Verify it yourself

The claim this product makes is that you do not have to trust us. This page is how you test that claim rather than accept it.

Get a receipt we did not hand you directly

Open /verify and let the page seal a record in your browser, then download it. The cryptography runs on your machine — the receipt is produced locally, not fetched.

Check it on a machine with no network

npm install -g cool-nwc

# disconnect, then:
cool verify ./change-receipt.json --offline

The verifier makes no network calls. On the website that claim is measured rather than asserted: for the duration of a verify run the page replaces fetch, XMLHttpRequest.open, WebSocket, EventSource and sendBeacon with counting wrappers and then prints the counter. The zero you see is a measurement.

Now make it fail

A verifier that only ever says yes has told you nothing. Try each of these.

# 1. Edit one byte of the record body, then:
cool verify ./tampered.json
#    binding and signature both fail

# 2. Demand a hardware root:
cool verify ./change-receipt.json --require-hardware
#    REFUSED: attestation is simulated

The second one is the important one. --require-hardware is a real option, and a receipt without a vendor-rooted quote is rejected outright however many other domains pass.

Check the implementation against the spec

The browser build of the SDK differs from upstream in exactly one file — codec.ts, whose hex and base64 helpers were rewritten off Node's Buffer onto btoa/atob. That deviation is proven byte-transparent rather than asserted:

npm run verify:sdk

It mints a receipt, tampers with it, confirms rejection on both domains, then verifies the published cool-spec conformance vectors — produced by the upstream Node implementation — under the browser-safe code, and confirms every tampered vector is rejected.