Check a record yourself.
Paste a receipt, a record ID or a sealed export. The check runs in this browser with the same rules as the offline verifier, against the key the tenant published. Nothing you paste or open is sent anywhere.
Exactly this, and no more.
A receipt passes when its own hash recomputes and a sealed export the tenant signed carries the very same receipt. A sealed export passes when its hash and signature check, the signature is by the key that tenant published, and every reading, batch, receipt, ledger entry and state row inside it recomputes.
The full boundary — the twelve checks and the eight things a pass never proves — is on What verified means.
It does not prove a value is physically true, that a sensor was calibrated or a source was honest — only that what arrived has not changed since.
It does not prove a human approved anything, or that an export is complete. An export declares its scope; this checks the declaration is present and consistent.
Three checks run only in the offline verifier: horizon certificates, the re-check of every grant from the ledger, and a witnessed tree head. The chain is tamper-evident under controlled administrative access — not tamper-proof.
The same checks, plus the three the browser cannot run — on your own machine.
The offline verifier is one file, ua-verify.mjs, released as ua-verify-1.2.0.tar.gz. It needs Node.js 26 and nothing else, opens no network connection, and prints one report with one exit code: 0 pass, 1 fail, 2 nothing verified (the file could not be read).
Check the archive before you open it
The value printed must equal the SHA-256 published above, character for character.
shasum -a 256 ua-verify-1.2.0.tar.gz # macOS sha256sum ua-verify-1.2.0.tar.gz # Linux certutil -hashfile ua-verify-1.2.0.tar.gz SHA256 # Windows
Check every file inside, then run it
tar -xzf ua-verify-1.2.0.tar.gz cd ua-verify-1.2.0 shasum -a 256 -c SHA256SUMS # every line must say OK node ua-verify.mjs capsule.json # the sealed export the utility handed you
What a pass does and does not prove is on What verified means; the verifier prints the same list in every report as notProven.
| Tenant | Signing key fingerprint |
|---|---|
| Demo Utility — UAE DEMO | ed25519:895bd1f61bb3f880urn:ua:tenant:t-a7e0c2 |
| Demo Utility — Oman DEMO | ed25519:dfb42d14cd9e6527urn:ua:tenant:t-5b19d4 |
| Demo Utility — Qatar DEMO | ed25519:8e60b1e0557714f8urn:ua:tenant:t-c38f61 |
A real tenant appears here with its public key only. Its sealed exports stay in its own country; you receive one from the utility and open it above — it is checked in your browser and never uploaded. /data/tenants.json