Inside
Insiders sell it
NEET 2026: teachers, coaching owners and others were arrested. Families paid bribes to get the paper.
Leak-proof exam paper distribution
Paper Seal
Exam papers stay sealed until shortly before the exam, with no single person to trust.
No one person holds the paper or the key. Every step leaves public proof, and anyone can check it.
A working demo on a test network. Not for real exams yet. Read the limits.
- Contents
- One exam paper
- Opens
- Shortly before the exam
- Takes
- The clock, and 8 of 10 key holders
Sealed
The problem
22 lakh students sat the same exam twice.
NEET-UG 2026 Question paper
Cancelled
- 3 MayThe exam. About 22.7 lakh candidates.
- 12 MayCancelled.
- 21 JuneThe re-exam.
A “guess paper” passed around before the exam matched over 100 of the 180 real questions. Students had to sit an exam they had already sat, because a few people sold it for their own gain.
It leaks from both sides
Outside
Hackers take it
JEE Main 2021: the CBI alleges a Russian hacker got remote access to exam-centre computers.
Why the current way fails
- Someone always has the paper. Today one person or one company has to be trusted with it before the exam.
- Every fix still trusts someone. Every fix so far asks you to trust a person or a company, and that is where the leak comes from.
- Nobody outside can check. Students are told it was safe. They can't see that for themselves.
“The solution here is… openness and verifiability.”
How it works
The life of a paper
Seven steps, in order. The people involved use a normal web page and a security key. The cryptography stays out of their way.
-
The exam board Before anyone joins
Publish
The board creates the exam: its name, date, topics and limits. The exact code version and the settings go on the public record first. After that they can't be changed, even by the board.
Watch this step -
Key holders, centres, setters Before the exam
Register
Key holders and centres are picked by name from a public directory, and each signs in with their security key. Setters get a private invite, and their names are never published. The board posts the final list once, where anyone can read it.
Watch this step -
Setters Before the exam
Seal questions
Many setters write questions, not one. Each question is encrypted in the browser and goes straight into the sealed machine: a locked computer that no one can look inside. The setter gets a signed “sealed” receipt. No human sees the whole bank.
Watch this step -
The sealed machine No human involved
Build the paper
The bank locks by itself once it meets the published rules. Only then does the machine make a private random seed and pick the questions for each topic, so no setter can steer the choice. It builds one identical paper for every centre and locks it with a key.
Watch this step -
The clock and the key holders Shortly before the exam
Two locks, then the release
The machine splits the key in two. One half goes into a public time lock. The other is cut into 10 pieces for the key holders. The locked paper goes to public storage days ahead, and its record goes on the chain. Shortly before the exam the clock releases its half, and key holders touch their security keys to release theirs.
Watch this step -
Exam centres Shortly before the exam
Centres open it
With 8 pieces in, the machine rebuilds the people half and sends it only to approved centres. Centre staff touch their key. The app joins both halves, opens the paper and checks it against the public record. If it doesn't match, it won't show the paper.
Watch this step -
Anyone At every step, and after the exam
The public verifies
The verifier page shows each step and whether it passed, with no sign-in. At the end of the exam the clock opens the paper to everyone, and anyone can check it matches what was committed before the exam.
Watch this step
Neither half opens the paper alone
The paper key is split in two. You need both, and they are held by very different things.
The clock half
A time lock run by drand, a public network. It opens by itself, shortly before the exam. No person can hurry it.
The people half
7 exam centres3 neutral parties
Any 8 of 10 rebuild it. 7 reveal nothing. Centres alone can't reach 8, so a neutral party must join. Up to 2 can be offline.
Demo
Watch one exam, start to finish
Six short clips, recorded from the real apps in a browser. Under 2 minutes in all.
Clip 10:21
The board creates an exam
Name, date, topics and limits, then key holders and centres picked by name.
Clip 20:23
A setter seals questions
Register a security key, write the questions, and send them straight into the sealed machine.
Clip 30:12
A centre registers
The name is checked against the public directory, then the security key signs.
Clip 40:12
The machine builds, and key holders release
The paper is built and its record posted. At unlock, each key holder touches their key once.
Clip 50:07
The centre opens the paper
The key arrives, centre staff touch their security key, and the paper appears.
Clip 60:23
Check with your own AI
Copy one prompt into any AI agent. It reads the originals and reports what passed.
Features
What holds it together
No one can read it early
The paper is locked before anyone could see it, and stays locked by two separate things.
A sealed machine, proven by Google
The paper is built inside Google Confidential Space. Google signs a token saying exactly which code the machine runs, with debugging off. That code's fingerprint sits on the public record, and the apps refuse to talk to a machine that doesn't match.
Nobody can read the questions, including the board
Questions are encrypted in the setter's browser to a key that only the machine holds. The board's servers carry nothing but scrambled data. The bank is held in memory and never revealed, so unused questions stay private. Setters only know their own.
A timelock plus 8 of 10 key holders
The drand quicknet network releases one half of the key at a set time. Seven centres and three neutral parties hold pieces of the other half, each encrypted to their own security key. A released piece needs a touch of that key. Any 3 absent holders stop the unlock.
The evidence is public
The board runs the machine and the storage. So the proof lives in places the board can't quietly change or switch off.
A public record on Sepolia
The ExamRegistry contract holds the code version, exam settings, approved list and one Build per exam, with a hash of every file. The date and the list are written once. Only the board's address can write, and anyone can read.
ENS names
An exam has a name such as jee-main-2026.paperseal.eth, so you type a name and not a contract address. Each key holder and centre publishes their security key on a name of their own. The verifier checks a name both ways before it trusts it. The machine and the contract never read ENS, so a wrong name can only make a check fail.
An Arkiv mirror
A relay copies the signed release log and Google's token to Arkiv as they appear, and keeps an index of exams. Rows can't be edited and live for 180 days. A heartbeat shows when the copy stops. A row that doesn't verify never counts, and nothing secret goes there.
A Swarm backup
Every exam's public files are backed up to Swarm. If the board's storage goes down, the verifier takes the files from the backup, but only when they match the record on Sepolia. The key holder and centre pages don't use the backup yet.
Check it yourself
You don't have to take our word for it, or the page's.
The public verifier
No sign-in. It shows the code's fingerprint, Google's proof, the approved list, live unlock progress and the proof after the exam, step by step. It is hosted apart from the board. See a live example: time-q.paperseal-demo.eth.
An independent checker, and “Check with your own AI”
Each release has paperseal-verify.mjs, one Node file with nothing to install, which runs the verifier's checks from your own machine. One button copies a prompt for any AI agent. The agent gets the checker from the repository, reads the original sources and never takes the page's word. It reports pass, fail, not yet or not checked, and it says what it couldn't check.
Reproducible builds
Dependencies, base images and timestamps are pinned, so rebuilding a tagged commit gives the same image fingerprint. Each version is built twice on a clean GitHub runner, and anyone can run that action for any commit and compare.
Self-hosting
The verifier is a static page that needs no private key, so anyone can host their own copy and point it at their own RPC. A board runs its own deployment from one settings file, with a doctor script that checks each step.
Trust
Who can do what
Everyone involved has a job, and no one has enough power to open the paper alone.
| Who | Can | Can't |
|---|---|---|
| Exam board | Set the exam, pick the key holders, run the machine and host the apps. It can block an exam by refusing to run it. | Read questions as they pass through its servers, change the date, or swap the list once it is posted. |
| Setter | Write questions and see their own. One could recognise their own question on the paper. | See the whole bank, go over the limit for a topic, or steer which questions get picked. |
| Key holder | Release one piece with a touch of their security key. Holders could pool pieces in private. | Open anything before the clock releases its half. Neutral parties never get the paper's key at unlock. |
| Exam centre | Download the locked paper days ahead, open it at unlock and hand it out. It could still leak it after opening. | Open it before unlock, or get a different paper from any other centre. |
| Sealed machine | Build the paper and briefly hold the whole key before splitting it. Collect pieces at unlock. | Run other code unnoticed, because its fingerprint is checked against the public record. |
| Run the hardware and sign the proof of which code is running. It is trusted to report that honestly. | Write to the public record. Only the board's address can. | |
| drand | Release the clock half at the set time. It is the only clock, so a drand outage could delay the unlock. | Open the paper alone. The people half is still needed. |
| The public | Read the list, the record and the live unlock. After the exam, open the paper and check it. | See the paper before the end of the exam, see the question bank, or learn who the setters are. |
What if someone tries
- The paper-building code is malicious
- It is open source, so anyone can read it, and rebuild the same program to compare.
- The wrong version is running
- The machine proves which exact code it runs, and that must match the public one.
- An insider wants the paper early
- There is no single key. It takes a time lock plus 8 of 10 key holders.
- Key holders collude
- They could pool pieces, but that opens nothing before the time lock.
- A setter tries to rig the pick
- The random seed is made inside the machine, after the bank locks.
- The board swaps the approved list
- The list is posted once. The contract rejects a Build with a different list.
- A hacker steals the file
- It's encrypted, and useless without both halves of the key.
- A fake centre asks for the key
- Only centres on the approved list, with a registered security key, receive it.
These make each attack harder. They don't make it impossible. The limits are below.
Honest limits
What this is not
Paper Seal is a demo. It is not ready for real exams, and we make no claim of production readiness.
Test network
This is a testnet demo
It runs on Sepolia and Arkiv's test network. On Sepolia anyone can register a look-alike name, so names prove nothing until a mainnet name is used.
The security key maker isn't checked
The machine is proven by Google, but the check on who made a security key is off. The demo uses software keys in place of real ones.
Blocks are read before they are final
The demo reads the latest block to run faster. A real exam should read finalised blocks.
Not reviewed for real exams
No published image is fit for a real exam yet, and the design hasn't been reviewed for real use.
A centre can leak after it opens the paper
That leak can't be traced to a centre, so the gap before the exam is kept as short as possible.
The web app can be tampered with
The board serves it, so it could swap keys at registration. Even then, the clock keeps the paper closed until unlock.
In the demo, neutral parties aren't independent
The board owns the demo's directory and issues their records. A real exam needs names the board doesn't control.
Some things stay trusted
Google must report the running code honestly. If drand is compromised, 8 key holders could open the paper early. The selection is attested by the machine, not independently proven.
Don't trust it. Check it.
Open a demo exam on the verifier, or read every line of the code.