Tools

Stamp. Plot. Verify.

Files and location stay on this device. No account. Checking a stamp never touches the network.

Profile

Drop a file to stamp or tap to choose · hashed on this device · never uploaded

Phone witness

Link to an earlier stamp optional

A later stamp names an earlier content id inside the bytes it seals: source → harvest → mill → product. A matching parent shows the named bytes exist. It does not show the claim is true.

Open this page on a phone

Stamp from the device that was at the stump or the mill desk. Same page, no app to install.

…

This device's signing key

Every seal from this browser is signed by a key that never leaves it. Its hash is the record's device id; a reader's roster says whose it is.

Reading the key…

Draft a plot at the desk: draw the ring on the map, type corners, or paste GeoJSON. Stamp. Keep the file. At the plot? Use the farmer's page — it walks the corners in the farmer's language, with no prices. Two phones in a room: Phone sync. A witness on this tab signs bytes, not a place.

No points yet.

Name, area and who captured it

Plot name

Declared area (ha), optional

Plot kind pre-selected · change if wrong

Captured by pre-selected · change if wrong

Above 4 ha, Art. 9 asks for a polygon rather than a point. If the numbers say so, the gap is written into the file.

Type coordinates or paste GeoJSON

Latitude

Longitude

Or paste GeoJSON someone drafted. You still confirm it here.

Use an address instead applicable micro/small primary operator

The revised EUDR lets an applicable micro or small primary operator give a postal address instead of geolocation when it clearly identifies the plot. This page records your claim. It does not decide whether you qualify.

I am using the simplified primary-operator routeConfirm your role and deadline with your adviser or competent authority. Postal address or reference from an applicable official system

Download the picture

A picture of the declared geometry for your GIS. The picture is not evidence; the stamped file is.

Read a chain: every stamp with the file it sealed. This page pairs them by fingerprint, follows the parent citations inside the sealed bytes, and hands the batch to the evaluator under the policy you state below. Nothing leaves this device.

Drop every stamp and file from the chain many files at once, or several drops · the .cts stamps and the .json records they seal · hashed here, never uploaded

Add a record to this chain stage, seal, keep the pair

Stage a record for one of the codes a browser can mint, seal it, and keep the .cts with the .json. The new record joins this chain, so the map and the evaluation update. What it declares stays declared; the seal fixes the bytes and a time bracket. Every value that could name a person or a number someone could guess is committed, never written in clear; the opening stays in this browser's disclosures.

Record

Parents in this chain content ids this record will cite pre-selected · change if wrong

Pre-selected by the profile's parent rule. Only a sealed record has a content id to cite; hold Ctrl or ⌘ to pick several.

Where · latitude optional

Where · longitude optional

Device id this browser's signing key hash — written into the record and used to sign the seal

Reading the key…

Reader policy what this reader decides — never the artefact's

The evaluator asks what the reader holds and requires. Everything here stays in this browser (key osfp-reader-policy) and is digested into the evaluation so anyone can re-run the same lamp. Empty roster means no list is held: signer rows read ◔ not checked, never refuted.

Roster · enrolled devices one per line: key hash, optionally followed by the raw public key hex

Yield band · minimum %

Yield band · maximum %

Offline queue · days a capture may precede its seal

Loose fix · metres

Max bracket width · seconds S12 · S29 · S32 · S48

S12

S29

S32

S48

Disclosures this reader holds commitment → opening; made here or pasted from the party that committed

Add a disclosure paste the JSON a commit gave you: { "commitment", "disclosure": { "version", "tag", "salt", "fields" } }

Policy digest SHA-256 of the canonical policy; disclosures excluded so no salt travels

—

See a mill contradiction

Two output lots claim overlapping input from one sealed harvest. The arithmetic runs on this page; the verdict comes from the numbers, not from the button.

Sealed harvest input: 120 m³ oak · plot A

Output lot 1 claims: 80 m³

Output lot 2 claims: 70 m³

Combined outputs: 150 m³ · vs input: +30 m³

See it on a full SKU

Limits of the free page

Loading remaining stamp capacity for this network…

Stamping needs the network once: a public randomness beacon and two free timestamp authorities — and a qualified third where this deployment has contracted one — receive a fingerprint, never the file. Checking a stamp needs nothing. Files up to 8 MB, one at a time, and twelve stamps a day on this browser close their upper edge here.

Past that this page keeps stamping. The stamps come out one-sided: the envelope remains bound to a beacon round, without dating the original content, and only the closing edge is missing. A plan closes it — see the plans and your account.

Agents, ChatGPT and what is honest

Nobody should need ChatGPT in a forest. An agent or a GIS may draft GeoJSON; a person pastes it into the Plot task, sees the ring on the map, and stamps from the phone that was there. ChatGPT is not a GNSS source.

The account page provides API keys for the stamp endpoint. No MCP server is offered here today. GeoLibre is an export picture, not something this page loads.