For everyone who has ever seen a suspicious IQ screenshot. Here is the actual mechanism — no hand-waving.
++ Every other IQ test hands you an image. An image is just pixels — + open any editor, change "89" to "139", done. There is no way for a + stranger to tell a real certificate from an edited one, because there + is nothing to check it against. +
++ When you finish the test, our server computes your score and signs it + with an Ed25519 private key that never leaves the server. The + signature covers the exact payload: result ID, score, percentile, + question bank version, completion time. Change one character of the + score and the signature no longer matches. +
++ Ed25519 is the same signature scheme used by SSH and TLS-adjacent + tooling. Forging a signature without the private key is not "hard" — + it is computationally infeasible with known methods. +
++ When someone opens your link /v/<id>, + the server re-checks the signature against the stored payload on every + view and shows the verdict. The service public key is published at + /.well-known/veriq-pubkey.txt — + anyone can independently verify a payload+signature pair offline with + any Ed25519 implementation. We don't ask you to trust our UI; the + math is checkable by hand. +
++ Honest limits: a signature proves the result was issued by this + service and unaltered. It does not prove who sat behind the + keyboard — unless the result is claimed via X/Instagram binding, and + even then it proves the account owner took it, not that they didn't + get help. Scores are preliminary-calibrated until 500 completions. + We say this on every result page. Tests that don't state their + calibration status are selling confidence, not measurement. +
++ Take any result link, fetch its payload and signature from + /api/result/<id>, and check the Ed25519 + signature against our public key. Ten lines of Python: +
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+import base64, json, urllib.request
+d = json.load(urllib.request.urlopen("https://YOUR-DOMAIN/api/result/RESULT_ID"))
+pub = Ed25519PublicKey.from_public_bytes(base64.b64decode(
+ urllib.request.urlopen("https://YOUR-DOMAIN/.well-known/veriq-pubkey.txt").read()))
+pub.verify(base64.b64decode(d["signature"]),
+ json.dumps(d["payload"], sort_keys=True, separators=(",", ":")).encode())
+print("signature valid") # raises InvalidSignature if tampered
+
Get your own signed result — free, no registration.
+ Start the test → +No third-party trackers — everything below comes from our own event log.
+loading…
+