Verify a record

Verify a signed record in your browser.

Paste a PEAC record and the public key you expect. The signature is checked in your browser, and nothing is uploaded.

Runs in your browser. Nothing is uploaded.
Not verified yetPaste a record and a key, or load a sample.
  • PendingThe supplied key validates the signature.
  • PendingThe signed bytes have not changed since signing.
  • Not checkedWhether the supplied key belongs to the declared issuer.
  • Not checkedWhether every related event was recorded or shared.
  • Not checkedWhether a policy or legal requirement was satisfied.
  • Not checkedThe full PEAC profile (I-JSON input, record structure): run the CLI for that.
Full verification

Run the full profile with the CLI.

The browser checks the signature. The PEAC CLI also checks the input rules and record structure, offline, under the key you supply.

$ pnpm dlx @peac/cli@0.16.4 samples generate -o ./s
$ pnpm dlx @peac/cli@0.16.4 verify ./s/valid/basic-record.jws --public-key ./s/bundles/sandbox-jwks.json
Signature valid (offline).
Verification profile

What PEAC v0.16.4 checks.

Offline, by public keyno network
Only the issuer's public key is needed. Nothing is fetched, and no account is required.
Ed25519 over compact JWSRFC 8032 · RFC 7515
Checked with a small-order key denylist. Runtimes without stable Ed25519 fail closed.
Deterministic inputRFC 7493 (I-JSON)
Duplicate members, out-of-range numbers and invalid strings are rejected, so every verifier reads the same bytes the same way.
Optional replay guardopt-in
Classifies a verified record as fresh, replayed or outside its acceptance window.
HTTP Message SignaturesRFC 9421 · RFC 9530
For request-shaped flows, with content digests over the raw body bytes.
Inclusion proofsset commitment
Confirm a record belongs to a sealed run without re-checking every other record.

Send someone a record, and they can verify it here.