Sign, encrypt and communicate. Without trusting anyone's servers.
Radix Seal turns the Radix Wallet into your institution's own certificate authority. Everything happens in the browser and proofs are anchored on a public ledger that anyone can verify independently, forever.
Sign documents verifiable, with no middleman.
The certificate proves each signature without depending on this site: anyone verifies it with the original file, with no Radix account needed. And if you want, you anchor the signature as a soulbound NFT in your collection for an on-ledger record.
Encrypt files that never leave your browser.
Content is encrypted locally and travels peer-to-peer between browsers. With ROLA + Ledger you authorize specific accounts in advance and there is a public record of who may decrypt.
The Radix Seal: an open on-ledger standard. Each user self-mints a soulbound seal NFT that acts as the insignia of their attestation collection: the on-chain equivalent of an institutional stamp, held in self-custody.
Your wallet works like a security key (passkey): you prove your identity by signing a challenge, without ever exposing the key.
Three tools,
one trust model
Every Radix Seal tool follows the same rule: your wallet proves identity, your browser does the cryptography, and no intermediary ever holds content or keys. Available today in the Radix console.
Sign documents
Sign any file with your Radix Wallet. The document is hashed locally and never uploaded: only the hash is signed, proving integrity, timestamp and control of the account key.
- Attached certificate or embedded directly inside the PDF
- Optional on-ledger anchoring as a soulbound NFT
- Multi-party signing: several signers on one certificate
- Identity disclosure you control: name, email or signature only
- Anyone can verify, no wallet or account needed
Encrypt files
The encryption key is derived from your wallet signature via ROLA: only the account that encrypted a file can ever unlock it. Files are processed in chunks, entirely in the browser.
- No file size limit: chunked, never uploaded
- Key derived from your wallet: nothing to store or lose
- Direct browser-to-browser transfer, end-to-end encrypted
- Receiver decrypts only when the owner approves and signs
Secure chat
End-to-end encrypted conversations where both sides prove who they are by signing with their wallet. The session key is derived from that verified exchange: no server can read, alter or impersonate anything.
- Both participants wallet-verified before the room opens
- Messages travel peer-to-peer over an encrypted channel
- Each invitation link works for a single conversation
- Identity checks verified locally, in each browser
- Encrypted file sending with no size limit over the same channel
- Nothing leaves your browser: messages vanish when the page closes and the local copy of received files is deleted after 24 hours
Your wallet is the
certificate authority
Traditional trust infrastructure asks you to delegate: to a SaaS vendor, to a certificate authority, to a key server. Radix Seal inverts the model: the keys stay in your wallet, the computation stays on your device, and the only shared dependency is a public, decentralized ledger.
Self-custody keys
Identity is proven with ROLA: the wallet signs a challenge, never revealing the key. The same key management your institution already uses for assets now backs signatures, encryption and messaging.
Local cryptography
Hashing, encryption, decryption and verification all run in the browser. Documents, messages and plaintext never leave the device: there is no upload step to secure, audit or breach.
Peer-to-peer transport
When content must move between parties (an encrypted file, a chat message) it travels over a direct, end-to-end encrypted channel between browsers. No intermediary storage, no server in the data path.
Public, permanent proof
Optionally, a document hash is anchored on the Radix ledger as a soulbound NFT. The proof is timestamped by consensus, immutable, and verifiable by anyone without a Radix account.
An open on-ledger standard, not a product
Radix Seal is defined by public metadata conventions on the Radix ledger. Any wallet, explorer or third-party tool can implement it: discover a signer's attestation collection, check its insignia and verify its certificates, with no permission from us and no proprietary format in the way.
- Soulbound insigniaEach user self-mints a non-transferable seal NFT: it cannot be bought, sold or stolen. Each account mints its own by signing with its wallet, so holding the seal proves you control that account, and only you can use it.
- Attestation collectionsSignatures and invitations live in per-user collections whose owner and minter is the user's own seal: a chain of custody readable on-ledger.
- Only hashes on-chainThe ledger stores document hashes, never documents, names or messages. Public verifiability without publishing anything confidential.
How the seal,
the collection and its NFTs work
The whole Radix Seal model rests on two base NFTs you mint once, plus five NFT types kept inside your collection. Here is what each one is, who mints it and what it proves, made clear without jargon.
The two base NFTs (one time only)
Seal NFT
It is your signer identity and the only key able to mint into your collection. You get it once from the official Radix Seal resource.
- Soulbound: cannot be sold, moved or burned
- Only you control it, bound to your account
- Without it, nobody (not even this site) can create anything in your name
Signing collection
Your personal, reusable resource where every NFT you issue or sign is stored, numbered. Its owner rule is locked and requires your Seal.
- Reusable: each document adds a numbered NFT (#1, #2, #3...)
- Rules locked at creation: data unalterable forever
- Only your Seal can mint into it, so nobody else can create signatures or invitations in your name
The five NFT types inside the collection
They all share the same unforgeable chain of custody: they live in a collection owned by your soulbound Seal, in your account. That is why nobody can forge them in your name.
Signature invitation
kind: inviteDeposited into each signer's wallet. It carries the document hash and the invited account. It is a notice, not a signature; the issuer can recall it after a mistake, but can never touch a signature.
- ▸
- Minted by whoever requests signatures, one per signer
- Public record of who was asked to sign that document
Signature
kind: signatureThis is the record that truly counts as a signature: non-transferable, data locked. Impossible to forge because only the signer's Seal can mint into their collection.
- ▸
- Minted by each signer into their own collection
- The account signed that specific document
Encryption signature
kind: cipher-signatureOnly in ROLA + Ledger mode. Always minted, with or without receivers: a public, permanent record in the encryptor's collection that this account encrypted the file, the encryption counterpart of a document signature.
- ▸
- Minted by whoever encrypts, into their own collection
- The account encrypted that specific file
Encryption invitation
kind: cipher-inviteOnly in ROLA + Ledger mode. Deposited into the receiver's wallet, carrying the encrypted file's hash. Without this invitation, an account cannot even request the key from the sender.
- ▸
- Minted by whoever encrypts, one per authorized receiver
- The account is allowed to request decryption
Decryption receipt
kind: cipher-receiptOptional, in ROLA + Ledger mode. A public, permanent record in the receiver's collection that they obtained the key, verifiable by the sender on the ledger.
- ▸
- Minted by the receiver after obtaining the key
- The account decrypted the file
All of this is public and permanent on the Radix Network. Anyone can read and verify it without depending on this site, with no account and no proprietary formats.
Encryption that never
trusts a server
Radix Seal locks a file to your account with a key derived from your wallet, encrypts it in your browser and shares it peer-to-peer. No server ever holds your file or your key. Here is how it works, why it fits institutions, and how it improves on current methods.
How it works
1. Key from your wallet
The AES-256 key is derived from a deterministic ROLA signature over a per-file challenge, so only the account that encrypted the file can re-derive it. Nothing is stored: no password, no key file.
2. Encrypted in your browser
The file is encrypted chunk by chunk with AES-256-GCM, entirely on your device. There is no size limit, and not a single byte ever reaches a server.
3. Shared peer-to-peer
When you share it, the file travels over a direct, end-to-end encrypted channel between browsers. The receiver opens a link and it transfers browser to browser.
4. On-ledger access record
With ROLA + Ledger, the encryptor mints a signature marking that this account encrypted the file, plus one invitation per authorized receiver, so who may decrypt is a public, verifiable record.
Why it matters for institutions
Data sovereignty
Documents and keys never touch a third-party server: no data processor holding your content, no cross-border transfer to assess, and no vendor breach that can expose your files.
No key-management burden
The key is re-derivable from the wallet your organization already controls, so there is nothing to store, rotate, escrow or lose, and no key server to secure.
Auditable access
With ROLA + Ledger, who was authorized and who decrypted is recorded on a public ledger, verifiable years later with no vendor account and no API that may have been retired.
How it improves on current methods
No keys to share or leak
The key is derived from your wallet and never leaves it. You never send passwords or key files over any channel, so there is no key leak, and the file itself never leaves your device, so there is no information leak either.
Only the encryptor can release it
Only the account that encrypted the file can re-derive the key. Nobody else, not even this site, can decrypt it without that account's explicit approval, signed with its wallet.
Free to use
Encrypting, sharing and decrypting are free. Today's tools are usually paid, with a license or a per-user or per-file subscription. Here the only possible cost is a fraction of a cent in network fees, and only if you choose the ledger record.
The ledger, only if you want a record
Everything works locally and peer-to-peer without touching the chain. You only interact with the ledger if you want a public, verifiable record of who encrypted the file and who may decrypt it.
Your document never leaves
your browser
All the cryptographic work happens on your device. The only thing that touches the network is the bare minimum anyone needs to verify: the document hash and the signing accounts.
Local hashing
The document is digested with Blake2b-256 in your browser, and signing means signing that hash. The content is never transmitted to any server.
Direct browser-to-browser channel
When the file must reach another signer, it travels browser to browser over an end-to-end encrypted channel. No cloud in between.
Identity under your control
Name or email are only included if you decide so, and they live in the certificate, not on the ledger. The chain holds only hashes and accounts.
No accounts, no sign-up
No registration, email or password. Your wallet is your identity and the only key able to mint into your collection.
Built for organizations that
answer to auditors
Banks, public administrations, law firms and healthcare providers share the same three problems: prove who signed what and when, keep confidential data confidential, and avoid betting their evidence on a vendor's survival. Radix Seal addresses all three by design.
Audit trail by consensus
An anchored signature is timestamped by the network's consensus, not by a vendor's clock. Years later, an auditor or regulator verifies it against the public ledger directly, with no vendor account, no API contract and no certificate chain that may have expired in the meantime.
Data sovereignty by architecture
Documents, messages and encryption keys never touch a third-party server, so there is no data processor holding your content, no cross-border transfer to assess, and no vendor breach that can expose your files. What never leaves the building cannot leak from someone else's cloud.
No vendor lock-in
Radix Seal is an open standard over a public ledger with open-source tooling. Certificates are plain JSON, proofs are ordinary ledger entries, and verification needs no proprietary software. If this website disappeared tomorrow, every proof would remain verifiable.
Procurement-friendly economics
No per-envelope licensing, no per-seat subscription, no infrastructure to deploy or maintain. Signing and verifying are free; anchoring a proof on-ledger costs a fraction of a cent in network fees. The trust budget goes to zero, not to a line item.
How Radix Seal compares to
today's most trusted techniques
Cloud e-signature suites, PKI with qualified certificates and PGP are today's benchmarks for signing and encrypting. Each one delegates something (custody, confidentiality or longevity) that Radix Seal keeps in your hands.
| Criterion | Cloud e-signature / storage SaaS | PKI / qualified certificates | PGP / S-MIME | Radix Seal |
|---|---|---|---|---|
| Keys & custody | ||||
| Who holds the keys | The vendor: signatures are applied on their servers | Smartcard or HSM, issued and revocable by a CA | Local keyring, entirely user-managed | Your wallet: self-custody, no issuer above you |
| Trust anchor | The vendor's goodwill, uptime and security | Hierarchical CAs, single points of failure | Web of trust, hard to scale beyond experts | A public, decentralized ledger |
| Confidentiality | ||||
| Where your document goes | Uploaded to the vendor's cloud to be signed | Often uploaded to portals in signing workflows | Stays local, but usually sent by email | Never leaves the browser: only the hash is signed |
| Transfer between parties | Through the vendor's servers and storage | Email attachments or shared drives | Email attachments, metadata exposed | Direct browser-to-browser, end-to-end encrypted |
| Verification & audit | ||||
| Independent verification | Requires the vendor's portal or API to exist | Requires CA chain plus CRL/OCSP status checks | Requires key servers and fingerprint checks | Anyone with the file and the public ledger, no account |
| Timestamp integrity | Attested by the vendor's own clock | Paid timestamping authority (RFC 3161) | None by default, self-declared | Fixed by network consensus, immutable |
| Longevity & cost | ||||
| Proof lifetime | As long as the vendor exists and keeps records | Until certificate expiry or CA revocation | As long as keys are safely kept | As long as the public ledger exists |
| Cost model | Per-envelope pricing and per-seat subscriptions | Certificate issuance, renewals and tokens | Free software, high operational complexity | Open source: near-zero network fee, no subscription |
| Identity and adoption | ||||
| Verified legal identity | Email, SMS or KYC verification depending on plan | Identity validated by an authority (QES) | No verification; peer-to-peer trust | Self-declared by the wallet; no legal binding |
| Ease for first-time signers | One click from the email, nothing to install | Card or token plus dedicated software | Installation and technical concepts | Requires the Radix Wallet and a one-time setup |
| Corporate workflows (templates, reminders, signing order) | Very mature: templates, reminders, integrations | Depends on each organization's software | Nonexistent | Essential invite and on-ledger status flow |
Keys & custody
Who holds the keys
Trust anchor
Confidentiality
Where your document goes
Transfer between parties
Verification & audit
Independent verification
Timestamp integrity
Longevity & cost
Proof lifetime
Cost model
Identity and adoption
Verified legal identity
Ease for first-time signers
Corporate workflows (templates, reminders, signing order)
A Radix Seal signature proves the integrity of a document, its consensus timestamp, and control of the signing account, with any disclosed name self-declared by the signer's wallet. Where regulation requires an identity-verified qualified signature (such as eIDAS QES), Radix Seal complements those schemes with stronger custody, confidentiality and longevity. When idOS (decentralized identity) is implemented on Radix, a Radix Seal signature could reach legal validity, by binding the signing account to a verified identity.
Verifiable by anyone,
forever
A Radix Seal signature does not depend on this site. The standard is a set of public metadata conventions: any tool can read the ledger and reach the same conclusion.
Self-contained PDF
The signed PDF carries the certificate and the intact original document inside. One file is enough to verify the full signature.
Public request key
Every signing request has a key (collection and id) that lets anyone query the ledger for who had to sign and who has signed already.
Chain of custody on-ledger
Each signer's collection is guarded by their non-transferable Seal: a proof of authorship read straight from the chain, trusting nobody.
Official Radix Seal resource
The genuine brand resource per network. A signing collection is only authentic if its metadata references one of these addresses. Confirm the address before trusting a collection.
resource_rdx1nf89ryugl2ytuh7lfcrpt7ghudnfah7gdcwwjw6y3e6v5cwrr5tfxsresource_tdx_2_1n20d5q2y9p46zrjaw543vcpdmk3dygtlq4uzyw2zvssg48cxsteu3eTrust is no longer
something you rent.
Sign a document, encrypt a file or open a verified conversation, right now, from your browser, with the wallet your organization already controls.