Both tables below are generated from the cards themselves, so they cannot fall out of step with what the cards say.
The cards are grouped into five families: addresses, keys, money, session and files. A family is a place to look, not a claim that its members are related in any deeper way, and several shapes could sit in two families at once.
If you already know which format you are dealing with, the first table will take you to it in one step. If you do not, the second table is often the faster route, because it is phrased in terms of the question you are trying to answer rather than the name of the thing in front of you.
The shapes, family by family
One row for each card, giving the alphabet it uses and a single line on what it covers. The alphabet column is a short label; the symbol sets behind those labels are on the four alphabets. Where two rows share an alphabet they will usually differ on length, and where they share both, they will differ on structure.
The quickest way to use this table is to work down the alphabet column first and the length inside it second. Between them those two properties separate most of the shapes on the site from each other, and the ones they do not separate are precisely the pairs worth being careful about, since two formats that share an alphabet and a length can only be told apart by where their fixed characters sit.
Addresses and identifiers
| Shape | In one line | Alphabet |
|---|---|---|
| The onion address | One length, one alphabet, no punctuation inside, and a fixed suffix at the end | 56 chars, base32 |
| The sixteen character onion address | The older short form, and what meeting one says about the age of a note | 16 chars, base32 |
| A mirror link that carries a path | Scheme, host, path and query, and the one slash that separates two of them | scheme, host, path |
| A host built from lookalike characters | Confusables, and why the onion alphabet deletes most of them before anyone can use them | a narrow set, by accident |
| Percent encoding inside a link | A percent sign plus exactly two hex digits, and the shapes that hides | percent, two hex digits |
| An order reference | A shape whose rules are private, and how to read one anyway | set by the market |
| A username | Casing, punctuation, invisible characters, and two names one character apart | letters, digits, light punctuation |
| A string shaped like an email address | Local part, one at sign, a domain with a dot, and the display name trap | local part, at sign, domain |
Keys and signatures
| Shape | In one line | Alphabet |
|---|---|---|
| A PGP public key block | The marker lines, the blank line, the base64 body and the closing line, taken one at a time | base64 body, ASCII markers |
| A PGP private key block | The same container as a public key block, with the one word that changes what it holds | base64 body, ASCII markers |
| A clear signed message | Readable text between an opening marker and a signature block, with an escape rule of its own | plain text, then base64 |
| A detached signature block | A signature with no message inside it, and the filename convention that ties it to one | base64 body, short |
| A PGP encrypted block | The least specific marker in the family, shared by several unrelated kinds of payload | base64 body, any length |
| A key fingerprint | Forty hex characters, usually in ten groups of four, with several printed forms | 40 hex characters |
| A short key id and a long key id | Eight characters or sixteen, cut from the end of a forty character fingerprint | 8 or 16 hex characters |
| The checksum line at the foot of an armoured block | An equals sign and four base64 characters, alone on the line above the closing marker | equals sign plus 4 base64 |
Money
| Shape | In one line | Alphabet |
|---|---|---|
| An amount and its decimal places | Where the separator sits, how many digits follow it, and what the system keeps instead | digits, one separator |
| A Bitcoin address in the older alphabet | A mixed case run beginning 1 or 3, in the alphabet that leaves out four lookalike characters | base58, mixed case |
| A Bitcoin address in the newer alphabet | Opens bc1, stays in one case throughout, and uses a thirty two character body alphabet | bech32, one case |
| A Monero address | A fixed ninety five character run opening with 4, in the base58 alphabet | base58, 95 chars |
| A Monero subaddress and an integrated address | Three near identical strings separated by one character at the front and a total width | base58, 95 or 106 chars |
| A wallet seed phrase | A fixed count of lower case words, single spaced, every one drawn from a fixed list | words, single spaced |
| A transaction id | Sixty four hexadecimal characters in one run, with no prefix and no separators | hex, 64 chars |
| What a payment QR code carries | A square code is a container; the shape worth reading is the text a scanner returns | text, scheme first |
Session and account
| Shape | In one line | Alphabet |
|---|---|---|
| A captcha token | The short answer you type, and the opaque value that answer produces on the far side | four to eight chars, one alphabet |
| A session cookie | A name, an opaque value and a fixed vocabulary of attributes on one line | name=value, then attributes |
| A password | The one shape you never see while you type it, described through the field around it | any printable characters |
| A one time code | Six digits, sometimes eight, where the first character may be a zero that matters | digits only, 6 or 8 |
| A timestamp printed on a page | A moment written as text, complete or ambiguous depending on one trailing field | digits, separators, offset |
| A time written as a plain integer | A run of digits counting seconds, indistinguishable from any other number of that width | digits only, 10 or 13 |
| A link with a token inside it | A URL where an opaque run in the path or the query is itself the secret | URL with an opaque run |
Files and text
| Shape | In one line | Alphabet |
|---|---|---|
| A file hash | A fixed run of hex characters where the count of characters names the algorithm family | hex, 32 to 128 chars |
| A filename | A short label attached to a file by whoever made it, subject to rules that differ by system | almost any character, 255 max |
| An extension, and the second extension behind it | A name may carry many dots, and only the text after the final one is the extension | letters and digits, no fixed length |
| A line from an archive listing | One row of a printed archive index: attributes, a size, a date, and a path at the end | columns, path last |
| A quoted message block | Earlier text reproduced inside a reply, marked line by line so it reads apart from the new writing | marked lines, nested |
| A block that lost its line breaks | Text that carried structure in where its lines ended, passed through something that joined them | any text, structure lost |
| The line of metadata under an image | The small line a viewer prints beside a picture: dimensions, a size, a format and sometimes a date | integers, unit, format word |
What each correct shape leaves unsettled
The same cards again, in the same order, with a different column: the one sentence from each card naming what stays open after the format matches. Read down this table when you are deciding whether a check is worth running at all, because it tells you in advance what you will still not know when it passes.
| Shape | What a correct one still leaves open |
|---|---|
| The onion address | A correct address says nothing about who holds the matching private key. |
| The sixteen character onion address | The short form dates the note you are reading, not the motives of whoever kept it. |
| A mirror link that carries a path | A path can be laid out correctly and still land somewhere you did not intend. |
| A host built from lookalike characters | A host that survives every confusable test is still only a host somebody handed you. |
| Percent encoding inside a link | Working out which characters are hidden does not reveal where the link goes. |
| An order reference | A neat reference is still just a label that somebody typed or pasted into a field. |
| A username | Nothing inside a username carries information about the person behind the account. |
| A string shaped like an email address | The layout cannot say whether the mailbox exists or who collects what arrives there. |
| A PGP public key block | Anybody can produce one of these and put any name they like in the comment field. |
| A PGP private key block | A tidy private key block is still a private key block, and it should not have reached you. |
| A clear signed message | The readable half can be rewritten and the layout will still look exactly right. |
| A detached signature block | Nothing inside names the file it belongs to; the pairing rests on a filename. |
| A PGP encrypted block | The marker names the container, so an encrypted body and a merely compressed one look alike. |
| A key fingerprint | A fingerprint printed beside a key was put there by whoever built the page it sits on. |
| A short key id and a long key id | A short id that agrees is eight characters agreeing; the other thirty two never took part. |
| The checksum line at the foot of an armoured block | The line speaks about transport, and says nothing about who assembled the block. |
| An amount and its decimal places | A faultlessly formatted amount can still be the wrong quantity, in the wrong unit, for the wrong thing. |
| A Bitcoin address in the older alphabet | Passing the alphabet and the length says who could not have produced it by accident, never who holds it. |
| A Bitcoin address in the newer alphabet | A longer checksum catches more typing accidents and answers no question about the destination. |
| A Monero address | Ninety five correct characters establish the form of the string and nothing about its destination. |
| A Monero subaddress and an integrated address | Separating the three kinds is reliable and stops precisely at the kind; the holder stays invisible. |
| A wallet seed phrase | A phrase in perfect shape is silent about how many people have already read it. |
| A transaction id | Sixty four valid hex characters do not even establish that the string is an identifier of this kind. |
| What a payment QR code carries | A well formed payload proves the container was decoded, and says nothing about what the printing beside it claims. |
| A captcha token | A correctly shaped answer is still only a guess at what a picture said. |
| A session cookie | The value is opaque on purpose, so a well formed one carries no information at all. |
| A password | The field can accept a value in full and still store only part of it. |
| A one time code | The digits are right or wrong only relative to a clock you cannot see. |
| A timestamp printed on a page | A time is a statement made by whoever rendered the page. |
| A time written as a plain integer | Nothing in the digits says the number is a time rather than a reference. |
| A link with a token inside it | Holding the link is the whole of the claim it makes. |
| A file hash | A digest of the right length still leaves open which file, if any, it was computed from. |
| A filename | A legal name is a label somebody typed, and it constrains the bytes behind it not at all. |
| An extension, and the second extension behind it | A familiar suffix is a label chosen by hand and describes the bytes only by agreement. |
| A line from an archive listing | Every column is a header field recorded when the archive was built, not a measurement of it. |
| A quoted message block | Quoted text is typed by the person replying, so its formatting is theirs from end to end. |
| A block that lost its line breaks | A block with its breaks intact has survived a journey, which is a fact about the journey only. |
| The line of metadata under an image | Each field is read from a header, and a header is a value written by whatever produced the file. |
These lines are deliberately narrow. Each is specific to its own shape, and the general argument they are instances of is set out on what a shape proves, and where it stops.
Other ways in
Two indexes cover the routes these tables do not. If your starting point is something visibly wrong on your screen, the symptom index is filed by appearance rather than by format. If your starting point is a card you have opened and cannot follow, the anatomy page explains what each of the six sections on a card is doing.
Neither table on this page is hand written. Both are assembled from the cards at the moment the page is built, which means a card cannot appear here saying one thing and say another when you open it. It also means the tables are complete by construction: there is no card on this site that is missing from them, and no row here that leads anywhere except to a card.