TruthKit

Don't trust us. Check it yourself.

Every TruthKit report is signed. This page checks the signature here in your browser, with the same maths anyone can write. Your report is never sent anywhere.

Drop a report JSON here

Each step, as it happens

  1. Read the report as JSON

  2. Find the signature block

  3. Get the public key

  4. Put the payload in canonical form (RFC 8785)

  5. Verify the Ed25519 signature

Is this the same file?

Drop the original file to compare its fingerprint with the report. It is hashed here, and nothing is uploaded.

Drop the original file here

Use your own copy of the key

If you would rather not rely on the engine's key file, paste the public key from a source you trust.

Keys are published at https://aadam-2012legend--truthkit-engine-web.us-east.modal.run/.well-known/truthkit-keys.json

Works offline

Once the key has been fetched, it is saved in this browser. Load this page, disconnect from the internet, and the check still runs: that is how you know nothing is being sent to us.

What a valid signature means

  • TruthKit's key signed exactly this report, and nothing in it has changed since.
  • The fingerprint inside it belongs to the file that was checked. Hash your file to confirm it is the same one.
  • The findings, numbers and any user adjustments are the ones recorded at the time.

What it does not mean

  • It does not mean the file is what it claims to be. A report can validly say Contradicted or Inconclusive.
  • It does not mean the measurements are beyond dispute. It only shows what was measured and that the record is unchanged.
  • It does not vouch for the claim's place and time, which were given by whoever ran the check.

Do it without this page

Take the payload, write it in RFC 8785 canonical JSON as UTF-8, and verify the base64url signature against the Ed25519 key whose id matches. The key id is the first 16 hex characters of the SHA-256 of the raw key.