Verifies in YOUR browser

Verify a Content Shield record

Check a Content Shield record entirely on your device: the canonicalization, the P-256 signature, and SSL.com's independent RFC 3161 timestamp, anchored to SSL.com's public root. Nothing about your record is sent to us or to anyone.

Prefer not to trust our domain? This page is one self-contained file with no backend. Clone the repo (or save this page) and open it locally: no server, no domain, nothing sent anywhere. Its entire logic is the un-minified verifier.js: same code, same result, audit it.

Verification file

Choose the verification file exported from the Content Shield app (the same data is embedded inside an evidence-package PDF).

Optional: the media file itself

Confirms the exact bytes match the record's asset_sha256.

Verify independently — paste the data

Paste a record's verification data to check it yourself, without relying on the exported file. This runs the exact same trustless checks; the raw data is shown here for anyone who wants to inspect or copy it.

Verification data (JSON)

What this does and doesn't prove

Runs on your device. All checks happen in your browser. No record data leaves this page. You can verify with your network off, or read this page's logic yourself.
Trustless. The only thing trusted is SSL.com's public timestamping root (already in your OS/browser trust store) which is bundled and fingerprint-pinned here. You do not have to trust Content Shield.
Identity is self-asserted. Any name or handle is a claim by the creator, dated and signed, not independently verified by us.
Provenance, not anti-copying. A verified record proves who declared what, and when. It does not prevent copying, scraping, or AI training, and declarations are statements of intent, not enforcement.
Prefer the command line? The offline verifier (Python CLI) makes the same checks with zero browser involved. Both are in this repo. The repo is the source and the host.
Run this browser's self-test → (real record must verify, tampered record must be rejected, in your browser).