<attestto-verify>

Client-side document verification. Drop a PDF and get hash, signatures, forensic audit results, and a trust level — all without leaving the browser.

Basic usage

HTML 
 <attestto-verify></attestto-verify>

That is a fully functional verifier. Every attribute below is optional.

Attributes

Attribute Type Default Description
hash string — Pre-computed SHA-256 hash to verify against. If provided, the component compares the file hash to this value.
allow-plugins boolean true Enable or disable the plugin system. Set to false to use only the built-in verification pipeline.
theme "light" | "dark" "light" Color scheme for the component. Can also be controlled with CSS custom properties.
root-ca string — URL to a custom root CA certificate bundle (PEM). Used to validate signer certificates against your own trust store.
All attributes 
 <attestto-verify
  hash="e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  allow-plugins="true"
  theme="dark"
  root-ca="https://example.com/ca-bundle.pem"
></attestto-verify>

What it does

When a user drops a PDF onto the component, the verification pipeline runs four stages:

1

Hash — Computes a SHA-256 hash of the entire file. If a hash attribute is set, compares the result and reports match/mismatch.

2

Signatures — Detects and verifies PAdES and PKCS#7 digital signatures. Extracts signer names, certificates, timestamps, and chain validity.

3

Forensic audit — Scans for JavaScript injection, OpenAction scripts, embedded executables, form actions pointing to external URLs, and encryption flags.

4

Plugins — If enabled, passes results through registered plugins (DID resolution, trust registries, blockchain anchors) to elevate the trust level.

Events

The component dispatches Custom Events that bubble and cross Shadow DOM boundaries:

Event Detail When
verification-started { fileName: string, fileSize: number } A file is dropped or selected and processing begins.
verification-complete { hash: string, signatures: Signature[], plugins: PluginResult[] } All verification stages have finished.

Listening for events

JavaScript 
 const verifier = document.querySelector('attestto-verify')

verifier.addEventListener('verification-started', (e) => {
  console.log('Processing:', e.detail.fileName)
  console.log('Size:', e.detail.fileSize, 'bytes')
})

verifier.addEventListener('verification-complete', (e) => {
  const { hash, signatures, plugins } = e.detail

  console.log('SHA-256:', hash)
  console.log('Signatures found:', signatures.length)

  // Check trust level
  const trusted = signatures.some(s => s.trustLevel === 'trusted')
  if (trusted) {
    console.log('Document is trusted')
  }

  // Send hash to your backend for recording
  fetch('/api/verify', {
    method: 'POST',
    body: JSON.stringify({ hash, signatureCount: signatures.length })
  })
})
🔒
Privacy note: Only the hash leaves the browser in the example above — and only because your code explicitly sends it. The component itself makes zero network requests.

See also