Verify a report

If you've been given a WebBorder report or piece of evidence (for example, as a forensic expert, insurer or lawyer), here you can check that WebBorder issued it and that not a single byte has changed since.

Everything is checked in your browser: the document isn't sent anywhere.

1. The document report.pdf or, for a piece of evidence, manifest.json (in Spanish packs, informe.pdf / manifiesto.json) 2. Its signature report.pdf.sig or manifest.sig, from the same pack Check

What is checked

• The signature. WebBorder signs every report and every piece of evidence with its private key (Ed25519). If the document changes, even by a space, the signature no longer matches. The public key used to check it is the one WebBorder publishes at webborder.es/app/api/firma; its fingerprint is ….
• The document's fingerprint (SHA-256). It appears below when you check; it must match the one in the pack's README.txt and, for evidence, the one recorded in the history.

And the time

The signature proves who issued the document and that it's intact. The time is also certified by a third party: the pack includes an RFC 3161 timestamp (.tsr) from an external authority. That is checked with OpenSSL, as the README.txt explains:

openssl ts -verify -data report.pdf -in report.pdf.tsr \
  -CAfile freetsa-cacert.pem -untrusted freetsa-tsa.crt

Without this browser

The same signature check, with OpenSSL 3 and the public key included in the pack:

openssl pkeyutl -verify -pubin -inkey webborder-public-key.pem \
  -rawin -in report.pdf -sigfile report.pdf.sig

Back to WebBorder · Legal notice · Privacy