Those records simply have no independent timestamp.

5. Build an invoice from your tracked work

Choose the client and billing period, then create an invoice from the work you want to bill. Review the tasks, hours, rates, and amounts before sending it. The tracked lines are linked to the sealed work records that support them.

If you need to replace an invoice after a client rejects it, the original sealed work records stay unchanged.

6. Add any manual invoice lines

Add manual lines for fixed fees, expenses, or adjustments. Explain what each charge covers, and use one manual invoice line per expense so your client can follow the total.

Manual lines are part of the invoice, but you add them yourself. They are not generated by the app or backed by work logs. The verifier labels tracked records as App-observed and manual lines as Manual. The invoice signature covers the manual lines too, so later changes can be detected.

When the invoice is ready, export its evidence package. This includes the invoice, supporting records, signatures, any timestamp receipts, and a browser page that checks them. Review the package before sharing it, then send it however you normally send invoices.

Ask your client to unzip the package and open verify.html. That page checks the signed invoice data. The separate invoice.html and lines.csv files are convenience copies; your client should use the verifier to check the details that matter.

8. Your client checks the invoice

The checks run in your client’s browser. No account, app installation, or upload is needed, and the downloaded package works offline. The verifier checks:

Whether the billed tracked hours match the sealed work records.
Whether the invoice signature matches the signing key shown in the package.
Whether the work records have changed since they were sealed.
Whether the records match their place in the sealed history.
Whether any included timestamp receipts cover the sealed blocks.

Your client can compare the signing-key fingerprint with one you have already shared, such as in a contract or an earlier invoice. A matching signature identifies the holder of that key; it does not establish a person’s identity on its own.

The records cannot establish who was at the keyboard or whether the client considers the work worth the charge. The browser also does not validate the TSA’s certificate chain; the package’s README.txt explains how to check that separately.

Open a sample invoice and see the checks, or read what to send when a client disputes your hours.