Verify a crawler

Paste a request's User-Agent and source IP. A claimed identity is only real if the IP falls inside the operator's own published ranges. Everything else is a claim, not a fact.

User-Agent

Source IP (IPv4)

try: real GPTBot spoofed GPTBot real PerplexityBot Bytespider a regular browser

Analyze a log

Paste raw access logs (nginx / Apache combined, Cloudflare JSON lines, or IP ,/tab UA). Every line claiming a known crawler is checked against that operator's published ranges, with a spoof rate per bot.

load a sample log

Web Bot Auth signature

The emerging standard (RFC 9421 HTTP Message Signatures, the basis of Web Bot Auth): a genuine bot cryptographically signs its request, so identity no longer depends on an IP list. Paste the signature base, the agent's Ed25519 public key, and the signature. Verification runs in your browser.

Signature base (RFC 9421)

Public key - Ed25519 JWK "x" (base64url)

Signature value (base64)

load RFC 9421 example

Scope: this verifies the Ed25519 signature over a reconstructed base, proven in your browser against RFC 9421's own Appendix B.2.6 test vector. Production fetches the agent's key from its Signature-Agent directory and canonicalizes the live request itself.