Verify a signed record

Somebody sent you a file and a signed record of the checks it passed. Check it here. No key, no account, and the file never leaves your browser: the signature is verified on your machine, not on our server.

Do it without this page

A verifier that depends on the issuer is not a verifier. This one is a single file with no dependencies. Save it, read it, and run it against any record we ever issue, whether or not this site is still here.

verify-record.mjsthe public key set
node verify-record.mjs record.jws model.json jwks.json

What a green result does not mean

It does not mean the contents are true.
A signature proves these bytes came from this key and have not changed since. Whether the recycled-content figure inside is correct is a question for the supplier and his evidence, not for cryptography.
It does not mean the file is legally conformant.
A structurally valid file says nothing about legal conformity, we are not a conformity assessment body, and no certification scheme for these standards exists to be certified against.
Read the two facts separately.
A signature can be authentic while the file has been edited since. That case is a stale record, not a forgery, and this page reports it as its own outcome rather than folding it into one boolean.
Self-asserted is not verified.
If the issuer identity says self-asserted, nobody proved who signed it. That is a real and useful state, and it is not the same as a proven domain.

What each check covers, and the checks we do not run, are enumerated in the conformance statement.

Command palette

Navigate + run actions