Verify a signature

Each nightly Monitor result is signed with our key and carries an RFC 3161 timestamp from FreeTSA, a public timestamping authority, checked against its root certificate before we store it. Public scan results are signed and carry our own time, not an independent timestamp. This page checks the signature. It needs no account, and nothing you drop or paste here is kept.

What you need

A night's JSON. Each night has two parts: the verdict, which is the run's own result, and the signature record, the much shorter file stored beside it. Drop them as one file holding both, or drop the two files from your exit pack's runs folder together. A public scan's result JSON can be dropped the same way.

A PDF cannot be checked here yet. The verification block on a report's last page names the night it was built from: drop that night's JSON instead.

The verdict and its record stay two separate documents. The signature is taken over the verdict, so a record folded into the verdict changes the very thing it commits to and could never check out.

What an answer means

A signature that holds proves the verdict is byte for byte the one that was sealed. It proves nothing about whether the measurement behind it was right, and this page makes no claim that it does.

A signature that does not hold is reported as exactly that. This page will not tell you which check failed: an explanation of why a forgery failed is an instruction for making a better one. It also takes no view on what a result means for you or for anyone else.