Radix Seal, the self-custody trust standard

Sign, encrypt and communicate. Without trusting anyone's servers.

Radix Seal turns the Radix Wallet into your institution's own certificate authority. Everything happens in the browser and proofs are anchored on a public ledger that anyone can verify independently, forever.

RADIX SEAL

The Radix Seal: an open on-ledger standard. Each user self-mints a soulbound seal NFT that acts as the insignia of their attestation collection: the on-chain equivalent of an institutional stamp, held in self-custody.

Your wallet works like a security key (passkey): you prove your identity by signing a challenge, without ever exposing the key.

0
Servers that ever store your files, messages or keys
100%
Of the cryptography runs client-side, in your browser
3
Tools under one trust model: sign, encrypt and chat
1
Wallet signature is all it takes to prove control of an account
The toolset

Three tools,
one trust model

Every Radix Seal tool follows the same rule: your wallet proves identity, your browser does the cryptography, and no intermediary ever holds content or keys. Available today in the Radix console.

Sign documents

Sign any file with your Radix Wallet. The document is hashed locally and never uploaded: only the hash is signed, proving integrity, timestamp and control of the account key.

  • Attached certificate or embedded directly inside the PDF
  • Optional on-ledger anchoring as a soulbound NFT
  • Multi-party signing: several signers on one certificate
  • Identity disclosure you control: name, email or signature only
  • Anyone can verify, no wallet or account needed
Open the signing tool

Encrypt files

The encryption key is derived from your wallet signature via ROLA: only the account that encrypted a file can ever unlock it. Files are processed in chunks, entirely in the browser.

  • No file size limit: chunked, never uploaded
  • Key derived from your wallet: nothing to store or lose
  • Direct browser-to-browser transfer, end-to-end encrypted
  • Receiver decrypts only when the owner approves and signs
Open the encryption tool

Secure chat

End-to-end encrypted conversations where both sides prove who they are by signing with their wallet. The session key is derived from that verified exchange: no server can read, alter or impersonate anything.

  • Both participants wallet-verified before the room opens
  • Messages travel peer-to-peer over an encrypted channel
  • Each invitation link works for a single conversation
  • Identity checks verified locally, in each browser
  • Encrypted file sending with no size limit over the same channel
  • Nothing leaves your browser: messages vanish when the page closes and the local copy of received files is deleted after 24 hours
Open the secure chat
The trust model

Your wallet is the
certificate authority

Traditional trust infrastructure asks you to delegate: to a SaaS vendor, to a certificate authority, to a key server. Radix Seal inverts the model: the keys stay in your wallet, the computation stays on your device, and the only shared dependency is a public, decentralized ledger.

Step 1

Self-custody keys

Identity is proven with ROLA: the wallet signs a challenge, never revealing the key. The same key management your institution already uses for assets now backs signatures, encryption and messaging.

Step 2

Local cryptography

Hashing, encryption, decryption and verification all run in the browser. Documents, messages and plaintext never leave the device: there is no upload step to secure, audit or breach.

Step 3

Peer-to-peer transport

When content must move between parties (an encrypted file, a chat message) it travels over a direct, end-to-end encrypted channel between browsers. No intermediary storage, no server in the data path.

Step 4

Public, permanent proof

Optionally, a document hash is anchored on the Radix ledger as a soulbound NFT. The proof is timestamped by consensus, immutable, and verifiable by anyone without a Radix account.

An open on-ledger standard, not a product

Radix Seal is defined by public metadata conventions on the Radix ledger. Any wallet, explorer or third-party tool can implement it: discover a signer's attestation collection, check its insignia and verify its certificates, with no permission from us and no proprietary format in the way.

  • Soulbound insignia
    Each user self-mints a non-transferable seal NFT: it cannot be bought, sold or stolen. Each account mints its own by signing with its wallet, so holding the seal proves you control that account, and only you can use it.
  • Attestation collections
    Signatures and invitations live in per-user collections whose owner and minter is the user's own seal: a chain of custody readable on-ledger.
  • Only hashes on-chain
    The ledger stores document hashes, never documents, names or messages. Public verifiability without publishing anything confidential.
Anatomy of the seal

How the seal,
the collection and its NFTs work

The whole Radix Seal model rests on two base NFTs you mint once, plus five NFT types kept inside your collection. Here is what each one is, who mints it and what it proves, made clear without jargon.

The two base NFTs (one time only)

Your insignia

Seal NFT

It is your signer identity and the only key able to mint into your collection. You get it once from the official Radix Seal resource.

  • Soulbound: cannot be sold, moved or burned
  • Only you control it, bound to your account
  • Without it, nobody (not even this site) can create anything in your name
Your on-ledger archive

Signing collection

Your personal, reusable resource where every NFT you issue or sign is stored, numbered. Its owner rule is locked and requires your Seal.

  • Reusable: each document adds a numbered NFT (#1, #2, #3...)
  • Rules locked at creation: data unalterable forever
  • Only your Seal can mint into it, so nobody else can create signatures or invitations in your name

The five NFT types inside the collection

They all share the same unforgeable chain of custody: they live in a collection owned by your soulbound Seal, in your account. That is why nobody can forge them in your name.

Signature invitation

kind: invite

Deposited into each signer's wallet. It carries the document hash and the invited account. It is a notice, not a signature; the issuer can recall it after a mistake, but can never touch a signature.

Minted by whoever requests signatures, one per signer
Public record of who was asked to sign that document

Signature

kind: signature

This is the record that truly counts as a signature: non-transferable, data locked. Impossible to forge because only the signer's Seal can mint into their collection.

Minted by each signer into their own collection
The account signed that specific document

Encryption signature

kind: cipher-signature

Only in ROLA + Ledger mode. Always minted, with or without receivers: a public, permanent record in the encryptor's collection that this account encrypted the file, the encryption counterpart of a document signature.

Minted by whoever encrypts, into their own collection
The account encrypted that specific file

Encryption invitation

kind: cipher-invite

Only in ROLA + Ledger mode. Deposited into the receiver's wallet, carrying the encrypted file's hash. Without this invitation, an account cannot even request the key from the sender.

Minted by whoever encrypts, one per authorized receiver
The account is allowed to request decryption

Decryption receipt

kind: cipher-receipt

Optional, in ROLA + Ledger mode. A public, permanent record in the receiver's collection that they obtained the key, verifiable by the sender on the ledger.

Minted by the receiver after obtaining the key
The account decrypted the file

All of this is public and permanent on the Radix Network. Anyone can read and verify it without depending on this site, with no account and no proprietary formats.

Encryption

Encryption that never
trusts a server

Radix Seal locks a file to your account with a key derived from your wallet, encrypts it in your browser and shares it peer-to-peer. No server ever holds your file or your key. Here is how it works, why it fits institutions, and how it improves on current methods.

How it works

1. Key from your wallet

The AES-256 key is derived from a deterministic ROLA signature over a per-file challenge, so only the account that encrypted the file can re-derive it. Nothing is stored: no password, no key file.

2. Encrypted in your browser

The file is encrypted chunk by chunk with AES-256-GCM, entirely on your device. There is no size limit, and not a single byte ever reaches a server.

3. Shared peer-to-peer

When you share it, the file travels over a direct, end-to-end encrypted channel between browsers. The receiver opens a link and it transfers browser to browser.

4. On-ledger access record

With ROLA + Ledger, the encryptor mints a signature marking that this account encrypted the file, plus one invitation per authorized receiver, so who may decrypt is a public, verifiable record.

Why it matters for institutions

Data sovereignty

Documents and keys never touch a third-party server: no data processor holding your content, no cross-border transfer to assess, and no vendor breach that can expose your files.

No key-management burden

The key is re-derivable from the wallet your organization already controls, so there is nothing to store, rotate, escrow or lose, and no key server to secure.

Auditable access

With ROLA + Ledger, who was authorized and who decrypted is recorded on a public ledger, verifiable years later with no vendor account and no API that may have been retired.

How it improves on current methods

No keys to share or leak

The key is derived from your wallet and never leaves it. You never send passwords or key files over any channel, so there is no key leak, and the file itself never leaves your device, so there is no information leak either.

Only the encryptor can release it

Only the account that encrypted the file can re-derive the key. Nobody else, not even this site, can decrypt it without that account's explicit approval, signed with its wallet.

Free to use

Encrypting, sharing and decrypting are free. Today's tools are usually paid, with a license or a per-user or per-file subscription. Here the only possible cost is a fraction of a cent in network fees, and only if you choose the ledger record.

The ledger, only if you want a record

Everything works locally and peer-to-peer without touching the chain. You only interact with the ledger if you want a public, verifiable record of who encrypted the file and who may decrypt it.

Privacy by design

Your document never leaves
your browser

All the cryptographic work happens on your device. The only thing that touches the network is the bare minimum anyone needs to verify: the document hash and the signing accounts.

Local hashing

The document is digested with Blake2b-256 in your browser, and signing means signing that hash. The content is never transmitted to any server.

Direct browser-to-browser channel

When the file must reach another signer, it travels browser to browser over an end-to-end encrypted channel. No cloud in between.

Identity under your control

Name or email are only included if you decide so, and they live in the certificate, not on the ledger. The chain holds only hashes and accounts.

No accounts, no sign-up

No registration, email or password. Your wallet is your identity and the only key able to mint into your collection.

For institutions

Built for organizations that
answer to auditors

Banks, public administrations, law firms and healthcare providers share the same three problems: prove who signed what and when, keep confidential data confidential, and avoid betting their evidence on a vendor's survival. Radix Seal addresses all three by design.

Audit trail by consensus

An anchored signature is timestamped by the network's consensus, not by a vendor's clock. Years later, an auditor or regulator verifies it against the public ledger directly, with no vendor account, no API contract and no certificate chain that may have expired in the meantime.

Data sovereignty by architecture

Documents, messages and encryption keys never touch a third-party server, so there is no data processor holding your content, no cross-border transfer to assess, and no vendor breach that can expose your files. What never leaves the building cannot leak from someone else's cloud.

No vendor lock-in

Radix Seal is an open standard over a public ledger with open-source tooling. Certificates are plain JSON, proofs are ordinary ledger entries, and verification needs no proprietary software. If this website disappeared tomorrow, every proof would remain verifiable.

Procurement-friendly economics

No per-envelope licensing, no per-seat subscription, no infrastructure to deploy or maintain. Signing and verifying are free; anchoring a proof on-ledger costs a fraction of a cent in network fees. The trust budget goes to zero, not to a line item.

100%
Of verification possible without any vendor account or API
<$0.01
Network fee to anchor a proof on-ledger, no subscriptions
24/7
Public ledger availability: proofs outlive any vendor
0
Confidential bytes published: only hashes reach the ledger
Head to head

How Radix Seal compares to
today's most trusted techniques

Cloud e-signature suites, PKI with qualified certificates and PGP are today's benchmarks for signing and encrypting. Each one delegates something (custody, confidentiality or longevity) that Radix Seal keeps in your hands.

Keys & custody

Who holds the keys

Cloud e-signature / storage SaaS
The vendor: signatures are applied on their servers
PKI / qualified certificates
Smartcard or HSM, issued and revocable by a CA
PGP / S-MIME
Local keyring, entirely user-managed
Radix Seal
Your wallet: self-custody, no issuer above you

Trust anchor

Cloud e-signature / storage SaaS
The vendor's goodwill, uptime and security
PKI / qualified certificates
Hierarchical CAs, single points of failure
PGP / S-MIME
Web of trust, hard to scale beyond experts
Radix Seal
A public, decentralized ledger

Confidentiality

Where your document goes

Cloud e-signature / storage SaaS
Uploaded to the vendor's cloud to be signed
PKI / qualified certificates
Often uploaded to portals in signing workflows
PGP / S-MIME
Stays local, but usually sent by email
Radix Seal
Never leaves the browser: only the hash is signed

Transfer between parties

Cloud e-signature / storage SaaS
Through the vendor's servers and storage
PKI / qualified certificates
Email attachments or shared drives
PGP / S-MIME
Email attachments, metadata exposed
Radix Seal
Direct browser-to-browser, end-to-end encrypted

Verification & audit

Independent verification

Cloud e-signature / storage SaaS
Requires the vendor's portal or API to exist
PKI / qualified certificates
Requires CA chain plus CRL/OCSP status checks
PGP / S-MIME
Requires key servers and fingerprint checks
Radix Seal
Anyone with the file and the public ledger, no account

Timestamp integrity

Cloud e-signature / storage SaaS
Attested by the vendor's own clock
PKI / qualified certificates
Paid timestamping authority (RFC 3161)
PGP / S-MIME
None by default, self-declared
Radix Seal
Fixed by network consensus, immutable

Longevity & cost

Proof lifetime

Cloud e-signature / storage SaaS
As long as the vendor exists and keeps records
PKI / qualified certificates
Until certificate expiry or CA revocation
PGP / S-MIME
As long as keys are safely kept
Radix Seal
As long as the public ledger exists

Cost model

Cloud e-signature / storage SaaS
Per-envelope pricing and per-seat subscriptions
PKI / qualified certificates
Certificate issuance, renewals and tokens
PGP / S-MIME
Free software, high operational complexity
Radix Seal
Open source: near-zero network fee, no subscription

Identity and adoption

Verified legal identity

Cloud e-signature / storage SaaS
Email, SMS or KYC verification depending on plan
PKI / qualified certificates
Identity validated by an authority (QES)
PGP / S-MIME
No verification; peer-to-peer trust
Radix Seal
Self-declared by the wallet; no legal binding

Ease for first-time signers

Cloud e-signature / storage SaaS
One click from the email, nothing to install
PKI / qualified certificates
Card or token plus dedicated software
PGP / S-MIME
Installation and technical concepts
Radix Seal
Requires the Radix Wallet and a one-time setup

Corporate workflows (templates, reminders, signing order)

Cloud e-signature / storage SaaS
Very mature: templates, reminders, integrations
PKI / qualified certificates
Depends on each organization's software
PGP / S-MIME
Nonexistent
Radix Seal
Essential invite and on-ledger status flow

A Radix Seal signature proves the integrity of a document, its consensus timestamp, and control of the signing account, with any disclosed name self-declared by the signer's wallet. Where regulation requires an identity-verified qualified signature (such as eIDAS QES), Radix Seal complements those schemes with stronger custody, confidentiality and longevity. When idOS (decentralized identity) is implemented on Radix, a Radix Seal signature could reach legal validity, by binding the signing account to a verified identity.

Open verification

Verifiable by anyone,
forever

A Radix Seal signature does not depend on this site. The standard is a set of public metadata conventions: any tool can read the ledger and reach the same conclusion.

Self-contained PDF

The signed PDF carries the certificate and the intact original document inside. One file is enough to verify the full signature.

Public request key

Every signing request has a key (collection and id) that lets anyone query the ledger for who had to sign and who has signed already.

Chain of custody on-ledger

Each signer's collection is guarded by their non-transferable Seal: a proof of authorship read straight from the chain, trusting nobody.

Official Radix Seal resource

The genuine brand resource per network. A signing collection is only authentic if its metadata references one of these addresses. Confirm the address before trusting a collection.

Mainnetresource_rdx1nf89ryugl2ytuh7lfcrpt7ghudnfah7gdcwwjw6y3e6v5cwrr5tfxs
Stokenetresource_tdx_2_1n20d5q2y9p46zrjaw543vcpdmk3dygtlq4uzyw2zvssg48cxsteu3e

Trust is no longer
something you rent.

Sign a document, encrypt a file or open a verified conversation, right now, from your browser, with the wallet your organization already controls.