Independent verifier

Verify a record package

Paste a package hash or slug, a hosted URL, or drop in a bundle. The verifier resolves the package's own proofs and re-checks them here, in your browser — recomputing the hash, checking the signature, and looking up the signing key in the publisher's trust registry. Each check shows the values it computed. You get two independent readings: whether the cryptography holds, and — separately — whether the publisher is one typedstandards.org recognizes.

A hash or slug carries no origin of its own, so it resolves against civicaitools.org by default. A link can point it at a different publisher in three ways: the path form /verify/<host>/<id>, a &host=https://<publisher-origin> parameter beside ?hash=, or ?url=with the package's own hosted URL. When nothing names a publisher, the verifier states which host answered and offers the roster to re-resolve it elsewhere in one click.

Powered by @typedstandards/verify-core v0.9.0 — the same verification core civicaitools.org runs server-side. Depth matches that core: full client-side crypto for the signature, hashes, and key trust; the RFC 3161 timestamp is chain-verified offline to the pinned FreeTSA root; and the Rekor transparency-log entry has its Merkle inclusion proof recomputed against the log’s signed checkpoint. Disclosure ≠ validation: this surfaces integrity, identity, timestamp, and transparency — not whether the content is correct.

Publishing records? Embed a verify badge that deep-links readers here.