@attestto/verify v0.1.0 · Apache 2.0

Verify & Sign

Web Components for document verification and DID signing. Drop them into any page — no framework, no backend, no API keys.

What is @attestto/verify?

@attestto/verify is a library of Web Components that give any web page the ability to verify PDF documents and sign them with decentralized identity wallets. The entire verification pipeline runs in the browser. Your documents are never uploaded, never transmitted, never logged.

🔒
Privacy guarantee: All verification and signing runs 100% client-side. No analytics, no tracking, no network requests. Your documents never leave the device.

Two components, one import

The library ships two Web Components:

Component Purpose
<attestto-verify> Drop a PDF → get hash, signatures, forensic audit, and trust level
<attestto-sign> Sign a document with any DID wallet → produces a Verifiable Credential

Both are standard Custom Elements. They work in plain HTML, React, Vue, Svelte, Angular, Astro — anywhere that renders HTML. Shadow DOM encapsulation means they will never conflict with your existing styles.

Trust levels

Every verified document is assigned a trust level based on what the component can confirm:

Detected
The file was hashed and parsed. No digital signatures found. Integrity can be tracked by hash alone.
Signed
At least one digital signature (PAdES or PKCS#7) was detected and its cryptographic integrity verified.
Trusted
The signer's certificate chains to a recognized root CA, or the signer's DID resolves to a known trust registry.
Qualified
The signature meets a legal framework's requirements (e.g., Costa Rica Firma Digital, eIDAS QES). Requires a trust plugin.

Architecture at a glance

The verification pipeline processes documents in four stages. Each stage can be extended with plugins.

Parser
Extract data from PDF
→
Crypto
Verify signatures
→
Trust
Resolve anchors & CAs
→
Verifier
Identity & trust level

Next steps