A receipt you keep
The seller signs a receipt once, at checkout. You keep the file. Anyone can verify it afterwards — offline, unchanged, with no surviving service of any kind.
.attest bundle here
or a bare .attest.json receipt — click to pick a file
No receipt handy? — then break it, and watch this page notice. Or download it and open it anywhere, later, offline.
Checking against the issuer’s own evidence? Drop
revocation-view.json, transfer-view.json,
compromise-view.json or revocation-evidence.json on the same
area — they stay loaded while you check receipt after receipt.
Disclosing the salt is replayable: whoever you show it to can replay it, so disclose only to parties you would show the receipt to anyway (spec §8.1). This page stores nothing.
Each button alters this receipt for real and runs the same check again. The first ones turn a single byte of the file — one letter, one character — and say which byte, at which offset. The last leaves the file untouched and hides the seller’s published keys instead, which is a different failure and reads differently below.
An account is a promise a company keeps for as long as it exists. A signed receipt is arithmetic: it does not need the seller to be alive, reachable, solvent, or willing. Anyone holding the file and the seller’s published key can settle exactly what the seller signed and on what terms. Supplying the identifier and salt can additionally prove possession of the binding secret the issuer recorded; it cannot settle who made the purchase. Those checks still work a decade from now, on a laptop with no network.
It works today wherever files are sold without DRM, and it is built so a regulator could point closed platforms at it: a format the purchase confirmation the law already requires could travel in — one a machine can check and you can carry away.
Once, at checkout, with keys it has published. It never has to do anything again.
Disk, cloud, a USB stick in a drawer. No account has to stay alive.
This page, a command-line tool, a marketplace. The store can disappear; the arithmetic does not.
attest issue --log-dir now logs a receipt as it is issued — but this deployment pins no anchor, so for a receipt you hold today the declaration is still final. The rescue itself is not a promise on paper — it is replayed below, in this tab.Skeptical? Good — read the FAQ, it answers the questions a reasonable person asks.
A signing key gets stolen, and the seller publishes that fact: from now on, treat everything signed with that key as worthless. What happens to the receipt you already hold? Answering that from good intentions is not possible — somebody has to be able to show which came first, and neither party can be trusted to say.
The two receipts below are the same file, byte for byte, signed by the same stolen key, against the same declaration of theft. The only thing that differs is what the public log says about when each was published. One survives. One does not (spec v0.2 §19).
They are two of the project’s own conformance vectors, compiled into this page and replayed in your browser when you press the button — against the vectors’ own pinned log keys and pinned block headers, not this site’s. That distinction is not decoration: this site’s log has no anchor attached to any checkpoint yet, so the rail being shown here cannot be reached with the material this deployment holds. Each run is then compared, field by field, with the result the corpus demands of any conforming implementation, and the comparison is shown whichever way it comes out.
The line above the dropzone — nothing is uploaded, this page cannot reach any other host — is the kind of claim a page should not expect to be taken on trust. So press the button and the page will try to fetch the seller’s key material from the seller’s own domain, and report what the browser did about it. If the request goes through, the page says that instead.
This is evidence, not proof: the page is reporting on itself. The proof is the policy your browser is enforcing — read it in the page source, or watch the request fail in your browser’s network panel.
Where this honestly stands
No store issues attest receipts yet, and no regulator mandates them. The standard, two independent implementations and the conformance suite are done and free to use. What is missing is the first seller who signs.