Permavault › What Is Self-Authenticating Evidence?

What Is Self-Authenticating Evidence?

Self-authenticating evidence is evidence that requires no extrinsic proof of authenticity: Federal Rule of Evidence 902 lists fourteen categories that authenticate themselves, so no foundation witness is needed to establish that the item is what you say it is. It still has to clear hearsay, relevance, and every other objection.

Published August 29, 2026 · Updated September 3, 2026

Most evidence has to be authenticated before it can be admitted. Someone has to produce enough proof that the thing is what its proponent says it is. Self-authenticating evidence is the exception: a defined list of items the rules treat as authentic on their face, with no extrinsic evidence required at all.

That is the whole concept. The rest is knowing what is on the list, what the certification route requires, and what self-authentication conspicuously does not do.

The short answer

Federal Rule of Evidence 902 opens with the operative sentence: the listed items “are self-authenticating; they require no extrinsic evidence of authenticity in order to be admitted.”

“Extrinsic evidence” means evidence outside the item itself. Ordinarily, under Rule 901(a), a proponent must produce evidence “sufficient to support a finding that the item is what the proponent claims it is,” which in practice usually means a witness. Rule 902 removes that step for fourteen defined categories, either because the item carries its own indicia of reliability, such as an official seal, or because a written certification stands in for the witness.

Two things follow immediately, and both are routinely misunderstood:

• Self-authentication is about authenticity only. It is not a ticket to admission.
• It removes a procedural burden, not a substantive standard. The item still has to be what you say it is; you just do not have to prove it with a live witness.

Authentication, and what Rule 902 removes from it

It helps to see the two rules as a pair.

Rule 901 is the general requirement. To authenticate, the proponent produces evidence sufficient to support a finding that the item is genuine. The bar is deliberately low, and it is worth being precise about why: the question is whether a reasonable jury could find the item is what it is claimed to be, not whether the judge is personally persuaded that it is. Rule 901(b) lists non-exhaustive examples: testimony of a witness with knowledge, comparison by an expert, distinctive characteristics, evidence about a process or system, and so on.

Rule 902 says that for the listed categories you skip that showing entirely. Not a lower bar, no bar. The court does not weigh whether the seal is convincing; a properly sealed domestic public document is self-authenticating, full stop.

What the opponent keeps is the right to contest everything else, including the genuineness of the item as a matter of weight before the jury. Self-authentication decides who has to do what at the admission stage. It does not decide what a factfinder believes.

The fourteen categories

Rule 902 has fourteen paragraphs. Note that many summaries still say twelve: that count predates the December 1, 2017 amendments, which added paragraphs (13) and (14) for electronic evidence. If a source says Rule 902 has twelve categories, it was written before 2017 or copied from something that was.

These are short paraphrases for orientation. The rule text controls, and it is worth reading when you intend to rely on a paragraph.

There is a natural break in that list. Paragraphs (1) through (10) are self-authenticating because of something visible about the item: a seal, a notarial acknowledgment, a masthead, a label. Paragraphs (11) through (14) are different in kind. Nothing about a server log looks authentic. Those four are self-authenticating because someone qualified signs a certification, in advance, and the other side gets notice and a chance to object.

The certification route: 902(11) through 902(14)

The four certification categories all borrow their mechanics from Rule 902(11), and the Advisory Committee notes set the standard precisely: the certification must contain “information that would be sufficient to establish authenticity were that information provided by a witness at trial.”

That is a useful test to write against. Draft what a live witness would have said about the record or the process, have a qualified person sign it, and you have the substance. An unsworn declaration under 28 U.S.C. § 1746 suffices.

The two electronic paragraphs, added in 2017, split along a clean line:

• 902(13) is about a process. A record generated by an electronic process or system that produces an accurate result. System logs, application output, the record produced by an automated capture tool. The question it answers is whether the machine’s output can be trusted.
• 902(14) is about a copy. Data copied from a device, storage medium, or file, authenticated by a process of digital identification. In practice that process is a cryptographic hash. The Advisory Committee notes are direct: “If the hash values for the original and copy are the same, it is highly improbable that the original and copy are not identical.” The question it answers is whether a copy matches its original.

They overlap in one direction only. As Judge Paul Grimm, Professor Daniel Capra, and Gregory Joseph observe in their Baylor Law Review treatment of the amendments, a copy is itself a record generated by an electronic process, so most 902(14) evidence could arguably ride under 902(13) as well; the reverse is not true, because records generated by an electronic system “may well not be a ‘copy’ of anything.” We take the pair apart in detail in FRE 902(13) vs 902(14).

What a 902(14) certification looks like in practice

Reported decisions actually applying these rules are scarce, which is worth knowing before you rely on one. The clearest is United States v. Dunnican, 961 F.3d 859 (6th Cir. 2020), where the government authenticated data extracted from a defendant’s phone under Rule 902(14).

The certification came from an ATF special agent “who possessed training and experience in mobile-device data extraction,” and it certified two things:

1. that he extracted the data on a specific date “through the use of specialized forensic software, which created an accurate and reliable duplication of the data”; and
2. that the software generated a “digital fingerprint” (otherwise known as a “hash”), “which indicated that the extraction was successful, complete, and accurate.”

That is the whole template: a qualified person, a described process, and a hash establishing the copy is complete and accurate. The Sixth Circuit held “the stipulations of Rule 902 have been met and the evidence was properly authenticated.”

One caveat that matters for how much weight to put on it. Dunnican had objected to neither the notice nor the proposed authentication method before trial, so the court reviewed only for plain error. Dunnican shows what an accepted certification contains; it is not a considered ruling on what the minimum is.

Two appellate decisions confirm the mechanism the rule relies on. In United States v. Miller, 982 F.3d 412 (6th Cir. 2020) and United States v. Holmes, 121 F.4th 727 (9th Cir. 2024), the courts quoted the 902(14) committee note on hash values, with Holmes observing that courts “have equated hash-value matches to digital fingerprints or digital DNA.”

Notice, which is the step people forfeit

The certification categories come with a condition that is easy to read past and expensive to miss. Rule 902(11) requires the proponent to give the adverse party “reasonable written notice” of the intent to offer the record, and to make the record and certification available for inspection, so the opponent has “a fair opportunity to challenge them.”

The Advisory Committee notes describe the purpose plainly: the procedure lets the parties “determine in advance of trial whether a real challenge to authenticity will be made,” and plan accordingly. The rule is designed to surface fights early, not to spring a shortcut at trial.

Skip the notice and you have surrendered the shortcut. You are back to Rule 901 and a live witness, on the day you were counting on not needing one.

United States v. Wood, 109 F.4th 1253 (10th Cir. 2024) is what that costs. The government’s certificate was substantively fine; it was disclosed after the jury had been chosen. The Tenth Circuit reversed the convictions, holding the district court “essentially ignored Rule 902(11)’s notice requirement, rendering a nullity one of the critical elements of the rule,” and that the disclosure did “not amount to written notice provided a reasonable time before trial.” The court explained why the requirement exists: to ensure the certificate system “did not serve to unfairly disadvantage litigation opponents,” who could then “do at pre-trial what they would have previously done by cross-examining foundation witnesses.”

Wood concerned a 902(11) certificate, but 902(13) and 902(14) both borrow that rule’s notice mechanics, and the court noted as much.

What self-authentication does not do

Three limits, all straight from the sources, all worth stating to a client before they get comfortable.

It establishes authenticity and nothing else. The Advisory Committee notes say a certification “can establish only that the proffered item has satisfied the admissibility requirements for authenticity,” and that the opponent “remains free to object to admissibility of the proffered item on other grounds,” listing hearsay, relevance, and, in criminal cases, the right of confrontation.

The note to Rule 902(13) makes the point in a way worth quoting to anyone who thinks a certificate settles matters: “a certification authenticating a computer output, such as a spreadsheet, does not preclude an objection that the information produced is unreliable, the authentication establishes only that the output came from the computer.” Authenticity answers where a record came from. It says nothing about whether the record is any good.

It does not improve a weak process. Grimm, Capra, and Joseph again: “These new amendments do not change the standards for authentication of electronic evidence. Rather, they change the manner in which the proponent’s submission on authenticity can be made.” If the capture process could not survive cross-examination, writing it down does not help. This is the point practitioners most often get backwards: the certification is a description of a process, so the quality of the process is the whole game.

It is federal. Many states have adopted parallel provisions, but adoption is not universal and details differ. Check your jurisdiction’s rules before relying on the federal route in state court.

A platform’s certificate authenticates the record, not the content. This one catches people with social media evidence. In United States v. Farrad, 895 F.3d 859 (6th Cir. 2018), the government obtained a certification from Facebook for photos taken from an account. The Sixth Circuit held it was error to treat the photos as self-authenticating business records on that basis, though harmless, because the photos were properly authenticated under Rule 901 anyway. The reasoning it adopted came from United States v. Browne, 834 F.3d 403 (3d Cir. 2016): a platform can confirm that communications took place between certain accounts at certain times, which “is no more sufficient to confirm the accuracy or reliability of the contents” than “a postal receipt would be to attest to the accuracy or reliability of the contents of the enclosed mailed letter.”

An honest gap in the case law

We could find no federal decision holding a 902(13) or 902(14) certification substantively insufficient. The reported cases either accepted the certification, treated it as unopposed, or turned on the notice requirement. So the standard for what a certification must contain currently comes from the Advisory Committee note and from commentators, not from decided cases. Anyone telling you there is a settled body of law on the contents of these certifications is ahead of the authority.

Rule 902 is not frozen

Worth knowing before you rely on the table above in a filing: Rule 902 has a proposed amendment open for public comment right now. The Judicial Conference published proposed amendments to Evidence Rules 104 and 902 on 14 August 2026, with comments closing 15 February 2027.

The Rule 902 change is narrow, and it is not about electronic evidence. It would amend Rule 902(1)(A) alone, adding “a federally recognized Indian Tribe or Nation” to the list of governments whose sealed and signed public documents are self-authenticating. The Committee Note explains that self-authentication of tribal public documents “will allow for more efficient proof of tribal records in federal court and will conserve the valuable resources of tribal officials who often had to appear in court to authenticate documents,” and that the amendment “concerns authenticity only; other evidentiary requirements continue to apply.” Coverage would turn on federal recognition as of the date the document is offered, per the list the Secretary of the Interior publishes under the Federally Recognized Indian Tribe List Act of 1994.

Paragraphs 902(11) through 902(14), the certification route most of this page is about, are not touched by the proposal.

The companion Rule 104 amendment affects the vocabulary of authentication more than its substance. It would codify that preliminary questions of fact under Rule 104(a) are decided by a preponderance of the evidence, and rewrite Rule 104(b) so the proponent “must demonstrate to the court that the trier of fact could reasonably find that the requirements of Rule 401 have been met.” The Committee Note says the amendment “eliminates the concept of ‘conditional relevance,’” reasoning that nearly all relevance involves some condition and the special category caused confusion. The Note lists Rule 901 among the provisions that call for this lower standard. If you have read that authentication is a question of “conditional relevance,” that framing is what the amendment would retire; the practical test would not move.

Nothing here is law yet. An amendment that survives comment still has to clear the Advisory Committee, the Standing Committee, the Judicial Conference, the Supreme Court and a period before Congress. The fourteen paragraphs described above are the current rule. The official published-for-comment page carries the current text and is the thing to check before citing the rule in a brief.

Self-authenticating digital evidence in practice

For web and document evidence, the two 2017 paragraphs are the practical route, and a well-made capture is the rare exhibit built for both at once.

The capture process is 902(13) territory: an automated system retrieved the page at a recorded URL and time, rendered it, and produced the archive. The certification describes that system and why its result is accurate.

The capture files are 902(14) territory: every file fingerprinted with cryptographic hashes at capture, so any later copy, including the one produced to opposing counsel, can be certified identical to the original by hash match.

Timing is what makes the second one work. A hash computed at the moment of capture proves the evidence has not changed since it came into existence. A hash computed weeks later, after the file sat on a shared drive, proves only that nothing changed after the hash. That timing discipline is also what anchors a chain of custody for digital evidence, and you can check the mechanism yourself rather than take it on faith.

None of this addresses attribution. A certified, hash-verified capture of an impersonated account is a certified, hash-verified capture of a fake. Authorship needs its own evidence, a point we develop in are screenshots admissible in court.

Where Permavault fits

Permavault produces captures designed for both certification routes. A neutral automated system captures the page as it rendered, records the URL, time, and process, and fingerprints every file with cryptographic hashes at capture. The result is stored on a permanent decentralized network of roughly 300 independent nodes, funded by a long-term storage endowment, so the record and its proof survive independently of any vendor. Including us. Anyone can verify it without trusting us.

Each capture is $4.99, with an optional Certificate of Authenticity from $9. The Legal tier adds a qualified electronic timestamp from Disig a.s., an EU-listed qualified trust service provider, applied to the signed capture manifest, plus an independent Bitcoin-anchored timestamp and a declaration template designed to support authentication under FRE 902(13) and 902(14). Under eIDAS Article 41, a qualified electronic timestamp carries a presumption of the accuracy of its date and time in EU courts.

This article is general information about the Federal Rules of Evidence, not legal advice for any specific matter. Rule text and Advisory Committee notes are quoted from the current official edition; the category summaries above are paraphrases and the rule text controls. Admissibility always depends on the facts, the jurisdiction, and the judge.