Verify a receipt
Questi contenuti non sono ancora disponibili nella tua lingua.
Paste a signed receipt envelope and the issuing instance’s public key, and this page checks the signature entirely in your browser. It makes no network requests of any kind: nothing you paste leaves this page, there is no upload, no lookup service, and no Mildport endpoint in the loop. Verification and license checks never phone home — that is the protocol’s standing posture, and you can confirm it here with your browser’s network inspector open.
The same check is available as an MIT command-line tool —
mildport-verify-receipt — whose repository also
carries an example envelope and key
you can try here. The scheme itself is specified on the
receipt spec page.
The verdict appears here. Nothing happens until you press Verify; nothing leaves the page either way.
What this page checks
Section titled “What this page checks”The same four steps as the CLI, specified normatively here:
the envelope shape and receipt version, the RFC 7797 protected-header discipline, the ES256
signature over the recomputed canonical JSON (a single flipped byte anywhere fails), and the
keyId/kid agreement. A valid verdict proves the receipt is byte-for-byte the document
the key holder signed — binding that key to an operator is between you and them.
ECDSA P-256 is supported by every browser’s WebCrypto. Envelopes whose header says
alg: EdDSA predate the 2026-08-09 algorithm unification and verify with the
spec repository’s tagged v0.1.x CLI; the
current CLI performs the identical ES256 check
on any Node.js 20+.