Conformance/CHECKER

Check a payload against the specs.

Paste an ATX credential, an AIP challenge-response transcript, a did:opena2a DID Document, an ATP trust proof or signed tree head, an AAP token (compact or JWS General), or an AAP grant reference. Structure is validated against the published JSON Schemas and signatures verify with real Ed25519 and ML-DSA-65 in your browser. Every failing check cites the clause it violates. Checks that need verifier state a browser cannot have — registration bindings, nonce ledgers, live revocation — say so instead of pretending.

Load an example

The suite examples are byte-exact fixtures from the conformance suites and carry their own verifier state (pinned clock, trusted issuers, keys) plus an expected verdict this page must reproduce.

Paste an ATX credential, AIP transcript, DID Document, ATP proof/STH, AAP token, or grant reference

Trusted issuer DIDs (optional, comma-separated)

Issuer / log Ed25519 public key (optional, hex)

Issuer ML-DSA-65 public key (optional, hex — needed to verify a hybrid credential’s post-quantum entry)

Everything runs in your browser — open the network tab: nothing you paste leaves this page.

What is real here

The structural layer validates against the same schema bytes the spec repositories publish (served at their $id URLs under /schemas/, hash-pinned and drift-gated in CI). The signature layer re-implements the pinned canonical forms — JCS (RFC 8785) over the ATX v1.1 TBS, the AIP five-field and ATP seven-field pipe strings, the STH raw-bytes rule — and the release gate replays byte-pinned conformance-suite fixtures through this page to prove the port agrees with the Go and Python reference verifiers. An ACCEPT here is still not a trust decision: trust needs your issuer set and your registration state.