Check a Parmana record yourself

A Parmana record is only useful if you can check it without trusting Parmana. The verifier does that. It recomputes the record's hash and checks its Ed25519 signature, and its ML-DSA-65 signature where one is present, against keys you pin in a trust file. It makes no network calls.

Run a valid record

node bin/parmana-verify.mjs test/vectors/record-whole-record-v3.json test/vectors/trust-whole-record.json

Output, exit code 0:

{"valid":true,"coverage":"full","errors":[],"checks":{"trustRecordHash":true,"signature":true,"hybridSignatures":true}}

Run a changed record

node bin/parmana-verify.mjs test/vectors/record-tampered-amount.json test/vectors/trust.json

Output, exit code 1. The record was changed after it was signed, so the hash and signatures no longer match, and the verifier lists each failed check.

Before you use it on real records

• Requires Node.js 24 or later. ML-DSA-65 checks also need OpenSSL 3.5 or later.
• The files under test/vectors are test material. Use your own records and pin the keys you trust.
• Pinning a key means adding it, with its fingerprint and validity dates, to your trust file.

Source, installation and key-pinning instructions are in the verifier repository. For what a signed record does and does not prove, see the security review page.