Verify
Verify a signed report
Paste or upload a signed RowAttest attestation report — or open a report's own link. The check runs entirely in your browser: the report is never uploaded, nothing is stored, and no account is needed.
Hosted report
Signed summary
Totals
Coverage statement
Have the full report? Drop its PDF or JSON here to check it matches this summary.
Paste a signed report to check it
What VALID and INVALID mean
VALID means: this report was produced by RowAttest's engine and has not been altered since it was signed. It does not mean the application is secure — read the report's coverage statement for what was and was not evaluated.
INVALID means the check did not pass. The result above names the check that failed: the file carries no signature block, it was signed by a key that is not RowAttest's, its content was changed after signing, or (for a v2 block) its report hash or verify link does not match the signed content.
Report links
A signed report carries a permanent link of the form rowattest.com/verify/<report-id>. Opening it loads what is published for that ID and verifies it here. For newer reports that is a signed public summary served from RowAttest's append-only store; the full report stays with the report's owner, and this page can check a copy of it against the summary. Older reports are published in full at /reports/<report-id>.json. Nothing published here is ever edited — a correction is a new report with a new ID.
RowAttest's signing keys
Every genuine report is signed with an Ed25519 key from the list below, and this page verifies against that list and nothing else. Rotation never removes a key, so a report signed before a rotation keeps verifying. A key would be removed only if it were ever compromised, and any removal would be announced on this page. Today the list holds one key.
- Algorithm
- Ed25519
- key_id
- 27499e4b
- Public key (base64)
- uxkQB8obyQW7s9G34caDDu+LzRa5bfFqbol0Iz9qr1U=
The same key is published at /.well-known/rowattest-signing-key. key_id is the first eight hex characters of SHA-256 of the raw public key. The matching secret keys never leave RW Digital Ventures LLC's signing machine and are never published.
How the check works
The page recomputes the report's RFC 8785 canonical bytes with the signature block removed — the exact bytes the engine signed — and verifies the Ed25519 signature over them, using your browser's WebCrypto and falling back to a vendored copy of tweetnacl. For a v2 block it also recomputes the report's SHA-256 and checks the verify link against the report ID. If a single byte changed, or the signature came from a different key, the check fails.