The document layer.
Features that live on the passport itself — visible, tactile, and checkable with nothing but your eyes and a bit of arithmetic.
Check digits in the number
Every passport number ends in an ICAO 9303 check digit — the 7-3-1 weighted scheme real passports use. SB-SPEC2X-8: mistype one character and the number fails before it ever reaches a registry. The alphabet drops 0/O/1/I/L, so numbers survive being read aloud.
Machine-readable zone
Two 30-character lines, TD3-inspired: document number, kind, issue date — each with its own check digit, plus a composite digit over the whole line. The MRZ also embeds the first 8 characters of the document’s cryptographic signature.
Printed signature
A 12-character HMAC-SHA256 fragment, computed over the passport’s canonical fields with a key only the issuing desk holds. Recomputed on every check — a forged card can’t survive contact with /verify.
Guilloché ground
The interference-pattern engraving from banknotes, generated as fine vector line work under the data page. Hard to reproduce convincingly; instantly recognisable when it’s wrong.
Holographic seal & microtext
An iridescent seal that shifts hue as the document moves, and a border of microprinted text — SUNBEAM·PASSPORT· repeated at sizes that degrade when copied.
Latent UV layer
Under the UV lamp the document shifts: a hidden watermark and status text appear — VALID·IN·ANY·LIGHT on genuine documents, REVOKED burned across withdrawn ones.
The digital layer.
The passport is also a signed credential — a Sunbeam Passport Token: an Ed25519 (EdDSA) JWT that any service anywhere can verify, with or without connectivity, without asking us.
Ed25519-signed tokens
Claims: passport number, holder, kind, spec version, issue date. Signed with the desk’s private key; verifiable by anyone with the public one. Standard JOSE — every language has a library that already speaks it.
Published keys
The public key lives at /.well-known/jwks.json. Fetch once, cache forever, verify offline — door scanners in a basement with no signal included. Keys rotate by addition (spt-1, spt-2, …), never by replacement.
Scans leave no trace
The QR encodes /verify#<token> — the token rides in the URL fragment, which browsers never send to any server. Verification happens in the scanner. Nobody’s logs learn who showed their passport to whom.
Live revocation registry
Offline checks prove a token is genuine; the registry at /api/status/[no] says whether it’s still in good standing — returning status and kind only, never holder identity.
Atomic, single-use invites
Passports are claimed through invite codes that can be redeemed exactly once — enforced at the database, not the interface — and one account can hold exactly one passport, by unique index.
A ledger that never forgets
Every mint, claim, stamp, and status change appends a full snapshot to an append-only revision ledger, tagged with its document spec version. Renderers for old specs are kept forever — any passport ever issued stays readable, exactly as issued.
Verify passports in three steps.
No API key, no account, no SDK. If your service wants to honour Sunbeam Passports at the door, this is the whole integration.
Fetch the keys (once)
GET https://passport.hiltonbarber.com/.well-known/jwks.json
→ cache it; it rarely changes
Verify the token — works offline
import { createLocalJWKSet, jwtVerify } from "jose";
const jwks = createLocalJWKSet(cachedJwks);
const { payload } = await jwtVerify(token, jwks, {
issuer: "sunbeam-passport",
});
// payload.sub → "SB-XXXXXX-0", payload.name, payload.kind
When online, check standing
GET /api/status/SB-XXXXXX-0
→ { "status": "active", "kind": "non_resident" }
◉ Under the UV lamp
Flip the UV switch on any rendered passport and the latent layer appears — watermark, status text, violet-shifted engraving. A toy? Partly. But it’s the same idea as the real thing: security you can only see when you know how to look.
Honest small print: offline verification proves a token was genuinely issued — it cannot know about revocations made after your last registry check. That’s true of every offline credential ever made; we just say it out loud. And none of this makes it a travel document. It opens our doors, not borders.