Get a free key

Methodology · verifier version 1 · capture method version 2

How directory verification works.

"Verified" means a listing passed the public checks below on the date shown on its record. The badge on a verified listing reads "Attested". It does not mean endorsed, secure or guaranteed.

Automatic

The checks

  1. Site reachable. The submitted URL must resolve to a public network address and return HTTP 200.
  2. Product evidence. The public page must hold enough real product information to tell it apart from a parked domain or an empty launch page.
  3. Supplied links. If a GitHub repository is supplied, its public URL must load. Private code is not inspected.
  4. Basic identity. The product name must appear on the public page. If it does not, the listing goes to manual review.

A listing whose name, description or URL matches the blocklist is rejected before any fetch. A parked domain or a 404 is rejected. Any other failed or unclear check sends the listing to manual review instead of listing it.

Review before listing

A public submission is never listed by the automatic checks alone. A submission that passes is held until it has been read, and the site is checked again at approval. Listings that PageVerified added itself from public information say so on their page and pass the same checks.

The record on each listing

Every verified listing shows its verification record and the date the checks ran. The stored record names the verifier version and the scope:

{
  "verifier_version": 1,
  "site_live": { "passed": true, "status": 200 },
  "content_sanity": { "passed": true },
  "github": { "supplied": true, "passed": true },
  "impersonation": { "status": "not_detected" },
  "scope": "Availability, public product evidence and supplied-link checks only. Not a security audit or endorsement."
}

The date matters: a record says what was true when the checks ran, not what is true now.

What verified does not mean

  • No source-code audit.
  • No penetration test.
  • No financial, privacy or regulatory certification.
  • No guarantee of future uptime or conduct.
  • No endorsement of the tool or its maker.

Indexed listings are different

The directory also shows listings copied from public catalogs. Those pages say "Not verified by PageVerified". None of the checks above have been run on them.

Payment and verification

Verification is free and is the same for every listing. A featured placement can be bought only after a listing is verified, and it does not change the result. Paid placement and affiliate links are described on the disclosure page.

Capture method version 2

How a Capture Record is made

This part is about signed Capture Records, not the directory. Every signed record is made under a method version. For a record made since outside timestamps were switched on, the record check names it.

  • Version 1. PageVerified signs the record with its own key. The time in the record is PageVerified's own clock. Nothing outside PageVerified confirms that time.
  • Version 2. The same signed record, with an outside timestamp added. After the capture has finished, the SHA-256 of the signed record is sent to FreeTSA and CNX Timestamp Authority, which PageVerified does not run. Each one signs that hash together with its own time, using the RFC 3161 time-stamp protocol, and the signed answer is kept with the record. Only the hash is sent. The page, the file and the URL are not.

Version 2 is switched on for this server. A record made before it was switched on is version 1 and stays that way.

What version 2 shows: the record existed, unchanged, by the time the authority signed. That time is after the capture, usually within 15 minutes. If an authority does not answer, the record says it has no outside timestamp yet and the request is retried, every 15 minutes at first and then less often, so the outside time can be hours or days later than the capture time.

The tokens are kept with the record for 365 days, or until the capture is deleted if that is sooner. The JSON answer from the record check holds them, and a saved copy can be checked offline at any time.

What it does not show: who wrote the page, or that the page was true. The capture time inside the record is still PageVerified's clock. The check does not look up whether an authority's certificate was later revoked. It is not a legal certification.

Anyone can check a record at /verify, or offline with the open-source script and OpenSSL commands linked there.