Checking a mod before you install it
A badge is an image. Anyone can copy an image. Here is how to tell a real certificate from a screenshot of one.
Click the badge
A genuine badge is a link. Clicking it lands you on https://backprobe.org/verify/ followed by the certificate number. If the badge is not clickable, or it goes anywhere else, it is decoration, not evidence.
Check the address bar
The verification page must be served from backprobe.org. Lookalike domains are the most common way this gets faked. We will never ask you to verify a certificate on a publisher's own site.
Compare the hash
This is the step that actually proves something. The verification page lists a SHA-256 for the exact file that was reviewed. Hash the file you downloaded and compare:
Windows certutil -hashfile yourmod.jar SHA256
macOS shasum -a 256 yourmod.jar
Linux sha256sum yourmod.jarIf the hashes differ, the file you have is not the file we reviewed, even if the certificate itself is real. Do not install it.
Scan the QR code
Certificates carry a QR code that resolves to the same verification page. Any camera app will read it. Check where it actually takes you before trusting it.
When something is wrong
File a report. If a project is displaying a badge with no certificate behind it, we want to know. That is the whole point of the register existing.
What the states mean
Reviewed and in good standing. Compare the hash before installing.
Was reviewed, but the certificate has lapsed. The result is no longer current.
Withdrawn. Do not install this build on the strength of the badge.