How it works
PageID, in detail
How your own symbol tells real sites from fake ones, how a company gets verified, and why it can't be faked.
What you see
1. Get your symbol, once
On PageID's own site you get a random symbol (one of 512, like a green rabbit or a purple anchor) and type a short text of your own, like "Hi Anna". No app, no signup, no account: both live only in a cookie in your browser, and PageID stores nothing about you.
2. Real sites show it
On a verified company's site, the PageID pill shows your symbol, with a check mark and the company's verified name. Only PageID's own label frame can read your symbol, and your browser shows that frame only on the domains the company has verified.
3. Fake sites can't
A fake site can draw a pill that looks the same, but it doesn't know your symbol. It can only guess, and it never knows your text. Not your symbol? Leave.
In doubt? Tap the pill
Tapping the pill opens PageID's own site in a new tab. It shows the site you came from, the verified company, your symbol and your own text. A fake site can't show your text on PageID's real address, pageid.app. Try it on a-fake-site.com, a fake news site we made on purpose.
For site owners: getting verified
1. Prove your company
Enter your LEI. PageID finds your company at GLEIF, and your Concordium wallet proves your legal name, business number and country with a zero-knowledge proof from your Company ID. About ten minutes.
2. Bind your domains
Publish a DNS TXT record or a .well-known file for each domain, then register one binding record from your own company account (about 5 CCD, once).
3. Add the label
Add one script tag and the <pageid-label> element to your pages. The PageID pill then comes down at the top of the page: visitors with a PageID symbol see their own symbol and text in it at once; visitors without one are invited to get theirs.
Where you start: four situations
PageID needs an LEI and a company identity from Global FinReg (Business ID) in a Concordium wallet. Get started asks two questions and shows only the steps you need; your progress is saved in a link, no account needed.
| You have | Your steps |
|---|---|
| An LEI and the wallet | With a company identity in it (path A): add about 11 CCD, connect to PageID, verify your domains, register the binding record. About 10 minutes. Without one yet (path B): first get a company identity at Global FinReg (your LEI, a recent extract from your company register, no older than 3 months, the signatory's passport or driving licence), wait for their approval, create a company account. Then as path A. |
| An LEI, no wallet | Path C: install the Concordium Wallet (browser extension or app), then as path B. |
| The wallet, no LEI | Path D: get an LEI (ask Global FinReg whether they can include it in the Business ID application, or use any GLEIF-accredited issuer), then as path B. |
| Neither | Path E: install the wallet, get an LEI, then as path B. |
Not sure about the LEI? Choose the country your company is registered in, type its name (and, if you like, its registration number) and PageID finds it at GLEIF, the global LEI index, for companies in every country; it finds the browser wallet by itself and can check whether your account holds a company identity. A personal identity in the wallet does not work for PageID. Global FinReg does not publish its processing time or price.
Why it can't be faked
- Your symbol is random. PageID picks it for you, one of 512; you never choose it, so nobody can predict it. A fake site's guess is wrong 511 times in 512, and it never knows your text.
- Only PageID can show it. Your symbol lives in a cookie only PageID can read, and only inside PageID's own label frame. The frame refuses to show it unless every check passed.
- Only on the company's own domains. Your browser itself refuses to show the genuine label frame on any domain the company hasn't verified, also when a fake site tries to embed the real one.
- Identity from the identity provider. Legal name, business number and country come from a Concordium identity provider's proof, never from what a website says about itself.
- Bound by the company itself. The company binds its domains and keys with a record sent from its own Concordium account.
- Tap to double-check. PageID's own site shows where you came from, the company, your symbol and your own text. A click from anywhere but the genuine label is refused.
- Payment is never proof. Onboarding needs the identity proof and a transfer from the same company account. A payment alone verifies nobody.
- Nothing stored about you. The cookie is the data. PageID keeps no symbol, text or id per person.
Who it's for
- Compliance: identity as a regulated identity provider verified it; every binding is a public, auditable record; revocation and expiry built in.
- Communications: a fast way for your visitors to tell your real pages from impersonations.
- IT and security: one script tag, no backend changes; domain control by DNS TXT or .well-known; keys rotated without onboarding again.
Questions
What do we need to get started?
A company identity from Global FinReg (Business ID) with a company account in a Concordium wallet, your company's LEI, about 11 CCD on that account, and access to the DNS or web server of your domains. Missing some of it? Get started guides you through each part.
What does it cost?
For visitors, PageID is free. Onboarding costs about 11 CCD in all, paid from your own company account: the proof request (about 4.5 CCD), the onboarding transfer (about 1 CCD) and the binding record (about 5 CCD), plus small fees. The company identity itself is Global FinReg's service; they do not publish its price.
Do visitors need an app or an account?
No. They get their symbol once on pageid.app/symbol/, in the browser they use. Nothing to install, nothing to sign up for.
What does PageID see about our visitors?
Nothing that identifies them. A visitor's symbol and text live only in a cookie in their own browser; PageID keeps no list of symbols, texts or people, and its logs never contain the cookie.
Can someone copy our label onto another site?
They can copy how it looks, but not what it shows. Browsers show PageID's genuine label frame only on your verified domains, so on any other site the real label stays empty, and an imitation drawn by the fake site doesn't know the visitor's symbol. A visitor who taps it lands on PageID's own site, which refuses a click that didn't come from the genuine label.
What if a visitor uses another browser or clears cookies?
Then that browser has no symbol yet, and the label invites them to get one. A new symbol takes a few seconds, and it is always a different one.
How do we sign in to our customer page?
With the Concordium wallet that holds your company account, or with the one-time sign-in link you saved at the end of onboarding.
Why do some addresses still say "netid"?
PageID was first called NetID. The protocol keeps that name so existing integrations keep working: /.well-known/netid.json (also served as /.well-known/pageid.json) and the API paths.