Verify a Challenge Coin.
Drop the file. The math does the rest — on your device, with nothing uploaded, no account, and no trust in the people who made it. Including us.
What just happened?
A Challenge Coin isn’t a screenshot of a result. Inside the file are the raw findings themselves, the verdict, and a cryptographic seal that binds every number together.
Each finding is hashed into a leaf, the leaves chain into one root fingerprint, and a challenge–response transcript locks the whole set. Your browser just rebuilt all of it from scratch.
The page never trusts the grade written in the file. It re-derives the score from the raw findings and checks that it opens the sealed commitment. Change one number and it can’t.
The whole verdict is signed with ML-DSA-44, the NIST-standardized post-quantum signature (FIPS 204) — the same class of cryptography the U.S. government is migrating to.
Under the hood: a transparent, hash-based binding proof — a SHA-384 Merkle commitment over the finding set with a Fiat-Shamir transcript, salted range and count openings, and an ML-DSA-44 origin seal. No trusted setup, nothing to subscribe to; verification is a deterministic replay of the derivation, and it fails closed on any mismatch. It is not a zero-knowledge proof (a zk prover is a patent-pending research direction). This page runs the same checks as pqcat coin verify, kept byte-exact against the engine by golden test vectors. Details in the whitepaper.