An answer is a claim.
When vrfy's verdict and your replay disagree on the same inputs, trust the replay. That's the point of making it reproducible.
vrfy / replay the verdict · example · not live yet
Don't trust us either.
Replay it.
Every vrfy answer names the receipt, the policy and the content hash it came from. Run the same checks yourself, offline, and you get the same answer, byte for byte. If you don't, your replay wins.
Generating keys…
example · not live yet · keys and hashes made in this tab
deterministic replay · run locally
Take the answer. Run it again.
Pick what vrfy told you. The page replays the four checks from the answer's own inputs, with real SHA-256 and Ed25519 in this tab, then compares its verdict to vrfy's line by line. Replay as often as you like; the hash never moves.
what vrfy told you
example · not live yet
real SHA-256 and Ed25519 in this tab · nothing sent
real SHA-256 and Ed25519 in this tab · nothing sent
the inputs the answer names
receipt you hold
…
policy
…
content you hold
…
| line | vrfy said | your replay | match |
|---|
NOT REPLAYED
Press Replay.
replays0
distinct hashes0
network requests0
network requests is read from this tab's own resource log, not typed in
what a replay needs
Three inputs. No vrfy.
A verdict is only useful if it can be reproduced. Everything a replay needs travels with the answer or is already in your hands.
01 · you hold itThe receipt
The signed object you were handed. The signature covers every field.
02 · the answer names itThe policy
The rule set the checks ran under, by version: vrfy.receipt/v3.
03 · you hold itThe content hash
SHA-256 of the bytes the answer was about. Hash your own copy and compare.
not neededvrfy, an account, a lookup
The replay runs where you are. No directory, no identity, nothing kept.
replay rules
The math, not the messenger.
What the replay on this page does, every time.
The hash never moves.
Same receipt, same policy, same bytes: the same verdict, down to its hash, on every run and every machine.
Check what it was about.
If the content hash in the answer isn't your file's, the answer says nothing about your file. Replay with your bytes.
to run the four checks on a damaged receipt, see break a receipt