Warden
Status unknown Integrate Run a live scan

Local record verification

Verify a Warden record

Check an APA attestation or WARDEN BREAKER certificate in this browser. The verifier uses canonical signed bytes and WebCrypto Ed25519; it does not accept an API's verified flag as proof.

Open verifier Inspect the log

Record input

Paste JSON, an attestation ID, or a supported same-origin URL.

UNKNOWN · no record checked

Remote lookup accepts a 32-character lowercase ID or this origin's attestation and badge URLs. Cross-origin URLs are rejected.

Maximum 256 KiB. The file is read locally and is not uploaded.

The sample is a signed cross-language fixture dated 14 July 2026, not a current endpoint claim.

Ready. No result is implied until the signed bytes are checked.

Pasted JSON stays on this page. Identifier lookups fetch only public issuer and record routes on this origin.

Verification result

Load a public record, use the dated sample, or paste your own material. The result separates signature validity, freshness, record status, and the limits of the claim.

How local verification works
  1. 01Parse

    Reject malformed or unsupported material.

  2. 02Resolve key

    Select the applicable current or recent key by signed time.

  3. 03Verify

    Check canonical bytes with WebCrypto Ed25519.

  4. 04Freshness

    Evaluate expiry and signed record status.

  5. 05Read boundary

    Separate what the record establishes from what it cannot.

Verification limits

What a valid signature does—and does not—prove

APA claim

A valid, fresh attestation proves that the host serving endpoint_host controlled the key pub when the issuer verified a live APA-conformant Protection Proof. The endpoint signed that proof, including its rolling 24-hour screened-payload count or an explicit unavailable state; the issuer separately signed the attestation. It does not prove that every request is routed through the guard or independently audit the endpoint owner's local counter state.

TOFU

First registration is trust-on-first-use: the issuer records the first valid endpoint key. An independently anchored log checkpoint makes later silent re-binding detectable; an unanchored chain cannot expose a complete rewrite or remove first-use trust.

Key theft

A stolen endpoint private key can produce valid endpoint proofs for the victim host. Revocation and key rotation can surface compromise; signature validity alone cannot rule out key theft.