Verify a consent receipt
A consent receipt is signed when the decision is recorded. Drop it here to see whether it is exactly as it was signed: if anything in it has been changed, even one character, this page says so and shows what.
or drop the file here. Nothing you paste is sent anywhere.
What this checks, and what it does not
- It checks in your browser. The receipt's contents are hashed and its signature is verified here, with the signing key's public half. The page does not ask a server whether the receipt is valid.
- It proves the receipt is unchanged since it was signed. It does not prove the consent was lawful, or that the person understood the notice; the receipt names the notice version they were shown.
- The key comes from this site. A receipt that checks out matches ConsentHub's key. To confirm that the key is really ConsentHub's, compare the fingerprint shown with one published by ConsentHub somewhere else.
Prefer to check offline? The same check runs from the command line with consenthub-verify --receipt receipt.json --pubkey key.pem, using a public key downloaded from /api/public/signing-keys.