<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>VerIQ — how verification works</title>
<link rel="icon" type="image/svg+xml" href="/assets/favicon.svg">
<link rel="stylesheet" href="/assets/style.css">
</head>
<body>
<div class="wrap">
<header class="top">
<a class="logo" href="/">Ver<span>IQ</span></a>
<span class="tagline">how verification works</span>
</header>
<section class="hero" style="padding-bottom:12px">
<h1 style="font-size:clamp(24px,5vw,36px)">Why a VerIQ link can't be faked.</h1>
<p class="lead">For everyone who has ever seen a suspicious IQ screenshot. Here is the actual mechanism — no hand-waving.</p>
</section>
<section class="panel">
<h2>1 · The problem with screenshots</h2>
<p>
Every other IQ test hands you an image. An image is just pixels —
open any editor, change "89" to "139", done. There is no way for a
stranger to tell a real certificate from an edited one, because there
is nothing to check it against.
</p>
</section>
<section class="panel">
<h2>2 · What VerIQ does instead</h2>
<p>
When you finish the test, our server computes your score and signs it
with an <b>Ed25519 private key</b> that never leaves the server. The
signature covers the exact payload: result ID, score, percentile,
question bank version, completion time. Change one character of the
score and the signature no longer matches.
</p>
<p style="margin-top:10px">
Ed25519 is the same signature scheme used by SSH and TLS-adjacent
tooling. Forging a signature without the private key is not "hard" —
it is computationally infeasible with known methods.
</p>
</section>
<section class="panel">
<h2>3 · What a verifier actually checks</h2>
<p>
When someone opens your link <span class="mono">/v/<id></span>,
the server re-checks the signature against the stored payload on every
view and shows the verdict. The service public key is published at
<a class="mono" style="color:var(--accent)" href="/.well-known/veriq-pubkey.txt">/.well-known/veriq-pubkey.txt</a> —
anyone can independently verify a payload+signature pair offline with
any Ed25519 implementation. We don't ask you to trust our UI; the
math is checkable by hand.
</p>
</section>
<section class="panel">
<h2>4 · What this does NOT prove</h2>
<p>
Honest limits: a signature proves the <b>result was issued by this
service and unaltered</b>. It does not prove who sat behind the
keyboard — unless the result is claimed via X/Instagram binding, and
even then it proves the account owner took it, not that they didn't
get help. Scores are preliminary-calibrated until 500 completions.
We say this on every result page. Tests that don't state their
calibration status are selling confidence, not measurement.
</p>
</section>
<section class="panel">
<h2>5 · Verify it yourself, right now</h2>
<p>
Take any result link, fetch its payload and signature from
<span class="mono">/api/result/<id></span>, and check the Ed25519
signature against our public key. Ten lines of Python:
</p>
<p class="mono" style="color:var(--text);background:var(--panel2);border:1px solid var(--line);padding:12px;margin-top:10px;font-size:13px;overflow-x:auto">
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey<br>
import base64, json, urllib.request<br><br>
d = json.load(urllib.request.urlopen("https://YOUR-DOMAIN/api/result/RESULT_ID"))<br>
pub = Ed25519PublicKey.from_public_bytes(base64.b64decode(<br>
urllib.request.urlopen("https://YOUR-DOMAIN/.well-known/veriq-pubkey.txt").read()))<br>
pub.verify(base64.b64decode(d["signature"]),<br>
json.dumps(d["payload"], sort_keys=True, separators=(",", ":")).encode())<br>
print("signature valid") # raises InvalidSignature if tampered
</p>
</section>
<section class="panel">
<h2>Try it</h2>
<p>Get your own signed result — free, no registration.</p>
<a class="btn small" href="/test" style="margin-top:10px">Start the test →</a>
</section>
<footer>
VerIQ · <a href="/stats">live stats</a> ·
<a href="/.well-known/veriq-pubkey.txt">service public key</a>
</footer>
</div>
</body>
</html>
