Signet Check a document

Proof of origin for documents

Know who sent the invoice before you pay it.

A company publishes a key on their own web domain. Every invoice they send carries a signature over the account number and the amount. If either is changed afterwards, the signature stops matching, and anyone can see it.

Check a document See the proof

No invoice to hand? The check page gives you three: a genuine one, one doctored after signing, one from a lookalike domain. Each is signed the moment you ask, so the genuine one certifies for you too, not only for whoever tried it first.

Live against real invoices, real domains and public DNS. The signature check needs nothing but dig and openssl, without this site at all; reading the page needs the document, and it is not kept.

A freight invoice for 15,580 US dollars carrying a signature mark and a QR code.

Why this exists

Paying the wrong account is the most expensive mistake in business.

$3.05B
Lost to business email compromise in 2025, where an invoice arrives from a real supplier with the bank details changed.
$122k
Average loss per report. This is not a consumer scam. It lands inside a finance team that was doing its job.
86%
Of that money moves by wire or ACH, so by the time anyone notices, it has already gone.
71%
Of flagged fake receipts were machine generated by mid 2026. Fourteen months earlier the figure was zero.

Losses and averages from the FBI Internet Crime Complaint Center, 2025 annual report. Receipt figures from AppZen, twelve months to May 2026.

Every tool built for this looks at the document and guesses. The forger has a copy of that tool. Signet does not look at the document. It asks the sender.

Three steps

  1. The company publishes a key

    One record on the web domain they already own. Nobody else can put it there, and that is the whole basis of trust. No authority, no registry, no account.

    _signet.northpost.dev

  2. Their invoices carry a signature

    Over the account number, the amount and the reference. Printed on the page as a QR code, so it survives a photograph, a scan and a forward.

    amt · cur · iban · bic · id

  3. Anyone checks it

    Drop the document here and watch each check answer. Or run two commands yourself and never touch this site at all.

    dig · openssl

Two commands, and one changed digit

Running against a real invoice, with tools already on your machine. The second half is the part that matters.

The same invoice, three ways

All three were produced and checked by the running system. The second and third are what a fraudster actually sends.

The genuine invoice. Certified

Genuine

Sent by the company it says, and nothing on the page has moved since.

The same invoice with a different bank account printed on it. Flagged

Account swapped

Intercepted in transit and the bank details changed. Eighteen characters.

An invoice from a lookalike domain. Flagged

Nearly the right company

A real domain one hyphen away from the real one. Nothing is forged.

What changed in the second one

Signed
The pay-to block showing the real account number.
Printed
The same block showing a different account number.

What is actually running

Nothing here is a mockup.

7independent checks, each reporting its own answer and its own evidence
2separate public resolvers read the key, and they have to agree
0models involved in the verdict, which is the same function every time
471tests, run on every change, with no credentials needed

Built with

What a green stamp does not mean

  • Not that you owe it. A real company can send a real invoice for something you never ordered.
  • Not forever. Whoever controls the domain can sign as that company, so a hijacked domain signs too.
  • Not a substitute for reading it. Signet answers who sent this, not whether the charge is right.
  • Nothing at all, until the sender publishes a key. An invoice from a company that has not adopted this gets no verdict, because there is nothing to check it against.
Check a document