Evidence verification

Verify an evidence package

Confirm that a Behavry evidence package is exactly what was signed, and that no event was altered, removed, or reordered. No account, no tenant access, no database.

Nothing you submit is stored. The package is verified in memory and discarded. It is never logged or forwarded.

The .zip exported from a Behavry APR.

Drop the .zip here, or choose a file

The issuing tenant's behavry-trust-anchor.json. Supplying it is what makes the result independent of Behavry. See why this matters.

What the result is worth

Verification is only as good as the key it checks against. There are three ways to supply one and they are not equally strong. Every report says which one it used.

You supply the tenant's trust anchor strongest
The package was signed by the key the tenant handed you out-of-band. Behavry is not in the loop.
The published registry convenience only
If you supply no anchor, we look the signing key up in our published registry. That confirms the package is internally consistent and signed by the named key, but the key came from Behavry. This is Behavry vouching for Behavry. If the result matters, get the anchor from the issuing tenant.

An evidence package does not contain the key needed to verify it. It carries only a truncated fingerprint, so you can confirm you are holding the right anchor.

Verify offline instead

The same checks, on your own machine, with no network and one dependency. This is the air-gapped path, and it is the one to use when the package is sensitive enough that you would rather not hand it to anyone at all. 

pipx install behavry-verify

behavry-verify --package apr-APR-2026-001942.zip \
               --trust-anchor behavry-trust-anchor.json

Exit codes are 0 verified, 1 not verified, 2 unusable input, so it drops straight into CI.