What the green check means

You scanned a code on a Safetied sticker or PDF and a page opened. This page explains what that page told you.

What green means

When the signature checks out, the page says:

This signature verifies. The holder of the key in this code signed exactly this content hash. The code does not say who holds the key or what the entry says, and the time and entry shown here are copied from the code, not proven by it. Compare the hash, the time and the entry with the sticker, the PDF or the entry in Safetied.

Green means the signature checks out for the hash inside the code. Whether that hash matches the paper is your comparison, and the page says nothing more.

Try it with a sample code.

What it does not prove

  • It does not say who holds the key. The code carries a public key, not a name.
  • It does not say what the entry says. The entry text you see on the page is copied from the code.
  • It does not prove the time. The time is copied from the code too.

That is why the page asks you to compare. The paper, the PDF or the entry in the mechanic’s Safetied is the thing you check the code against.

How to compare it with the paper

  1. Read the content hash on the page and the one on the sticker, the PDF or the packet cover. They should match.
  2. Read the key on the page. It is the first 16 hex digits of the SHA-256 of the public key, in groups of four.
  3. Compare it with the key printed on the entry or shown in the mechanic’s Settings. It is the same fingerprint the app prints on entry PDFs and packet covers.
  4. Compare the time and the entry text with the paper.

If the key matches what the mechanic shows you, the hash matches the paper and the signature is green, then that key signed that content. Whether that key belongs to the mechanic is something you confirm with the mechanic.

What the other states mean

Green is the only state that says the signature checks out. The others are:

  • Red. The page says: “The signature does not match this hash and key.” The signature does not verify for the content in the code.
  • Grey, code not readable. The page says: “This code could not be read.” The link is cut short or is not a Safetied code.
  • Grey, browser cannot check. The page says: “This browser cannot check signatures. Open the link in Safari or Chrome, or scan the code with Safetied.”

No data leaves your phone

The code travels in the URL fragment, which browsers never send to any server, and the page makes no network requests. The check runs in your browser.