Check that a font licence is genuine.

If you were given a licence to check

If you are a client, agency, printer or publisher’s lawyer with a link ending in /verify/ and a code, open it on the foundry’s site. Compare the masked name and the styles it lists with the licence certificate.

If there is no link, ask the foundry for its licence certificate or order record.

Where the link appears

The rest of this page is for the foundry. Each paid order gets a random 32-character verification code. The link, /verify/ and the code on your shop’s primary domain, is printed on the licence certificate, the receipt email and the printable receipt, and shown on the order in the buyer’s account.

What the page shows

Your foundry as licensor, the licensee, the order number and the date it was paid. Then each licensed line: the typeface or bundle, the licence with its tier and any term, the styles, its state and its term dates. Then each agreement the buyer accepted, with its title, version and SHA-256 hash, linked to its text.

The licensee is masked. Each word of the name and company keeps its first letter, followed by up to four dots, so “Ada Lovelace” reads “A•• L••••”. No email, address, price, total or usage detail such as domains or app names is shown. The page isn’t indexed by search engines, isn’t cached, and sends no referrer when the reader follows a link from it.

The states a licence can be in

Each line has its own state: in force, term ended, renewed by a later order, ended with a refund, ended by a payment dispute, revoked by the foundry, or paid and being issued. A trial licence reads “for testing only” while it runs and “trial ended” after. The page is read fresh on every visit, so a refund or revocation shows at once.

Who can check, and how often

A code works only on the shop of the foundry that issued it. On another foundry’s domain it gets the same “not found” as a mistyped, unknown or unpaid code, so the page reveals nothing about other foundries’ orders. Each IP address can make 30 checks a minute at each foundry, and past that the page asks the reader to wait. The same answer is available as JSON at /api/verify/ and the code.

The acceptance record behind it

The order keeps the agreement version and hash the buyer accepted, and the IP address and browser of the checkout request in which they ticked “I accept”. The time is when the order was placed. You see the address and browser in your admin, never on the public page. They are kept for six years after the order, and they are cleared at once if the buyer asks for their data to be erased. The font EULA guide covers what to keep as evidence of acceptance.