You have found a page you may need to rely on later: a competitor's advertising claim, a supplier's terms, a statement that might be edited tomorrow. You can take a screenshot, print it to PDF, or save the page with a capture tool. Each keeps something different, and each will be challenged on something different.
This article compares the three on the questions an opponent is likely to ask, and ends with a short rule for choosing.
What authentication asks of any of them
Whatever the format, the question is the same: is this what you say it is? In US federal courts, Rule 901 puts it as producing "evidence sufficient to support a finding that the item is what the proponent claims it is". Its examples include a witness with knowledge, the item's distinctive characteristics taken together with the circumstances, and evidence describing a process or system and showing that it produces an accurate result.
So a format helps to the extent that it carries its own circumstances (address, time, tool) and comes from a process you can describe. Other jurisdictions have their own rules, but the practical question is similar. Which of these three makes your account easier to prove?
Screenshots
A screenshot is a picture of the pixels on your screen at one moment.
What it does well. It is fast, everyone understands it, and it shows what a person actually saw, including layout. For a quick note to yourself, or to show a colleague what you are looking at, it is fine.
Where it falls short.
- It is an image, not a page. You cannot search it, select text from it, or follow its links.
- It captures only what was on screen. Content below the fold, in a collapsed section or behind a tab is not in it unless you took several.
- It records nothing about where it came from. Unless the address bar and the clock were in frame, nothing in the file says which URL it was, or when.
- It is easy to alter, and the person challenging it knows that. An image editor can change a price or a sentence without leaving an obvious mark.
A screenshot is evidence that you, or someone, took a picture. It proves little about the page.
Print to PDF
Printing a page to PDF is a step up. The result is a single document that is easy to file, email and open years later.
What it does well. The text is usually real text, so it can be searched and quoted. It is one file, and it looks like a document. Many tools add the address and the print date in the header or footer.
Where it falls short.
- It is not the page you saw. Browsers apply a separate set of styles when printing. Web authors can write CSS that targets the print media type, and they commonly use it to hide navigation, banners and other elements. A PDF can therefore leave out something that was prominent on screen, or show something that was not.
- The page is broken up. Page breaks fall where the printer settings put them, and wide tables and fixed elements can be cut or repeated.
- The date is whatever the tool wrote. A date in a footer is text. It is not an independent record of when the file was made.
- It is editable. Many PDF editors will change text in a PDF. A PDF with no hash recorded at the time and no independent timestamp is a file anyone with an editor could have altered.
PDF is a good format for reading and filing. As the only record of a web page, it is weak, because what it holds is a re-rendering of the page for paper.
Web capture
A web capture saves the page itself: its HTML, styles, images and fonts, loaded by a browser from the address you gave. How it is stored varies:
- A single self-contained HTML file opens in any browser with the layout intact, and the text stays text.
- A WARC file is the archiving standard (ISO 28500). It stores the exchange between the browser and the server as records, each with a date and a target address. We explain it in what a WARC file is.
What it does well. It keeps the page as a page. It can carry the requested and final addresses, the time, and the tool used, inside the file or in a manifest beside it. Because the output is a file made by a repeatable process, you can describe that process, which is what the Rule 901 example about a process or system asks for. And because it is a file, you can hash it and have the hash independently timestamped, as we describe in what a SHA-256 hash proves.
Where it falls short.
- The saved page is a faithful copy of what the capturing browser received. It is not necessarily what every visitor would have received. Sites vary content by country, device and login.
- Pages behind a login are out of reach for many tools, and dynamic content may need to settle before the save.
- It is less familiar to a non-technical reader than a screenshot, so you may need a short explanation of what it is.
- A capture without a hash or timestamp is still just a file. The format helps, but it does not authenticate itself.
Side by side
| Screenshot | Print to PDF | Web capture | |
|---|---|---|---|
| Shows the page as seen on screen | Yes, one screenful | Not reliably: print styles apply | Yes, if the tool renders it as a browser does |
| Text is searchable | No | Usually | Yes |
| Records the address | Only if in frame | Often, as header or footer text | Yes, in the file or manifest |
| Records the time | Only if in frame | As text, if the tool adds it | Yes, in the file or manifest |
| Easy to alter unnoticed | Very | Yes | Yes, unless hashed and timestamped |
| Can be hashed and timestamped | Yes | Yes | Yes |
| Easy for a layperson to open | Very | Very | Yes (HTML), no (WARC) |
The last-but-one row is the point. Any of the three can be hashed and given an independent timestamp, and that step is what turns "a file I made" into "a file that existed at this time". The format decides how much of the page you have to hash.
Which to use
- If you only need a note for yourself, take a screenshot, and put the address bar and clock in frame.
- If you need something to read, file or send, print to PDF, and say in the file name or a covering note that it is a print of the page.
- If the page may matter in a dispute, make a web capture, hash it straight away, and have the hash timestamped by a third party. Keep the original read-only and work from copies.
- If it really matters, do two: a web capture as the record, and a screenshot or PDF of it as the easy-to-read exhibit. Record who made them, when, and with what.
In every case, write down what you did: the address you requested, the time, the tool and its version, and who ran it. That note is the circumstances Rule 901 asks about. We list what to record in how to preserve a web page as evidence.
How Archivepanel fits
Archivepanel makes a web capture. A real Chromium loads the public page and saves it as one self-contained HTML file with scripts stripped. A JPEG preview (a screenshot of the saved file, not of the live page), a plain-text version, a WARC and a JSON manifest are stored alongside it. The manifest lists a SHA-256 digest for every file and the addresses, times and tool versions behind the capture, and a DigiCert RFC 3161 timestamp covers the digest of the main document. See capturing a page and trusted timestamps.
It captures public pages only, one page at a time, as a browser sees them from our servers. The DigiCert timestamp is not an eIDAS qualified timestamp. It does not tell you what a visitor in another country would have seen.
Sources
- Federal Rules of Evidence, Rule 901, Authenticating or Identifying Evidence, Legal Information Institute, Cornell Law School.
- MDN Web Docs, Using media queries, on the
printmedia type and styles that target printers. - IIPC, The WARC Format 1.1.