A Presence, Not a Cloak

Carry Your Passport

A VPN hides you from the sites you use. Your passport does the opposite: it tells a site that a person is here, with rights under the law, and proves it with a signature only your phone can make.

Signing and checking happen in your browser, with JavaScript on.

Carry

Sign Your Presence

Name the site. The first time, your phone makes your key and keeps it; then it signs what you say. The key cannot be copied out of this browser, even by us, and nothing you type is sent anywhere.

Check

Check a Passport

For a company, or for you. Paste a passport and this page checks the signature in your browser; give your site and your code to require that it was made for you, now. A check link carries the passport after the # sign, which browsers never send to a server, so it never reaches us.

What It Proves

It proves
That the holder of this key wrote these words, for this site, on this date, and that not a character has changed since.
Same key, same person
The key is the citizen’s lasting name online. A company that keeps it can tell that the next passport, letter or request comes from the same holder.
It does not prove
A legal name, or that a person rather than a program holds the key. The Proclamation makes citizenship verified humanity; that check is not built yet, and until it is, the name on a passport is the citizen’s word.
What we keep
Nothing. The key is made and kept in your browser, and signing and checking happen there. We run no server for it, see no traffic and log no passport.
If you lose it
Clearing this browser’s data deletes the key, and we cannot restore it, because we never had it. Make a new one; passports signed with the old key still check until they expire.

Why Not a VPN

A VPN sends everything you do through its operator’s machines, and the operator can see all of it. That is the broker the third article of the Proclamation forbids, and hiding people is the opposite of the second: enforcement, not concealment.

Your passport sends nothing through us. It is a presence: you, in your own name, with your rights in hand.

For Companies: the Format

A passport is a JSON Web Token signed as a JWS in compact form: three base64url parts joined by dots. Any library that supports ES256 can check it.

Header
alg is ES256, ECDSA on the P-256 curve with SHA-256. typ is oc-passport+jwt. jwk is the public key that checks the signature.
Claims
iss and sub are the key’s SHA-256 thumbprint: the passport is self-issued. aud is the host of the site it was made for. iat and exp are seconds since 1970, ninety days apart. under is the address of the Proclamation. name, place, law, cite and since are what the citizen chose to say; nonce is your challenge, if you gave one.
To check one
Verify the signature with the header’s jwk. Compute that key’s thumbprint and require it to equal sub. Require aud to be your own host, exp to be in the future and no more than ninety days after iat. If you gave a challenge, require nonce to match it. Then answer the citizen as the law requires.
Sources
RFC 7515 (JWS), RFC 7518 section 3.4 (ES256), RFC 7519 (JWT), RFC 7638 (thumbprints), the W3C Web Cryptography API and FIPS 186-5 (the curve).

Version one of the format, specified on 1 November 2026. A change will carry a new typ, never a silent one. Free, as citizenship is.