Verification

Check a Proxara record yourself.

Every Proxara event is signed when it is written, chained to the entry before it, and anchored to Sigstore Rekor, a public transparency log Proxara does not operate. This page checks that record without taking custody of it: the full verification runs in your browser, and your file is read locally, never uploaded. The page enforces that on itself with a security policy that permits exactly one network destination, the fingerprint lookup, and nothing else.

Look up a fingerprint

Paste a SHA-256 fingerprint: a document's hash from its share page or console row, or an entry hash from an evidence pack. The lookup is content-free; it answers only whether that exact fingerprint sits in a signed chain and which public anchor covers it. Fingerprints cannot be guessed or enumerated, so you can only look up what you already hold.

Verify a whole evidence pack

Drop the evidence-pack zip exported from a Proxara console (or handed to you inside a bundle). The same checks the bundled offline verifier runs happen here, in this tab: every signature, every hash, the canonical bytes, the unbroken chain, the recorded head, and every Merkle inclusion proof up to the Rekor-anchored root. Nothing is uploaded.

Drop an evidence-pack zip here, or click to choose one. It stays on your machine.

What a PASS proves, and what it does not

A pass proves

Against the pack's own bundled key: the record was not altered by anyone who does not hold the signing key. Every entry's bytes are exactly what was signed; nothing was edited, removed, or inserted.

With the Sigstore Rekor cross-check: more than that. Batch roots publish to a public, append-only log Proxara does not operate, and a rewritten entry cannot be bound to a root the log already published, so even the party holding the signing key cannot quietly rewrite anchored history.

A pass does not prove

That the record is complete. A pack is an export over a window and a tenant; events outside it, or entries newer than the last anchor batch (reported here as pending, never claimed), are not attested by this check.

For the strictest posture, run the verifier that ships inside every pack on your own machine (VERIFY.md has the two commands) and pin a verifying key you obtained out of band. This page is a convenience; the math is the authority.