For everyone who has ever seen a suspicious IQ screenshot. Here is the actual mechanism — no hand-waving.
Every other IQ test hands you an image. An image is just pixels — open any editor, change "89" to "139", done. There is no way for a stranger to tell a real certificate from an edited one, because there is nothing to check it against.
When you finish the test, our server computes your score and signs it with an Ed25519 private key that never leaves the server. The signature covers the exact payload: result ID, score, percentile, question bank version, completion time. Change one character of the score and the signature no longer matches.
Ed25519 is the same signature scheme used by SSH and TLS-adjacent tooling. Forging a signature without the private key is not "hard" — it is computationally infeasible with known methods.
When someone opens your link /v/<id>, the server re-checks the signature against the stored payload on every view and shows the verdict. The service public key is published at /.well-known/veriq-pubkey.txt — anyone can independently verify a payload+signature pair offline with any Ed25519 implementation. We don't ask you to trust our UI; the math is checkable by hand.
Honest limits: a signature proves the result was issued by this service and unaltered. It does not prove who sat behind the keyboard — unless the result is bound to an X or Instagram account before the test starts (identity is part of the signed payload), and even then it proves the account owner took it, not that they didn't get help. Scores are preliminary-calibrated until 500 completions. We say this on every result page. Tests that don't state their calibration status are selling confidence, not measurement.
Take any result link, fetch its payload and signature from /api/result/<id>, and check the Ed25519 signature against our public key. Ten lines of Python:
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
import base64, json, urllib.request
d = json.load(urllib.request.urlopen("https://YOUR-DOMAIN/api/result/RESULT_ID"))
pub = Ed25519PublicKey.from_public_bytes(base64.b64decode(
urllib.request.urlopen("https://YOUR-DOMAIN/.well-known/veriq-pubkey.txt").read()))
pub.verify(base64.b64decode(d["signature"]),
json.dumps(d["payload"], sort_keys=True, separators=(",", ":")).encode())
print("signature valid") # raises InvalidSignature if tampered
Get your own signed result — free, one login, one active result.
Start the test →