MatrixAI signatures · in your browser
Check a signature
Drop the receipt, attestation or Living Report you were sent and this page checks, in your browser, whether the key it names signed it and whether anyone has touched it since. The file is not uploaded anywhere.
1. The file
2. The public key (optional)
If you leave it empty, the page uses the key the file itself carries. That only proves nobody touched the file after it was signed: it does not say who signed it, because anyone can sign with a key of their own and put it inside the file. To know who signed it, paste here the public key (or its fingerprint) that whoever sent you the file gave you through another channel, such as a message or a call.What a valid signature does NOT say
- It does not say the model is correct, that the data is good, or that the study was done well: it says the file is the one that was signed, not another.
- It does not say who the signer is. The fingerprint identifies a key, not a person: compare it with the one whoever sends you the file gives you through another channel. Without that comparison, the signature only says nobody touched the file after it was signed.
- The signer sets the time. There is no external timestamp: any date in the file is a claim by the signer.
- There is no revocation. If a key is lost or leaked, old signatures still come out valid, and there is no list to look it up in.
- A signature made on your own machine proves nothing to yourself: whoever holds the key can sign anything.
- The key’s fingerprint is the same on everything an installation signs, so it links those files together. The Studio lets you renew it.
- This page is a website. If someone compromised it, it could say “valid signature” every time. That is why the command-line check below exists, and it does not depend on this site.
What this page does with your file
It reads it in your browser and does all the arithmetic there. It makes no network request while checking: the file, the key you paste and the result are not uploaded. You can see it in the “Network” tab of your browser’s developer tools, which stays empty while you check.
This page stores nothing: not the file, not the key, not the result. Nothing is left when you close or reload it.
How it checks
A receipt or attestation is a DSSE envelope: the signed content is opened as it is (not rewritten) and the Ed25519 signature is checked over the type and the content together. It is tried with the key you paste, or with the one the file carries if you paste none.
A Living Report carries the signature of its fingerprint, which is the SHA-256 of the document as the browser reads it. This page recomputes that fingerprint with the same algorithm as the report itself and checks the signature against the recomputed one, never the one the file declares: whoever edits the file and recomputes the declared one leaves a signature that no longer fits.
Ed25519 is done by the browser itself (WebCrypto) when it has it; if not, by a JavaScript fallback (@noble/ed25519 3.2.0, MIT licence, no dependencies; that version is the rewrite of an earlier one audited in 2022 and has no independent audit of its own). If neither can, the answer is “could not be checked”, never a valid signature nor one that does not match.
If these calculations ever differed from Python’s, the parity tests would catch it: they generate truly signed files with MatrixAI’s code and demand the same verdict.
The same check, without this page
For a receipt or an attestation, the MatrixAI core ships the equivalent command. It needs the signing library (pip install 'matrixai[firma]') and the public key in a file:
matrixai receipt verify receipt.json --pubkey public-key.pem --locale en
matrixai receipt pubkey public-key.pemThe first checks the Ed25519 signature and says “valid signature”, “the signature does not match” or “could not be checked”; the second shows a key’s fingerprint so you can compare it.
There is no equivalent terminal command for the Living Report yet: today it can only be checked here.