How authentication works
What happens when you authenticate a document, and what each step is there to prevent.
Authenticating a document takes about as long as attaching it to an email. Underneath, five things happen, and each one exists to close off a specific way documents get faked.
1. Your document gets a fingerprint
The moment you choose a file, your browser calculates a fingerprint of it. A fingerprint is a short string of characters derived from the contents of the file, using SHA-256, a standard published by the US National Institute of Standards and Technology.
Two properties are what make it useful:
- The same file always produces the same fingerprint.
- Any change at all produces a completely different one. Not a similar one. A totally unrelated one. Editing a single digit, deleting a space, or re-saving the file is enough.
The fingerprint is calculated on your device. Audrie receives the fingerprint, your approval and any optional details you add, never your document's contents. Your document stays with you.
A fingerprint cannot be reversed. Nobody holding it can work out what your document said, or reconstruct any part of it. It is only useful for comparing against another file you already have.
2. You prove it is you
Before anything is authenticated in your name, you confirm it with a passkey. A passkey lives on your device and is unlocked the way you already unlock it, with a fingerprint reader, face unlock, or your device PIN.
This replaces passwords deliberately. A password can be guessed, reused, phished, or leaked in somebody else's breach. A passkey cannot: there is nothing to type, nothing to copy, and nothing useful for an attacker to steal from a server. Approving an authentication requires your physical device, in your hand, at that moment.
3. Your identity is already verified
Passkeys prove that the same person came back. They do not, on their own, prove who that person is. So Audrie verifies your identity separately, and a person can authenticate once that is complete.
Every certificate records how the identity was established, either verified independently through Audrie's identity provider, or attested by your employer. Anyone checking a document can see which.
An organisation can also authenticate documents it issues, through the API. Those records are attributed to the organisation, and every check shows that an organisation, not an individual, stands behind them. Whether a check shows the organisation's name depends on the tier, as disclosure tiers explains.
| A person | An organisation | |
|---|---|---|
| How | In the portal, approved with a passkey | Through the API, with your organisation's key |
| Identity | Verified before they can authenticate | Validated by Audrie before the organisation can authenticate |
| The record shows | The person | That an organisation signed |
| Best for | Documents where someone is accountable by name | Documents your organisation issues in volume |
See authenticate as your organisation.
4. Your document is signed
Audrie signs the record with a quantum-resistant signature, the NIST standard published in 2024 as FIPS 204. The signatures most of the internet uses today are expected to be breakable by future quantum computers. A deed or a company filing should still mean something in thirty years, so Audrie signs with a standard built to hold up.
If you are authenticating a PDF, you can also have a certificate page added to it. Your original content is preserved exactly, with the certificate added as a new page, so the file carries its own proof wherever it goes.
That page is different from a verification certificate, the separate record that shows somebody checked a document. Downloading a verification certificate needs an account, and both are free.
5. The record is committed to a public ledger
Finally, the record is committed to a public ledger run by a council of large international organisations, not by Audrie. Audrie has no control over it and cannot alter what has been committed.
The ledger assigns the entry a timestamp and a permanent position in sequence. Neither can be changed afterwards, by us or by anybody else. This normally settles within a few seconds, and until it does, a verification honestly reports the record as still settling rather than claiming more than it can prove.
This is the step that means you do not have to take Audrie's word for it. The entry is public, and anyone can inspect it without our involvement. See verifying a document.
Names never go on the ledger. The entry holds your document's fingerprint and what a verifier needs to check the record: no document content, no filename, and no name of a person or organisation. Records signed for an organisation, including by a person acting for it, use that organisation's own ledger address. That address is public, and the organisation's name is not written on the ledger, but anyone who looks the address up can tell which organisation it belongs to, and so the signer's employer.
The ledger entry is permanent. Whether a signer is still in good standing, or a record has been revoked, is checked by Audrie each time someone verifies, so the answer you get is current.
Next
- What you receive covers what you end up holding, and why there are two different kinds of proof.
- What Audrie never sees covers exactly what is and is not stored.