Check a receipt

Paste the JSON and the hash does the rest

The check runs in your browser and needs JavaScript. Without it, the same check is two commands: sort the body's keys and strip the whitespace, then compare its SHA-256 with the receipt's name.

What the check does

Your browser writes the receipt's body as canonical JSON (keys sorted at every level, no whitespace) and computes its SHA-256. If one character of the body changed after the receipt was written, that hash no longer matches the receipt's name. It then fetches the public key from /.well-known/receipt-key.json and checks the Ed25519 signature over the same bytes. The receipt itself stays in this tab.