EVACby Duress

Duress Evidence · Offline verifier

Verify a disclosure bundle

Everything runs in your browser. Nothing you drop here is uploaded anywhere.
Given a disclosure bundle from Duress Evidence, this page checks the recording against its manifest, the manifest against its signatures, and the whole record against the transparency log — without an account, without installing anything, and without trusting us. Once this page has loaded, it works with the network cable pulled out.

Or paste a receipt or bundle

Have a verification bundle or a commit receipt as text rather than files? Paste the .json here. A full bundle is checked exactly as if you had dropped it (the byte-level segment check is skipped, since the media isn't included, and says so). A lighter receipt — a manifest, or its leaf hash, plus the inclusion proof and the signed tree head — is checked for its place in the log. This runs entirely in your browser and fetches nothing: a receipt whose tree head signature it cannot check (because the receipt carries no keys) is capped at INCOMPLETE, never passed. An asset id on its own cannot be checked offline — download the bundle from the dashboard for that.

What this page checks

  1. Segment bytes. Each media segment is hashed with SHA-256 and compared to the hash the manifest recorded for it at capture. Run only when the media files are supplied.
  2. Merkle root. The segment hashes are combined into an RFC 6962 Merkle tree and the root is compared to the one sealed in the manifest — so segments cannot be reordered, dropped or substituted.
  3. Signatures. Each signature over the canonical manifest is checked against the bundled public keys, including that the signing key was in service at the time. Device capture signatures are recorded but not yet verified — device key attestation is a later phase, and this page says so rather than pretending.
  4. Log inclusion. An RFC 9162 inclusion proof places the manifest in the transparency log under the signed tree head, and the tree head's own signature is checked.
  5. Witnesses. Not yet — see below.

What it cannot check yet

Witness cosigning is NOT ESTABLISHED in v1. Independent witness cosignatures are what would prove there is one true log rather than a different one shown to each reader (the "split view" attack). Until the witness scheme is live, the best verdict this page will ever give is STRUCTURE VERIFIED (unwitnessed v1) — never a plain "verified". It proves append-only structure and valid signatures, not one-true-log.

The public keys used for signature checks arrive inside the bundle itself unless you obtained them independently. A bundle that is internally consistent is not the same thing as a bundle from us — cross-check the keys against an independent source before relying on a signature.

Some browsers cannot verify Ed25519 signatures yet. Where yours cannot, the affected check is marked "not checkable in this browser" — it is never silently passed.

Why it works offline

A verification step that phones home is a verification step the operator can watch, shape, or fail on purpose. This page contains everything it needs — the hashing, the tree maths, the signature checks — inlined, with no external requests of any kind. Save it to disk and it keeps working. That is not a convenience; it is the point.