For a reader with no receipt yet

Start here

You bought a game, a film, an album or a book online. What you actually got is permission to use it, kept on the store's computers. If the store closes, or your account is shut, or a licensing deal expires, that permission can vanish — and with it the thing you paid for.

attest gives you one piece of that purchase to keep. When a store uses it, your download comes with a small extra file: a receipt, signed by the seller. "Signed" means the receipt carries a seal made with the seller's signing key. Anyone can detect a later change, and only someone holding that key can make a receipt pass the check — which is why a stolen or compromised signing key still matters. You don't have to understand how the seal works. You only have to keep the file.

What you can do with it

Keep it anywhere. On your disk, in a backup, on a USB stick. It doesn't live in an account, so no account can lose it for you.
Check it whenever you like. With a free tool, on your own computer, with the internet switched off, without asking the store. Try it on a sample receipt →
Prove what you bought years from now — even if the store no longer exists.

What it does not do

It is not the game, film or book. If you never downloaded the file and the store is gone, no receipt can bring it back. Download what you buy, and keep it next to the receipt.
It protects you from a store that disappears, not from one that is still open and turns on you. A live seller can declare one of its own signing keys compromised, and that cancels the receipts signed with that key. The standard describes a shield against this — a receipt publicly logged and anchored before the declaration — and the verifiers already honour it when they are shown one. But nothing makes such a receipt yet: no store logs or anchors what it signs, and the verifier on this site holds no anchor to check against. So for now there is nothing you can do about it.
It doesn't unlock anything and it doesn't remove copy protection.
Almost no store issues one yet. Stores that sell files without copy protection can start today. Closed platforms are a longer road: when you buy from them online, the law in the EU already makes them confirm the purchase on something you can keep — Article 8(7) of the Consumer Rights Directive (2011/83/EU, 25 October 2011) — and a receipt like this is one thing that confirmation could come with, not a replacement for it. If your store doesn't offer it, that is the thing to ask for.

Never send *.private.attest to anyone.

That file is the proof the purchase belongs to you: anyone holding it can claim to be the buyer.

Because one private file covers your whole library, handing it over hands over proof for every purchase inside at once, not just the one you meant to show.

A real store or support agent will never need it — they can already see your order.

Keep it private, the way you would keep a paper receipt with your card number on it.

Your receipt will arrive as two files. If anyone needs to see what you bought, send them the other one — the one whose name ends in .attest but not in .private.attest. It shows the same purchases and gives no one a way to claim them.

Already have a receipt in hand? What is this file? · Curious how the seal works? See the attest specification.