Verify it yourself, right here.
Drop a Sigilbase evidence bundle or a Certificate of Evidence below. Your browser recomputes the hash chain, rebuilds the Merkle roots, and checks every Ed25519 signature. If a record was altered, deleted or reordered, the result names the exact entry that broke. Your file is not uploaded. Verification happens in this browser.
Drop an evidence bundle or certificate here
bundle .zip · manifest.json + events.ndjson + checkpoints.json · certificate .json
Your bundle is not uploaded. Verification happens in this browser, and this page makes no network requests after it loads: open the network inspector and watch.
This page is a convenience. The real verifier is yours.
A verification page served by the party being verified is exactly the kind of thing this product teaches you to distrust. The authoritative check is the standalone open-source verifier: one file you can read in a sitting and run offline, with no code from us anywhere near it. A copy ships inside every evidence bundle.
To keep this page honest, a continuous-integration job runs its verification code against the same fixture corpus the standalone verifier is tested on (a valid bundle, a tampered payload, a deleted event, reordered events, a forged signature, a broken checkpoint chain) and fails the build on any disagreement. Read what the verifier proves, and what it deliberately does not.
Questions about verifying in the browser.
Is my evidence bundle uploaded when I verify it here?
No. The file is read by your browser and verified there. This page makes no network requests after it loads. No upload, no analytics, no third-party scripts, and you can confirm that in your browser's network inspector.
Is this browser check authoritative?
No, it is a convenience. The authoritative verifier is the standalone open-source one you can read and run yourself; it is a single file, it validates more (including timestamp-token signatures), and its verdict is the one to rely on. A continuous-integration job runs this page's verification code against the same fixture corpus as the standalone verifier and fails on any disagreement, so the two should never diverge. When it matters, run the real one.
What does this page check?
For an evidence bundle, it recomputes every event's payload and entry hash, re-walks the hash chain, rebuilds each checkpoint's Merkle root from the events it covers, re-checks the checkpoint chain, and verifies every Ed25519 signature against the signing keys in the manifest. For a Certificate of Evidence, it recomputes the event's hashes, walks the Merkle inclusion proof, and verifies the checkpoint signature. A failure names the exact sequence that broke.
What file do I drop?
An evidence bundle as exported from Sigilbase (the .zip, or its manifest.json, events.ndjson and checkpoints.json selected together), or a single-event Certificate of Evidence as a .json file.