Basis Passport: your basis is yours.

Every crypto-tax tool locks your history in. We publish ours. The Basis Passport is a signed, versioned, portable file containing your complete evidence-linked basis state — open lots, disposals with full lot lineage, income events, open decisions. Export it from any saved ClearBasis scan, free, forever — even if you never pay us a cent. Import it anywhere; this page is the whole spec, and anyone (including our competitors) may implement it.

The format

One JSON document. All quantities and USD amounts are decimal strings (never floats — money in floats is how basis dies). Timestamps are ISO-8601 with offsets.

{
 "format": "basis-passport",
 "version": "1.0",
 "generator": {"name": "...", "engine_version": "...", "ruleset_version": "..."},
 "generated_at": "2026-08-22T18:00:00+00:00",
 "open_lots": [
   {"wallet": "coinbase", "asset": "ETH", "qty": "1.5",
    "unit_basis_usd": "1505.00", "acquired_ts": "2023-01-10T12:00:00+00:00",
    "origin_tx": "file.csv:2", "conservative_default": false,
    "evidence": [{"source": "coinbase_csv", "ref": "row:2"}]}
 ],
 "disposals": [
   {"tx_id": "file.csv:9", "ts": "...", "wallet": "coinbase", "asset": "ETH",
    "qty": "1", "proceeds_usd": "1990.00", "kind": "sale",
    "allocations": [
      {"lot_id": "L0001", "qty": "1", "unit_basis_usd": "1505.00",
       "acquired_ts": "...", "conservative_default": false}],
    "evidence": [{"source": "coinbase_csv", "ref": "row:9"}]}
 ],
 "income": [
   {"tx_id": "...", "ts": "...", "wallet": "...", "asset": "ATOM",
    "qty": "5", "fmv_usd": "50.00", "kind": "staking"}
 ],
 "decisions_open": ["D00007"],
 "integrity": {"algo": "sha256", "digest": "…64 hex chars…"}
}

The integrity seal

The integrity.digest is SHA-256 over the canonical JSON of every field except integrity itself — keys sorted, separators (",", ":"), no whitespace, UTF-8. It's a tamper seal, not a secret: anyone can verify a passport wasn't altered in transit, no ClearBasis account required.

canonical = json.dumps({k: v for k, v in passport.items()
                        if k != "integrity"},
                       sort_keys=True, separators=(",", ":"))
assert sha256(canonical.encode()).hexdigest() == passport["integrity"]["digest"]

Semantics that matter

conservative_default: true marks a lot or allocation whose basis was set to $0 because records were missing — the honest floor, never a guess. Importers must preserve the flag: it tells the next tool (and the next accountant) which figures are provable and which are placeholders awaiting evidence. evidence entries point at the source rows/documents each figure came from; an importer that drops them is discarding exactly the part that survives an audit. decisions_open lists unresolved classification questions — a passport is allowed to carry honest uncertainty.

Versioning & license

Semantic versioning; additive fields bump the minor version, breaking changes bump the major. This spec text and the format are free to implement with no license, fee, or permission — attribution appreciated, not required. Corrections and proposals: hello@clearbasis.tax.

Get your passport — run the free scan

Canonical JSON, precisely

"Sorted keys, no whitespace" is not enough to reimplement the seal, and we found that out the honest way — by writing a second implementation, the verifier below, in JavaScript. Four rules, and the third is the one that bites.

• Keys sorted ascending by Unicode code point.
• A comma between items and a colon between key and value, with no spaces anywhere.
• Every character outside 0x20 to 0x7E is escaped as a \uXXXX sequence, including 0x7F, and astral characters as a UTF-16 surrogate pair. Python escapes these by default and the original rule was written around that default without saying so; JSON.stringify, and the natural encoder in Go, Rust and Java, emit raw UTF-8 instead. A passport carrying an accented filename or a scam-token symbol therefore hashed to a different digest in every language but Python, and the other tool would have reported a perfectly good passport as altered. We document the rule rather than switch to raw UTF-8, because switching would break the seal on every passport already issued.
• The resulting ASCII string is hashed as UTF-8.

Verify one now

Paste a passport, or choose the file. Everything happens in this page: the passport is never uploaded, and this works with the network switched off. It is also the second implementation of the rules above, which is the only real proof they are complete.