Sticker check

You scanned a sticker. Now check it.

Here's what this sticker says, what it can't prove on its own, and how to make the device prove the rest — all in your own browser. No trust required. That's the point.

What this sticker says

This page is where a Canary's sticker points when you scan it. Open it by scanning a sticker (or follow a /verify?k=… link) and it'll show that device's identity — then walk you through checking it's the real thing.

this Canary

The shape above is drawn from the key on the sticker by the same code the device runs — so it's this unit's, not a picture we chose.

Wait — why does this prove anything?

Crypto feels weird right up until someone shows you the trick. Here's the whole trick, in five thoughts you're probably already having.

Its name is a random code, not a name someone gave it.

Right — and that's the feature. canary-7fA3 wasn't assigned by us; it's a fingerprint of the device's own seal. Nobody handed it out, so nobody can hand out a fake one. The name is made of the key.

…but I could photocopy this sticker in ten seconds. So what's it worth?

Totally fair. The sticker is a wanted poster, not a padlock. It says: “look for the device that can press this seal.” Photocopying a wanted poster doesn't make you the person on it. The paper only carries a picture of the seal — the device is the one thing on earth holding the ring that presses it, and that ring never leaves its chip. Copy the sticker all you like; you still can't make the seal.

Why am I comparing a little ASCII-art picture?

Because your eyes can't diff 64 hex characters, but you're a supercomputer at comparing shapes. Randomart turns the key into a shape so a human can do the check in two seconds — the same shape the device draws on its own screen (press “l”). Two shapes match → same key. Done.

Why isn't SecuraCV checking this for me? Why does it work with no internet?

Because checking is just math anyone can run — and if we did it for you, you'd be back to trusting us. This whole page runs in your browser. We're not in the loop, and we built it so we can't be.

What's this “verified build” line — a birth certificate?

Basically, yes. Every firmware release leaves a public, append-only record of exactly which source code became these exact bytes. The sticker names the build your device shipped on and links you to that record — so “what's running on it” is something you can look up, not take our word for.

Three ways to check, from no-tech to real crypto

Each rung is honest about what it proves. Nothing here flashes a green check it hasn't earned.

By eye works today

Press “l” on the Canary and compare the shape on its screen to the shape on the sticker. If they match, both are claiming the same key. Needs no browser, no cable, and no us.

Plug it in works today

Connect the Canary over USB and the browser reads its live identity and confirms it reports the same public key the sticker claims — same key, same shape, right now. The one button also runs rung 3. (Chrome or Edge on desktop.)

Make it sign a challenge works today

The strongest rung, and the same Connect button does it: the browser makes a fresh random number, the device signs it with the secret ring (the firmware's attest command), and the browser checks the signature against the sticker's key. A photocopy can report a matching key; only the device holding the ring can sign a number it has never seen before. That's what turns “same identity” into “provably the same device.”

A sticker is a public claim, never a secret. Everything it carries — the key, the build name, the witness starting point — is safe to print because none of it can be used to impersonate the device; only the device's chip holds the private half. The randomart is generated from the key by the same construction the firmware uses, pinned byte-for-byte against a golden vector in tests/randomart.test.mjs, so the shape on this page and the shape on the device can never silently disagree.