How to verify a Cardano token's policy ID

The identifier

What is a policy ID, exactly?

Cardano tokens are native: the ledger tracks them directly, with no token contract in between. An asset is identified by an asset ID, which Cardano's documentation defines as a pair, the policy ID and the asset name. Tokens sharing an asset ID are interchangeable with each other and nothing else, however similar they look (docs.cardano.org, checked September 11, 2026).

A minting policy is the set of rules deciding when tokens under it may be minted or burned: a required signature, a range of slots, or a Plutus script. The policy ID is that policy hashed, which is why it always renders as 56 hexadecimal characters and cannot be crafted to match someone else's. The asset name is the second half, an immutable label separating assets minted under the same policy. An asset can never move to a different policy, so a policy ID is not a label attached to a token but a permanent fact about how it was created. As a worked example, $CATSKY's policy ID is 9b426921a21f54600711da0be1a12b026703a9bd8eb9848d08c9d921copy and its asset name is the word CATSKY in hex, 434154534b59.

Fingerprints

What is an asset fingerprint, and how is it different?

The shorter string beginning with asset1 beside a token is the asset fingerprint from CIP-14. It is not a third identifier but a compressed form of the two you have: the specification concatenates the policy ID with the asset name, runs a blake2b hash with a 20-byte digest, and encodes the result in bech32 under the prefix asset (CIP-14, checked September 11, 2026).

Because the asset name goes into the hash, a fingerprint pins down the exact asset rather than the policy alone, and it is far easier to eyeball. The trade-off is that you cannot read the policy ID back out of it, so most projects publish the ID and let explorers show the fingerprint. Either is a valid check. Comparing a name or a ticker is not.

Sources of truth

Where does the real policy ID live?

1. The project's own site or documentation, reached by typing the domain yourself or using a bookmark, never through a search advert or a link someone sent you.
2. The Cardano Token Registry, a public repository maintained by the Cardano Foundation where a project submits a pull request mapping its subject, the hex policy ID followed by the hex asset name, to a name, description, ticker, URL, logo and decimals (cardano-token-registry, checked September 11, 2026).
3. An explorer such as Cardanoscan, which is the chain itself rather than a claim about it: mint date, supply, holders, minting policy.

Two things are not sources. An exchange search box is not, because listing is permissionless: Minswap's documentation says anyone can list a token by creating a pool with ada and that token, with verification a separate optional step afterwards (docs.minswap.org, checked September 11, 2026). A search result proves a pool exists, nothing more. Nor is any message that arrives unasked. Wallet teams say the same: unsolicited contact of any kind is a common first step in a scheme that ends in a loss, and a recovery phrase should never be shared with anyone (lace.io, checked September 11, 2026).

On the explorer

How do I check a token on Cardanoscan, step by step?

1. Open the token page. Paste the policy ID or the fingerprint into the Cardanoscan search. The page lists the policy ID, the fingerprint, the asset name and the total supply, with tabs for transactions, mint transactions and top holders. For the example above, that page is cardanoscan.io/token/9b42...534b59.
2. Compare the ID, do not skim it. A fake built to fool you matches at both ends and differs in the middle.
3. Read the mint history. The mint transactions tab shows every event that created or destroyed supply. A token claiming a 2023 launch that first minted last week is not that token.
4. Look at the holder count. A handful of addresses behind a story about a large community tells you something.
5. Check whether the policy can still mint, covered next, and the step most people skip.

For inputs, outputs, fees and metadata, see the Cardanoscan transaction guide.

Open policies

What does an open minting policy mean?

A policy states its rules as signature requirements, a slot range, or a Plutus script. The slot-range form is what people mean by time-locked: the policy forbids minting after a given slot, so once that slot passes nobody, including the original minter, can add to the supply (docs.cardano.org, checked September 11, 2026).

A policy with no such bound is open. Whoever holds the signing key can mint more of the same asset at any time, and those tokens carry the same policy ID, so no amount of ID-checking distinguishes them. Open is not automatically wrong, since a project minting in stages or updating CIP-68 metadata needs it. It is simply a fact to know first: a supply figure under an open policy is a snapshot, not a cap.

The playbook

How do the fakes actually work?

Same ticker, same logo, different policy. Cardano's documentation uses this as a teaching example: a policy it calls FAKERushConcert mints assets named Tickets and VIPTickets that are not interchangeable with the real ones, because they sit under a different policy (docs.cardano.org, checked September 11, 2026). On an exchange the fake pool looks convincing, with liquidity and a chart, because a pool is just two assets someone deposited.

Tokens that arrive on their own. Anyone can send anything to a public address, so unwanted tokens turn up in wallets, usually named to be read: a promise, a figure, a domain. The token does nothing; the payload is the site it sends you to. Ignore it, hide it, never claim it. Removing it is awkward: every output carrying a token also carries a minimum amount of ada (docs.cardano.org, checked September 11, 2026).

Sites that ask you to sign to "verify" or "unlock". Know what the requests mean. Under CIP-30, connecting a wallet gives a site read access to your addresses, balance and UTxOs, and signing data produces a signature over a message; signing a transaction is the one that moves value, and the wallet shows you what it does (CIP-30, checked September 11, 2026). Read the wallet prompt rather than the page behind it. A verification step that needs a transaction signature is not a verification step, and nothing legitimate needs your recovery phrase.

Badges

How does a wallet decide a token is "verified"?

Two mechanisms, neither a verdict on the project. Off-chain, wallets and explorers query the Cardano Token Registry, the Foundation's implementation of CIP-26, by subject to get a name, ticker, decimals and logo (CIP-26, checked September 11, 2026). Registration is optional, and the Foundation's terms say approval is a technical measure that does not include verification, endorsement or confirmation, and that entries may be deleted at any time (Registry Terms of Use, checked September 11, 2026).

On-chain, CIP-25 puts a record under metadata label 721 in the minting transaction, keyed by policy ID then asset name, which a later mint of the same asset replaces, something only an open policy allows (CIP-25, checked September 11, 2026). CIP-68 instead keeps metadata in a datum on a reference token, using asset-name label prefixes such as 100 and 333, so scripts can read it (CIP-68, checked September 11, 2026). Lace puts the limit plainly in its own guide: the wallet highlights verified tokens to reduce risk, and you should still double-check policy IDs (lace.io, checked September 11, 2026).

The short version

What are the three checks?

Run all three before a first swap, then run the first again on the token that actually landed in your wallet. The Minswap swap guide folds this into the buying steps. None of this is financial advice, and none of it says whether a project is worth your time; it tells you only which token you are holding.

Related: all guides · how to swap on Minswap · read a transaction on Cardanoscan · Cardano meme coins and their policy IDs