Code Verify: A New Layer of Assurance for WhatsApp Web
When you install a mobile app from an official app store, there's a baseline expectation that the code you're running is exactly what the developer published. The web offers no such guarantee. A browser fetches JavaScript from a server, and the user has no practical way to confirm that the code hasn't been altered in transit or on the server itself.
WhatsApp, concerned about the growing number of at-risk users on its web client—including journalists, activists, and human rights defenders—wanted to close this gap. The company approached Cloudflare to build a system that gives users a way to verify that the code running in their browser is the code WhatsApp intended to serve. Messages and media remain fully end-to-end encrypted and never traverse Cloudflare's network; Cloudflare's role is limited to acting as a trusted third-party audit point for code hashes.
The Core Challenge: Trusting the Hash Source
The idea of comparing hashes to verify a downloaded file isn't new. Consider the early days of Linux distributions: a user downloads an ISO and checks its MD5 hash against the one listed on the download page. If they match, the file is presumed authentic.
But there's a fundamental flaw in that approach. If an attacker can compromise the server hosting the software, they can just as easily replace the hash on the same page with one for their malicious version. The user's hash check passes, yet they've installed tampered code. Hosting verification data on the same infrastructure as the code itself provides little real security.
More robust schemes exist—such as signed signatures verified against public keys hosted elsewhere—but they demand technical knowledge and manual effort from users. That doesn't scale to a service with hundreds of millions of web users.
How Code Verify Works
Cloudflare's solution automates this verification process through a browser extension called Code Verify, published by Meta Open Source. The extension locally computes a cryptographic hash of the JavaScript libraries WhatsApp Web loads, then compares that hash against a "known good" hash stored on Cloudflare's audit endpoint.
The system involves three parties—the user, WhatsApp, and Cloudflare—and operates in four steps:
- WhatsApp publishes the latest version of its JavaScript libraries to its own servers, and simultaneously sends the corresponding hash to Cloudflare's audit endpoint.
- The WhatsApp web client fetches the libraries from WhatsApp's servers.
- The Code Verify extension retrieves the hash for that version from Cloudflare over a separate, secure connection.
- Code Verify compares the locally computed hash of the running libraries against Cloudflare's reference hash.
If the hashes match, the extension displays a "verified" state. If they don't, it signals that the code running in the browser differs from what WhatsApp intended to distribute—a potential indicator of tampering.
This design decouples the verification data from the code delivery infrastructure. Even if an attacker compromised WhatsApp's servers and replaced the JavaScript, they couldn't alter the reference hash stored with Cloudflare. The comparison would fail, alerting the user to the discrepancy.
Automation and Scale
The key innovation here isn't the hashing concept itself—it's the automation. Manual hash verification is impractical for mainstream users. By embedding the process in a browser extension, Code Verify makes tamper detection accessible to non-technical users without requiring them to understand or execute cryptographic operations.
The approach shares conceptual DNA with existing web security mechanisms. Subresource Integrity (SRI), for instance, lets browsers validate third-party assets against hashes embedded in the HTML that references them, refusing to load mismatched scripts. Certificate Transparency and Binary Transparency projects similarly provide publicly auditable logs for critical assets like WebPKI certificates. Cloudflare notes that the current system doesn't yet scale to arbitrary assets, but the company is exploring extending its offering toward a more general Binary Transparency model.
The WhatsApp collaboration represents an initial deployment of this verification model. Cloudflare's stated intention is to expand the offering to help other organizations provide similar code verification assurances to their own web users.
