Public record · ledger verification

Check any consent receipt. Right here.

Every consent recorded on a Candor ledger produces a receipt — a self-contained cryptographic record designed so any third party can confirm it, forever, with no access to the system that issued it. Paste one below and your own browser performs the entire verification. Nothing you paste leaves this page.

Record 01

Verify a receipt

Accepts consent-receipt-v1 and the assurance-bound consent-receipt-v2.

What this receipt attests — decoded

This browser doesn't support Ed25519 in Web Crypto yet — try a current version of Chrome, Safari, or Firefox.

Record 02

What each check proves

Messages rebuild from the receipt's own fields
The signed strings inside the receipt must reconstruct, byte for byte, from the readable fields beside them. If they don't, the signature covers different content than the receipt displays — the classic forgery.
The nonce weld (v2)
An assurance-bound receipt carries two signed messages, and one single-use nonce must rebuild both. That welds the adult-verification to this exact consent: an attestation captured from one ceremony cannot be attached to another.
Consent signature
The authorizer's signature must verify under the key the receipt itself states — proving the keyholder signed exactly these fields at that moment.
Assurance signature under the published key (v2)
Anyone can sign an "attestation" with a key they invented. What matters is that it verifies under the key published on the verification keys page — the one prefilled above. A self-signed impostor attestation passes raw math and fails exactly here.

What VALID does and does not mean. VALID means these exact fields were signed by the holder of the stated authorizer key, and — for v2 — the adult-verification was performed by the published assurance service and is inseparably bound to this consent. It does not by itself identify who holds the authorizer key; that binding comes from the ceremony the receipt was created in and the platform records around it. Cryptography proves the record wasn't forged or altered; context proves who was holding the pen.

Receipts survive data withdrawal by design: when a family withdraws, the personal payload is deleted from the ledger while the receipt remains — so proof that verified consent existed outlives the data itself. A receipt verifying here after withdrawal is the system working as intended.