FAQ
Frequently Asked Questions
What Trusted Codes does, how it protects you, and where its limits are.
Getting Started
Create your account first — email link, Google or Apple, no password to invent. Then install the app on your phone and add the people you actually know: family, friends, colleagues. Set the first one up together, in person, if you can. From then on each of you has a code for the other, ready whenever a call or a message feels off.
For a shared code, yes — it comes from a secret both devices hold, so both sides need a client. For a one-off check, no. A guest code is three words you create and send; the other person just reads them back, with nothing to install. And anyone can check a code at verify.trusted.codes — no app, no account.
Yes. After setup there is exactly one thing to do: open the app and read three words. Nothing to remember, nothing to type, no menus to find. Sit down with your parents or grandparents for the setup itself — that is the part worth doing side by side.
Your three recovery words get you back. Sign in on the new phone the usual way, then enter the recovery words to unlock your data. Your connections return as each contact's device comes online and re-sends its part, so give it a little time. Tell your contacts the phone is gone, so they stay careful until you confirm you are back in control.
Security & Privacy
Only until the code changes, which on a free account is every six hours. They would also have to be connected to you already — something you approved — or talk you into accepting them as a new contact, where the app shows you a risk warning and makes you wait before you can agree. Recorded words are a weak attack when they stop working within hours.
No. The secret behind your codes is sealed on your device to a key only your own devices hold. We store the sealed envelope and have nothing that opens it. The codes themselves are worked out on your phone and are never uploaded. When you check somebody else's code in a browser, the words you type do reach us to be compared against a stored fingerprint — but your own codes stay on your device.
Someone who takes our whole database gets sealed envelopes without keys, and fingerprints instead of codes. Your private keys live on your devices and nowhere else. That is the reason it is built this way: a break-in on our side is not a break-in on your verification.
Because we don't trust the browser to hold your identity keys, and we won't ship a version of Trusted Codes that is weaker than the name promises. Browser extensions, lookalike domains and script injection are a class of remote attack that simply does not apply to an app the operating system protects. So the clients that hold keys are the phone app and the desktop app. The web pages we do run — checking somebody else's code, billing, administration — never hold a key.
Two different problems. Somebody who gets into your account still cannot produce your codes: the secrets are sealed to keys your devices hold, and setting up a new device needs your recovery words. Somebody holding your unlocked phone can read your codes for as long as they hold it — the same as any credential kept on a device. The damage stays local, though: secrets sit in the phone's secure storage behind biometrics, there is no central store of codes anywhere, and only your own connections are affected. If it happens, get the phone locked or wiped, and tell your contacts to distrust codes from you until you confirm you have it back.
Three words from a list of 2048 is about 8.6 billion combinations. With 100 connections the chance of two matching at the same time is below 0.001%. If it does happen, searching a code shows you everyone it matches instead of guessing, and the public check refuses an ambiguous code rather than naming the wrong person. Nothing is broken — you pick the right name.
Codes follow fixed time windows, so both phones need roughly the same time — which they normally take from the network. The app also checks the window before the current one, so a code read moments after it changed still matches. A badly wrong clock will make codes disagree; letting the phone set its time automatically fixes it.
Not today. The part a large quantum computer would eventually threaten is the key exchange that seals your secrets, and machines able to do that do not exist — the estimates run to a decade or more. We are following the post-quantum standards and will move before it matters. Turning a secret into three words does not depend on that kind of mathematics at all, so that half is unaffected either way.
Limitations & Honest Answers
What Trusted Codes cannot do is as important as what it can.
It proves that somebody is the same person you added before. It cannot tell you whether that person was honest about who they were on the day you added them. Add a fraudster who claims to be your bank, and the check will pass the next time the same fraudster calls. This is why you add people you know, and why you do it in person where you can.
The system cannot tell. A code proves who is speaking; it cannot prove they are free to speak. For anything high-stakes, agree a second signal in advance with the people who matter — a phrase that means stop, or a rule that money moves only after you call back on a number you already had.
If they also get past the biometric lock, they can read the code and impersonate your friend. A code is one check, not the only one. For anything expensive or irreversible, add a second: call back on a number you already have, ask for video, or use a phrase the two of you agreed earlier.
Yes. Once the app holds the secrets for your connections, codes are worked out on the phone — airplane mode, no signal, a basement, it makes no difference. The word lists ship inside the app. Two things do need a connection: adding a new connection, and the first arrival of a new contact's secret. Until that lands, that one contact shows as waiting to sync instead of showing a code.
Pricing
Yes, and it stays free. A free account gives you 10 connections of your own, up to 12 people in each, and 10 guest codes a month — enough for a family and the people around it. Everybody has their own free account, so there is nothing to share or split. We are not going to put protection from impersonation behind a price.
Yes, and you can start it yourself without talking to us. Business begins at €30 a month for up to 10 people, with a 14-day trial, and adds the desktop app, unlimited connections and guest codes, Beacons for staff who call customers, sealed messages for files and instructions, and an admin portal and API access. Larger organisations can run the whole service on their own server.
It does not need millions of connections — that is what Beacons are for. Connections are for people who already know each other. For outbound calls, a member of staff switches on a Beacon for the length of the call, and the customer checks the three words at verify.trusted.codes with no app, no account and no prior pairing. A Beacon is a live session rather than a permanent badge, so a code is only good while the call is happening, and taking away somebody's seat stops their Beacon verifying. Cost therefore follows the staff who call customers, not the size of the customer base. A bank that has to keep its own data can run the verification service on its own server, federated with the rest of the network.
Ready to protect what matters?
Set it up in a couple of minutes. Free for personal use.