Someone gave you a record and told you it has not been altered. This page checks that claim. Nothing is uploaded. The file never leaves your computer, this page makes no network requests, and it works with your connection off.
Drop a .tar bundle here
or
This is the one thing the file cannot tell you honestly. It records a root, but that record was written by whoever sent it to you. If you were given a root separately, in a contract, an email, or a phone call, paste it here and the check uses yours instead.
No bundle to hand? Try one of these. Both are real exports, both carry a real transparency-log anchor, and the second one has been interfered with.
— five events. Its root is
ed25519:642a95838ed2d95898c47b803ebe925bcf5a6a039ad64ca75d608167fb8b0664,
published here on purpose: a trust root is a public fingerprint, and seeing it
somewhere other than inside the file is the whole point.
— the same shape, except the service storing it appended a fourth event
with its own key: a hardware set quietly downgraded, which the owner never
wrote. The chain is intact and the hashes all match, because it is a real
event, properly made. It fails anyway, on the one check that asks who wrote
each line. Its root is
ed25519:b98ee1fa5f972debf582b87cb29086230d8cd29783e7c9209993b310056dcc70.
The archive is complete and nothing in it is corrupted. This is not evidence against whoever sent it: anyone who could change a file could change the digest recorded beside it. It catches a truncated download, not a liar.
Every event hashes to its own contents and links to the one before it. This is the check that altering a record breaks. Change one word in one event and its hash changes, which breaks the link from the next event, and so on to the end.
The merkle root recomputes from the events. It is the single value an external anchor commits to.
Every event was signed by a key the project admitted, replayed from a trust root. The registry is not a list beside the record; it lives inside it as ordinary events. A key cannot admit itself, and validity is position in the chain rather than the clock on anyone's computer.
Without a root of your own this uses the one in the file and says so. That is worth less, because you are then asking the record to vouch for itself.
Every document the events cite actually travelled with them. A record that points at a drawing it cannot produce is a record you cannot check.
The root was published in a public append-only log that neither you nor the sender controls, and the log's own inclusion proof reaches its root. This is what stops a history being rewritten later and backdated. It is checked here arithmetically, offline, from the proof inside the file.
Each .paly is a database, and this page confirms its format and
reads the document hash it declares. Opening one fully, to re-derive that hash
from the PDF it carries, needs more of a database engine than belongs in a page
you are meant to be able to read. The bundle carries verify.py for
that, which needs only a Python install and no packages at all.
It was written by the same people who wrote the record. That is a fair objection and there is an answer to it: you do not have to use it.
Every bundle contains a file called verify.py. It does all of
these checks and the one this page leaves out, using nothing but the Python
standard library. No installation, no packages, no network. You can read it
before you run it, which is the point.
tar -xf bundle.tar verify.py python3 verify.py bundle.tar --root ed25519:…
The format is also documented inside the bundle in VERIFY.md,
so a determined reader can do every check by hand with a SHA-256 tool.