Duration: 3 minutes For whom: regulators · partners · auditors · anyone with a hash to verify Prerequisite: none (public page, no sign-in)
CyberPassport offers a public verification page that lets you confirm that a report hash indeed matches a seal recorded in the platform — without needing an account.
When to use this page?
- You receive a CyberPassport report (printed PDF, screenshot, email) and you want to verify that it is authentic before considering it in a decision (purchase, audit, certification, regulatory filing).
- You are a regulator (OFCS, BACS, supervisory authority) and you want to attest that an SME indeed provided you with the version it had at a given point in time.
- You are a business partner and you want to confirm that the report received from your supplier has not been modified since.
Step 1 — Retrieve the hash
The hash appears in 3 places:
In the printed report (PDF)
Block at the top of the report:
Sealed report · Self-hash · SHA-256 · 0x4a8b1f2e…
Sealed on 23 May 2026
Public verification: https://www.cyberpassport.ch/verify/4a8b1f2e…
📸 Screenshot location: sealing block in a PDF
The verification URL is printed in the clear — to type it, take the full hash (64 hexadecimal characters after 0x) or follow the link directly.
In the auditor interface
Badge at the top of the report:
✓ Sealed report · 0x4a8b…1f2e
Self-hash · sealed on 23 May 2026
📸 Screenshot location: sealing badge in /audit/{slug}
Clicking the badge opens the verification page in a new tab.
Communicated by the issuer
The organisation (or its auditor) may communicate the hash to you by email or phone. Expected format:
- 64 hexadecimal characters (0-9, a-f), lowercase
- Without the
0xprefix (or with it — it doesn't matter, you can remove it)
Step 2 — Open the verification page
Go to /verify/[hash], replacing [hash] with the 64 characters.
Example:
https://www.cyberpassport.ch/verify/4a8b1f2e9d3c7e8f2a1b6c5d4e3f2a1b6c5d4e3f2a1b6c5d4e3f2a1b6c5d4e3f
You can also simply click the link from the PDF or the badge.
Step 3 — Read the result
Case 1 — Valid and active hash ✅
Sealed report verified
SHA-256 hash : 4a8b1f2e9d3c…
Assurance level : Self-hash (SHA-256)
Sealed on : 23 May 2026 at 14:23
Status : ✓ Active — this hash matches the seal in force.
📸 Screenshot location: /verify page with green "Active" result
Conclusion: the report you are reading matches exactly what the organisation sealed on the indicated date. No modification since.
Case 2 — Valid but replaced hash ⚠️
Status : ⚠ Replaced by a more recent seal.
This hash attests the state of the report at its sealing date;
the report has since been modified and a new seal
has been issued.
Conclusion: the report in your possession is authentic (it was indeed produced by CyberPassport on the sealing date), but the organisation has published a more recent version since. If your decision depends on the most recent version, ask the organisation for its new hash.
⚠️ Important: a replaced hash remains verifiable indefinitely. This is by design: for historical audits ("here is the compliance state of this supplier as of 23 May 2026").
Case 3 — Unknown hash
No seal matches this hash in CyberPassport.
Check the character string or contact the report's issuer
to obtain the original hash.
📸 Screenshot location: /verify page with "Unknown hash" message
Possible conclusions:
- Typo (missing or extra character)
- The report is fraudulent (someone invented a hash)
- The report comes from another CyberPassport instance (rare in practice)
🟣 Tip: double-check carefully that you have exactly 64 hexadecimal characters. A typo is the most likely explanation.
Case 4 — Invalid format
If you type a hash that is too short, too long or contains non-hex characters (e.g. the letter z):
Invalid hash
A valid SHA-256 hash consists of 64 hexadecimal
characters (0-9, a-f).
Action: correct the entry.
Why it's useful — concrete examples
Example 1 — Regulator
I am the OFCS and I receive an SME's CyberPassport report as part of a grant application. How can I be sure the SME hasn't sent me a doctored report?
Answer: note the hash printed in the PDF, open /verify/{hash}. If the page confirms "Active" + a date consistent with what the SME declared → the report is authentic.
Example 2 — Large watchmaking group
I am the CISO of a large group. My supplier shared their CyberPassport report with me 6 months ago. I'd like to re-check that it was indeed valid at the time.
Answer: open /verify/{hash}. Even if the supplier has published 3 versions since, the original hash remains verifiable and attests the state at T-6 months.
Example 3 — Official Cyber-Safe auditor
Before carrying out my official Cyber-Safe audit, I reviewed the SME's preparatory self-assessment. How can I trace this version in my audit file?
Answer: note the hash, archive the PDF with the hash in its file name (e.g. acme_sa_2026-05-23_4a8b1f2e.pdf). Six months later, the official audit can reference this precise version.
About the "Self-hash" assurance level
The current assurance level in v0.9 is "Self-hash" — it is CyberPassport that computes and stores the hash, without an external trusted third party.
What it guarantees ✅
- The report's integrity: if a single comma changes, the hash changes.
- Priority on the CyberPassport side: if the hash exists in the database with a date, we know it was computed on that date.
What it does not (yet) guarantee ❌
- Legal enforceability: a court could theoretically contest CyberPassport's internal date.
- The signatory's identity: we know that organisation X sealed its report, but not that a specific individual signed it.
Roadmap (information)
- V1: adding a qualified timestamp from an external TSA authority (proof of date enforceable against a third party).
- V2: adding a qualified eIDAS signature of the auditor's conclusion (proof of identity).
These higher levels will be added to seal_kind (tsa_timestamped, eidas_qualified) without breaking existing Self-hash hashes.
Practical limits
- Verification is done online only (requires access to
cyberpassport.ch). - No public verification API in v0.9 — verification goes through the UI only. (API planned later.)
- The hash is a cryptographic digest of the report, not of the PDF. If you change the PDF's layout (but not the semantic content), the hash stays the same. Conversely, if you change the content (even 1 word), the hash changes radically.