Skip to content
Preview — registry, ledger and certificate data on this host are sample data.
Menu

Verify a certificate

Enter the identifier printed on the certificate. This page fetches the signed token and the published key set and verifies the signature in your browser — it does not ask us whether the certificate is good.

Sample data

No production certificate has been issued: the production signing keys are created at launch. The certificates below were signed by this preview's committed fixture keys (psn-preview-2026-1, psn-sandbox-2026-1) — public keys by construction, so nothing they sign is a credential. They exist so every verdict this page can reach is reachable, and a production build refuses them outright.

Offline mode — paste a token

Verify a certificate token against the published key set without looking anything up. Useful when you have the artifact but not the identifier, and for checking that a certificate you were sent matches one you already trust.

Offline mode checks the signature only. It cannot check transparency-log inclusion or revocation, so a token that passes here still needs a lookup by identifier to be trusted.

verify only at purposesource.org/verify

Try a sample certificate

One certificate per row of the verdict matrix below. Each link opens this page with the identifier filled in, and the verdict is then computed in your browser from the signature and the transparency log — not read off this table.

Sample certificates published by this preview. Every one is labelled sample; none is a credential.

Certificate What it demonstrates Expected verdict
cert_01j9smqa1a2b3c4d5e6f7g8h9j
supporter / entitlement · Alpenglow Systems AG sample 		corporate supporter, valid — signature verifies, hash logged, status current valid
cert_01j9smqa2k3m4n5p6q7r8s9t0v
supporter / entitlement · Pinecrest Studios sample 		corporate supporter, expired — WAS VALID for the period shown; expiry is not revocation was-valid
cert_01j9smqa3w4x5y6z7a8b9c0d1e
contributor / participation · sample-dev-anouk sample 		contributor participation, valid — attests participation only, never an amount valid
cert_01j9smqa4f5g6h7j8k9m0n1p2q
license-status / waiver · Larkspur Analytics sample 		licence-status (waiver), valid — a status claim, never a supporter or impact claim (D14) valid
cert_01j9smqa5r6s7t8v9w0x1y2z3a
supporter / entitlement · Tessellate Cloud Inc sample 		corporate supporter, revoked — the repository was delisted; revocation is prospective and the historical window stays visible revoked
cert_01j9smqa6b7c8d9e0f1g2h3j4k
supporter / entitlement · Sandbox Test Buyer sample 		sandbox key id — TEST CERTIFICATE, never a production credential, deliberately absent from the log (COM-086) test
cert_01j9smqa7m8n9p0q1r2s3t4v5w
contributor / participation · sample-dev-jiro sample 		signed but not in the transparency log — UNVERIFIED, whatever the signature says (CERT-030) unverified
cert_01j9smqa8x9y0z1a2b3c4d5e6f
supporter / entitlement · Alpenglow Systems AG sample 		superseded — issued with the wrong band and replaced five minutes later; payloads are never mutated, a successor is linked (CERT-046) superseded
cert_01j9smqa9g0h1j2k3m4n5p6q7r
supporter / entitlement · Quarry Lane Software sample 		tampered — the published token's payload was altered after signing (band changed); the signature no longer verifies, so the answer is INVALID regardless of the log invalid

What the verdicts mean

Every outcome this page can reach, and what each one asserts

Verdict What it means
VALID Signature verified here, hash present in the transparency log, status current.
WAS VALID Past its period. It attests what it attested then — expiry is not revocation and is not a defect.
REVOKED Withdrawn, with a date and a reason class. Revocation is prospective: the historical window shown stood while it stood.
SUPERSEDED Replaced by a later certificate, linked from the record.
UNVERIFIED The signature verifies but the hash is absent from the transparency log. Treat it as unverified regardless of how good the signature is — that is what the log is for.
INVALID The signature does not verify. Altered, or never issued.
TEST CERTIFICATE Signed with a sandbox key. Never a production credential, whatever it looks like.
CANNOT VALIDATE RIGHT NOW Something could not be fetched. Nothing is asserted in either direction — this is deliberately not the same answer as INVALID.

Verifying by hand

Nothing here depends on our code. The steps this page performs are the steps you can perform with a shell and any standard token library. Every document is published twice — as a same-origin static copy on this host, and on the edge API once it is live — and the two are byte-identical by construction:

  1. Fetch the status record from /artifacts/certs/{certId}.json (or /v1/verify/{certId} on the API host).
  2. Fetch the key set from /artifacts/jwks.json (or /jwks.json) and select the key by its kid.
  3. Verify the ES256 signature over the token's header.payload bytes.
  4. Take the SHA-256 of the compact token and look for it in the transparency log segment the record names, at /artifacts/ct/{n}.json (or /ct/{n}.json).

Key rotation history and the log's append-only guarantee are documented on keys and the transparency log.

verify only at purposesource.org/verify — any other address offering to verify our certificates is not ours.