1 · A fingerprint of the data. Every published version is run through SHA-256, producing the 64-character code above. Change one character anywhere in this passport and the code becomes completely different.

2 · A signature you can check. That fingerprint is placed inside a W3C Verifiable Credential and signed with our platform key. Press Verify and the signature is tested — if anything inside was altered after signing, it fails.

3 · A match. The fingerprint inside the signed credential is compared with the fingerprint of the data you are reading right now. Both must be identical.

4 · A date nobody can move. Steps 1–3 are all produced by us, so on their own they cannot rule out a passport being rewritten and re-signed later. So the fingerprint is also timestamped into the Bitcoin blockchain, through the free public OpenTimestamps calendars. Bitcoin blocks cannot be back-dated — not by us either. Only hashes go on the blockchain; no product, personal or commercial data ever does.

You don't have to trust us. The passport data is public JSON and the code above is a plain SHA-256 of it in canonical form — anyone can recompute it and compare. The Bitcoin proof is a standard OpenTimestamps file you can check with the reference `ots` client, which we have nothing to do with. JSONsigned credentialverify page

🇪🇺 Built to the EU registry's own proof format The EU's Digital Product Passport registry proves a record the same way this page does: a hash of the passport version, a trusted timestamp and a qualified electronic seal (Implementing Regulation (EU) 2026/1778, Article 9). At registration it also checks that the mandatory data is coherent and that a back-up copy is held by a DPP service provider (Article 8(7)). The hash above is that same per-version hash — so this passport carries the proof the registry asks for, in the form it asks for it.