Code & document signing
Check what a release really is before you run it. Verify Sigstore bundles and npm provenance down to the repository, workflow and commit that built them, read SLSA and in-toto attestations, check SSH-signed Git commits and files against allowed_signers, and inspect the signatures of Windows executables, Android APKs and Java archives. Documents and media too: verify PDF signatures (PAdES, LTV) and signed email (S/MIME) without uploading anything, decode RFC 3161 time-stamps, read the Content Credentials (C2PA) of images and video, and prove a key was generated on a YubiKey. Files and keys stay in your browser; the npm checker asks the public registry for the package you name, and the optional second Sigstore check sends our server only the bundle and the file’s digest.
12 tools
Sigstore Bundle Verifier
cosign, npm and GitHub attestation bundles
Verify a Sigstore bundle against the file it signs and the identity you expect: the Fulcio certificate and its SCTs, the Rekor log entry with its inclusion proof and checkpoint, signed and RFC 3161 time-stamps, DSSE and message signatures — offline, like cosign verify-blob.
Open toolnpm Provenance Checker
Where an npm package was really built
Type a package and version: the registry’s attestations are fetched by your browser and verified here — the Sigstore-signed SLSA provenance and the registry’s publish attestation — down to the repository, workflow and commit that built the tarball.
Open toolin-toto Attestation Viewer
SLSA provenance, DSSE and .intoto.jsonl
Paste a DSSE envelope, a .intoto.jsonl file, a Sigstore bundle or npm’s attestation list: see the statement’s subjects and what its predicate says — SLSA provenance, verification summaries, SBOMs — and verify the signatures with your keys or the embedded certificate.
Open toolSSH Signature Verifier
ssh-keygen -Y files, signed commits and tags
Check an SSHSIG signature made with ssh-keygen -Y sign, or a Git commit or tag signed with an SSH key, against an allowed_signers file — namespaces, principals, validity windows and SSH certificates, with the same rules as ssh-keygen.
Open toolAuthenticode Inspector
Signatures of Windows EXE, DLL and SYS files
Drop a Windows executable: its Authenticode image hash is recomputed and every signature verified — signer certificate and chain, nested SHA-1 and SHA-256 signatures, RFC 3161 time-stamps and countersignatures — with warnings for data hidden after the signature.
Open toolAPK Signature Inspector
Android APK signing schemes v1–v4
Drop an APK (and its .idsig): every signing scheme is verified as apksigner does — v2, v3 and v3.1 signers with their content digests, SDK ranges and key-rotation lineage, the v4 Merkle tree and the v1 JAR signature — with the certificate fingerprint Android identifies the app by.
Open toolJAR Signature Inspector
Signed JAR, WAR and EAR files, entry by entry
Drop a JAR, WAR or EAR: every entry is checked against the manifest, each signature file against the manifest and each PKCS #7 block against its signature file, with time-stamps and the signer’s chain — the verdict of jarsigner -verify -strict, entry by entry.
Open toolPDF Signature Verifier
Check PDF signatures without uploading
Drop a signed PDF to see what each signature covers, whether the document changed after signing, who signed it and when. PAdES, CMS, RFC 3161 time-stamps and LTV data are checked in your browser — the file is never uploaded.
Open toolS/MIME Signature Verifier
Check a signed email locally
Paste a signed email or open the .eml, .p7m or .p7s file: the CMS signature, the signer’s certificate, its e-mail address against the From: header and the certificate chain are checked in your browser.
Open toolTimestamp Token Inspector
Decode and verify RFC 3161 tokens
Paste a time-stamp token, response or request: TSTInfo is decoded, the message imprint is checked against your file, the nonce against the request, and the TSA signature and certificate chain are verified — all in your browser.
Open toolC2PA Content Credentials Inspector
Read and verify Content Credentials
Drop a photo, video or audio file to read its Content Credentials: who signed it, which tools created and edited it, whether AI was involved, what it was made from — and whether the file was changed since it was signed. Read in your browser with the C2PA reference implementation.
Open toolYubiKey Attestation Verifier
Prove a key was made on a YubiKey
Paste a YubiKey PIV attestation and the device’s f9 certificate: the chain to Yubico’s CA is verified and the slot, firmware, serial number, PIN and touch policies are read — so you can require a hardware-generated key before you issue a certificate.
Open tool