How to confirm a product's authenticity without needing ProductAuth's website — for auditors, technically inclined customers, or as a continuity plan if this business ever changes hands or shuts down.
Every product's QR code encodes a URL containing a signed token — a standard JSON Web Token (JWT), signed with the RS256 algorithm (RSA + SHA-256). This is a widely documented, industry-standard cryptographic format, not something proprietary to us.
The token's payload contains the product's ID, name, batch, and an internal account reference. The signature proves that whoever created this token possessed the private signing key — which is never shared, never leaves secured infrastructure, and cannot be forged.
This key can verify any token ever issued by this platform. It is safe to share publicly — that is the entire point of public-key cryptography; only the private key (never published) can create new valid signatures, while the public key can only check them.
Once inscribed on the Dogecoin blockchain (planned), this key will also be retrievable independent of this website at all, via any Doginals explorer, permanently. [Inscription ID to be added here once completed.]
Take the token from a product's QR code — it's the part of the URL after ?p=. Using any standard JWT library (available in virtually every programming language), verify it against the public key above using the RS256 algorithm. For example, in Node.js:
const jwt = require("jsonwebtoken");
const decoded = jwt.verify(signedToken, publicKey, { algorithms: ["RS256"] });
console.log(decoded);
If verification succeeds, the token is authentic and the payload (product ID, name, batch) is exactly what was originally signed — this cannot be forged or altered without invalidating the signature. This check works whether or not ProductAuth's servers are online.
Independent verification confirms a code was genuinely issued by this platform and hasn't been tampered with. It does not tell you scan history, risk flags, or whether a specific product has been individually deactivated by its issuing brand — that information lives in our database, not in the token itself.
[This section is for you to fill in with an actual policy decision — for example, a commitment to maintain DNS/verification availability for a minimum period, or to publish the public key and this verification method permanently regardless of the business's future, so that already-issued codes remain checkable by anyone who needs to.]
Questions: hello@myproductauth.com