Sticker check

You scanned a sticker. Now check it.

What this sticker says, what it can't prove on its own, and how to make the device prove the rest, all in your own browser.

What this sticker says

This page is where a Canary's sticker points when you scan it. Open it by scanning a sticker (or follow a /verify?k=… link) and it'll show that device's identity — then walk you through checking it's the real thing.

this Canary

The shape above is drawn from the key on the sticker by the same code the device runs — so it's this unit's, not a picture we chose.

Wait — why does this prove anything?

Its name is a random code, not a name someone gave it.

Right, and that's the feature. canary-7fA3 wasn't assigned by us; it's a fingerprint of the device's own public key, so a made-up name won't match when you check it. The name is made of the key.

…but I could photocopy this sticker in ten seconds. So what's it worth?

Totally fair. The sticker is a wanted poster, not a padlock: it says “look for the device that can sign with this key.” Photocopying a wanted poster doesn't make you the person on it. The sticker carries only the public key. The private key that signs never leaves the device's chip, so copy the sticker all you like: you still can't sign.

Why am I comparing a little ASCII-art picture?

Eyes can't compare 64 hex characters, but they're quick at comparing shapes. Randomart turns the key into a shape you can check in two seconds: the same shape the device draws on its own screen (press “l”). Same shape, same key.

Why isn't SecuraCV checking this for me? Why does it work with no internet?

Because checking is just math anyone can run — and if we did it for you, you'd be back to trusting us. This whole page runs in your browser. We're not in the loop, and we built it so we can't be.

What's the “Build it claims” line?

The firmware build your device shipped on. Every release leaves a public, append-only record of which source code became those exact bytes, so you can look it up instead of taking our word for it.

Three ways to check, from no-tech to real crypto

Each rung is honest about what it proves. Nothing here flashes a green check it hasn't earned.

By eye works today

Press “l” on the Canary and compare the shape on its screen to the shape on the sticker. If they match, both are claiming the same key. Needs no browser, no cable, and no us.

Plug it in works today

Connect the Canary over USB and the browser reads its live identity and confirms it reports the same public key the sticker claims. The same button runs rung 3. (Chrome or Edge on desktop.)

Make it sign a challenge works today

The strongest rung: the browser makes a fresh random number, the device signs it with its private key (the firmware's attest command), and the browser checks the signature against the sticker's key. A photocopy can report a matching key; only the device holding the private key can sign a number it has never seen before.

A sticker is a public claim, never a secret. Everything it carries — the key, the build name, the witness starting point — is safe to print because none of it can be used to impersonate the device; only the device's chip holds the private half. The randomart is generated from the key by the same construction the firmware uses, pinned byte-for-byte against a golden vector in tests/randomart.test.mjs, so if the page's shape and the device's ever drift apart, the build fails.