Verify a ControlFrame artifact
Paste a Decision Passport or a Governed Receipt. This page recomputes its hash chain and verifies its Ed25519 signature in your own browser, and tells you exactly which of those checks passed.
A Decision Passport or a Governed Receipt, as JSON. It stays in this browser tab — this page makes no network request with what you paste.
The result appears here.
What this page checks, and what it does not
Decision Passport
A controlframe.decision-passport.v1 document. The SHA-256 chain is recomputed record by record, the declared terminal hash and record count are checked against what the records actually produce, and the Ed25519 signature is verified against the public key embedded in the document.
Governed Receipt
A receipt carrying body, signature and public_key. The signature is verified over the canonical body, and the body digest and step chain are checked when the receipt declares them. A receipt that declares neither is reported as not present, not as passing.
Nothing is uploaded
Verification runs in this browser tab through WebCrypto. The pasted document is not sent to ControlFrame or anywhere else. A verifier you have to trust the vendor's server to run is not a verifier, which is why the offline path is the one published here.
Key provenance is out of scope
This page checks integrity and possession of the key that signed the document. It cannot tell you who holds that key. Match the reported fingerprint against a key you obtained independently before treating a pass as attribution.
A verifier that cannot fail is worthless
Change one byte anywhere in a signed document and this page reports a failure and names the record it refused. If you want to watch that happen on a known-good artifact before trusting it with yours, the walkthrough is on the offline verification page.