Transpareo Time Machine

A time machine for DPPs

Imagine holding a product in your hand and scanning the QR code on it. Instead of a PDF, a small app opens. You see the product as it is now: what it is made of, where it comes from, what to watch out for. A swipe leafs back through time - every version ever published can be viewed.

This is Transpareo Time Machine, our open-source consumer app for any Digital Product Passport. The code is published under GPL v3 on GitHub. The EU-funded project CIRPASS-2 lists Transpareo Time Machine in its OpenDPP Catalogue of open-source DPP software.

We build it because the EU Digital Product Passport regulation was written for consumers - for the person holding the product in their hand. Most providers turn it into a compliance form that nobody scans twice. We turn it into an app that the consumer actually opens.

Examples

See for yourself

The example passports are complete and filled with sample data: leaf through the version history and open the verification badge - right in your browser, no account needed.

In use

What the app does

Four touchpoints from the point of view of the person holding the product. No login, no app installation.

Scan

Scan the QR code with your smartphone camera. The app opens in the browser.

View the current state

The product appears as it is now - components, materials, origin, care, recycling.

Leaf through history

A swipe leafs back through time. Every earlier version with the date and the reason for the change.

Every version has its own link. A person shares a specific version with friends or authorities.

Why at all

The EU Digital Product Passport regulation is the biggest shift towards product transparency in decades. Read the underlying texts carefully and it is - explicitly - written for consumers. The authorities, the recyclers, the repair shops come along too; but the primary recipient is the person holding the product in their hand.

In numbers the case is clear-cut. An average European private individual will be able to scan dozens to hundreds of product passports per year by the end of the decade. Across 200 million households that adds up to billions of consumer interactions a year. The world of authorities and recyclers is, by comparison, numerically tiny.

If the regulation is to reach the consumer, then the consumer side has to be well built - fast, beautiful, coherent. Otherwise it misses its purpose.

We have decided to build this consumer side open-source, so that it does not depend on any single provider.

The history is required, the manifest is ours

A product passport changes: a repair, a new recycled-content figure, a recall. The rules therefore require earlier states to stay retrievable: the storage standard freezes every version, the interface standard provides for reading each version on its own. What the rules leave open is the piece in between: a list that ties all versions of a passport into one history. Transpareo publishes it for every passport as a manifest, signed, each version chained to its predecessor by fingerprint. That is what lets the Time Machine page through a product’s history, and what lets a reader check not only that a version is authentic but that it is the current one of an unbroken sequence.

The app does not depend on it, though. Point it at a single passport instead of a manifest, the way any provider publishes one under the open standards, and it renders that one version, verifies its signature if it carries one, and simply leaves the timeline out. A passport without a signature is not treated as a failure; it is shown without a verification mark. The same app therefore renders passports that were never at Transpareo.

Switching provider without a break

The EU Digital Product Passport rules require passports that are interoperable and built on open standards - transferable between services and systems rather than tied to a single provider. Independence from the service provider is therefore not an add-on; it is part of the requirement.

Transpareo Time Machine is the piece that makes this concrete. Because every product passport is delivered in open standards - resolver-neutral identification, canonical serialisation, published public keys - and the renderer is open-source under GPL v3, the presentation of a passport never hangs on our platform.

Responsibility for a product passport lies with an economic operator - the manufacturer, an importer or an authorised representative. If they decide to leave Transpareo and move to another service provider, the rendering stays stable: the same open-source renderer keeps displaying the already published versions and their full history unchanged, and a new provider that serves the same open standards is rendered by exactly the same app.

The data moves with them, consumers see no break, and nobody has to wait for a migration.

The move itself is not a project. Transpareo Time Machine is a static bundle: built once, copied to any web server, done. The look you configured in Transpareo for your passports travels with each passport as a published stylesheet, so the passport view your customers are used to looks the same on your own server, colours, typeface and logo included.

Verified in the browser, not on our server

At the top of every product passport a badge appears: Verified by Transpareo. It shows the result of a check that does not take place on our server, but in the visitor’s browser - from the loaded bytes and the issuer’s public keys.

Two mutually independent parties sign every DPP version: the issuer and Transpareo. Both signatures must be verifiable for the badge to turn green. With Bring Your Own Key (BYOK) the issuer runs their own signing endpoint - Transpareo never holds the private key and only adds the independent counter-signature. This produces an issuer signature that Transpareo itself cannot create.

A compromised server cannot forge the tick, because the check happens at the visitor’s end.

Anyone who wants the detail clicks on the badge. Behind it you see the signature chain, the hashes and the chained version history. Anyone who just wants the information simply ignores this and reads on in the product passport.

The same check is also available as a standalone page: on DPP verification you paste in the manifest URL of any product passport and see the full check result - without opening the passport itself.

We release the code

Transpareo Time Machine is published under GPL v3 on GitHub. Published modifications must in turn be under GPL v3, so that every further development serves the community. Clone, fork, self-host - all permitted.

How to embed the app, whether with one line in a page, as a package in your own application or fully self-hosted, is in the README there. It also covers the sister element for signature checking alone, which runs live on the DPP verification.

Who puts the app to good use

The app is built for consumers first. But it works for everyone who wants to view or verify product data independently.

End consumers scan, view, leaf through, share. No login, no trackers.
Market surveillance and authorities see the product passport in software whose source code is publicly auditable.
Repair shops and recyclers see the material composition and disassembly notes right on the product.
Brands and fork operators adapt the bundle to their own brand - CSS tokens, their own components, self-hosting.

What happens when Transpareo is no longer around

The EU requires that a product passport remains available for at least as long as the product is expected to last, even after the insolvency or liquidation of its issuer. For many products that is ten years and more, and a SaaS provider rarely lasts that long. We therefore build the platform from the outset so that the product passports remain usable independently of us:

Every signed DPP version sits in publicly readable storage. The bytes plus the published public keys are enough for later verification.
Once the product passports are registered with the EU register, a second, write-protected store additionally mirrors every DPP version and the event log for ten years. Nobody - not even us - can alter these mirror copies after the fact.
After a cancellation, the short product passport URLs remain reachable via a redirect on the Transpareo platform.
Transpareo Time Machine runs unchanged against archived holdings too. The bundle does not call back to us at runtime; it needs only the bytes and the keys.

If the Transpareo platform vanished tomorrow, the DPP versions and the open-source renderer would remain.

For the technically curious

Here is what happens under the hood. Anyone who does not need to know this in detail can skip this section - the app works either way.

GS1 Digital Link (ISO/IEC 18975): the product passport URL carries the product identification in a standardised form - resolver-neutral, interchangeable between providers.
JSON Canonicalization Scheme (RFC 8785): a deterministic serialisation. This keeps the hash reproducible regardless of field order or whitespace - anyone can recompute it themselves.
W3C Data Integrity Proofs (eddsa-jcs-2022): an Ed25519 signature over the canonicalised form (JCS).
/.well-known/dpp-keys/ (RFC 8615): the issuers’ public keys sit at a standardised path - no call to Transpareo needed, every verifier finds them itself.

Everything is documented in the README on GitHub - including the frontend architecture (its own reactive core, zero external frameworks) and the build guide for self-hosting.