Trust

The page is one file with everything inline, so you can read all of it. The decoder is a port of the app's; both must agree on the same published test vectors.

• source: github.com/davidemerson/hatband, the page under site/
• vectors: spec/vectors/cards.json
• signatures: a card carries an Ed25519 signature; the page checks it with your browser's WebCrypto and says whether it holds
• links: only https, http (marked), mailto and tel are ever tappable, and the host is printed beside each

Content-Security-Policy

Script and style are admitted by hash only; nothing may be fetched or posted.