How passport credential verification works
A passport credential is a signed statement, issued when a digital product passport is published, that says which product the passport describes, which version was published and what its content hash was. Verifying it tells you whether that statement is authentic and still current. It does not tell you whether the product complies with any law.
What is checked
- Structure and algorithm
- The token must be a well-formed JSON Web Token signed with EdDSA over Ed25519. Anything else is rejected before any key is looked up.
- Signing key and issuer
- The key named in the token must be one the platform published, and it must belong to the organization the credential names as its issuer. A valid signature from someone else's key does not pass.
- Signature
- The signature is verified against the published public key, so any change to the token's contents after signing is detected.
- Claims and validity window
- The credential must name an issuer, a subject and an identifier, and the current time must fall between its valid-from and valid-until dates.
- Revocation
- The issuer can revoke a credential. Credentials are also revoked automatically when a passport is recalled or archived, and superseded when a newer version is published.
- Integrity and freshness
- The content hash in the credential is compared with the passport as it is published now. If the issuer has published a newer version since, the credential is reported as out of date rather than as valid.
How to use it
- Open the verification link on a passport page, or paste a credential token above.
- Alternatively, enter a passport id to check that passport's newest credential.
- Read the list of checks: a credential is only reported as verified when every check passes.
What a verified result means
A verified credential shows that the named issuer published this passport content and has not withdrawn it. It is not a certificate of legal compliance, and it does not confirm that the declared facts are true; the issuer remains responsible for the accuracy of what it publishes. No account is needed.