Independent Verification
Everything below runs in your browser with the WebCrypto API — nothing is sent to the server. Paste values from any challenge's public record (or fetch them from the NIST and drand APIs yourself) and recompute every claim PHASE makes.
A matching hash proves that words and a secret reproduce a commitment. It does not prove when that commitment was made. Official PHASE verification additionally requires a public receipt timestamped before the challenge deadline; local predictions have no such attestation.
1 · Recompute a Future Phrase
master = SHA-256( nist | drand | local ) — lowercase hex strings joined with “|”, hashed as UTF-8. The phrase is the first 132 bits of the master value, read as twelve 11-bit indices into the 2,048-word dictionary.
2 · Verify a commitment
V1: SHA-256( PHASE-COMMIT-V1 | phrase | secret ). Legacy V0: SHA-256( phrase | secret ). The phrase is the 12 lowercase words joined by single spaces. A match proves the revealed prediction is the one committed before generation time.
Fetch the beacons yourself
NIST pulse for time T: https://beacon.nist.gov/beacon/2.0/pulse/time/next/<T-1 ms>
drand (quicknet) round: https://api.drand.sh/52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971/public/<round>
PHASE uses the first NIST pulse and the first drand round at or after each challenge's scheduled time. Both histories are immutable and signed by their operators.