What Is a Warrant Canary and How to Verify One with GPG

Short answer: A warrant canary is a regularly renewed, signed statement in which a service says it has not received certain secret legal demands, such as gag-ordered subpoenas or national security letters. If the statement stops being renewed or its wording changes, readers treat that silence as a warning. You verify one by checking its PGP signature against the publisher's key fingerprint and confirming the signature date is recent.

This article covers the legal idea behind canaries, their real limits, what a good canary contains, and a step-by-step GPG verification using the NoctisNode canary as a worked example.

How a warrant canary works

The name comes from the canaries miners once carried underground: as long as the bird was alive, the air was safe. A warrant canary works the same way. The service publishes a dated statement such as 'we have not received any secret court orders or gag orders' and renews it on a fixed schedule.

The legal idea, which originated mainly in the United States, rests on a distinction: authorities may be able to forbid a company from disclosing that it received a secret order, but compelling the company to publish a false statement is a different and more difficult demand. If the company simply stops renewing the canary, it has not disclosed anything, yet readers can draw their own conclusions from the absence.

Limits of warrant canaries

A canary is a useful signal, not a guarantee. Keep these limits in mind before relying on one.

• ▹The legal theory is largely untested in court, and the answer can differ between countries.
• ▹It only covers what it explicitly lists. A canary about secret orders says nothing about ordinary, public legal requests.
• ▹A lapse is ambiguous: it can mean a legal demand, or simply that the person responsible was away or made a mistake.
• ▹It cannot tell you what was requested, when, or which customers were affected.
• ▹It says nothing about what data exists. Pair it with a clear logging policy; see [no-logs VPS explained](/blog/no-logs-vps-explained).
• ▹It is only as trustworthy as the signing key and the people who hold it.

What a good warrant canary contains

The NoctisNode warrant canary

NoctisNode publishes a PGP-signed plain-text canary at `/canary.txt`, with the signing public key at `/canary-pubkey.asc` and an explanation on the warrant canary page. The canary is renewed by hand every month. If it has not been renewed for more than 35 days, treat that as a signal.

The signing key fingerprint is `3804 DA83 956F B4C1 1D87 36C3 129C E677 8F20 92E9`. Always compare the full fingerprint, never just the last 8 or 16 characters.

How to verify a warrant canary step by step

These commands work on Debian 12/13 and Ubuntu 24.04. Install the tools first with `sudo apt install gnupg curl` if they are missing. For extra privacy you can fetch the files over Tor with `torsocks curl` after installing the `tor` and `torsocks` packages.

1. 01.Compare the fingerprint printed in steps 2 and 4 with the one published on the canary page and in this article. If any character differs, stop: you have the wrong key.
2. 02.In the output of `gpg --verify`, look for `Good signature from`. A `BAD signature` line means the text was altered or the file is damaged, so do not trust it.
3. 03.A line saying `WARNING: This key is not certified with a trusted signature!` is normal if you have not signed the key yourself. The fingerprint check in step 1 is what establishes trust.
4. 04.Check the `Signature made` date and the date written inside the canary text. Both should be recent.
5. 05.If the signature is more than 35 days old, treat it as a signal and read the canary page for any announcement.

# 1. Download the canary and the public key
curl -fsSLO https://noctisnode.com/canary.txt
curl -fsSLO https://noctisnode.com/canary-pubkey.asc

# 2. Inspect the key without importing it
gpg --show-keys --with-fingerprint canary-pubkey.asc

# 3. Import the key
gpg --import canary-pubkey.asc

# 4. Confirm the fingerprint of the imported key
gpg --fingerprint 3804DA83956FB4C11D8736C3129CE6778F2092E9

# 5. Verify the signature on the canary
gpg --verify canary.txt

Automating the 35-day check

If you monitor the canary from a server or a cron job, use GPG's machine-readable status output instead of parsing human text. The script below fails if the signature is missing, comes from a different key, or is older than 35 days. Run it in the directory that contains a freshly downloaded `canary.txt`.

#!/bin/sh
FPR=3804DA83956FB4C11D8736C3129CE6778F2092E9
line=$(gpg --status-fd 1 --verify canary.txt 2>/dev/null | grep ' VALIDSIG ')
case "$line" in
  *"$FPR"*) ;;
  *) echo "FAIL: no valid signature from $FPR"; exit 1 ;;
esac
ts=$(echo "$line" | awk '{print $5}')
age=$(( ( $(date +%s) - ts ) / 86400 ))
echo "Canary signature is $age days old"
[ "$age" -le 35 ] || { echo "WARNING: older than 35 days"; exit 2; }

Note · A lapse is a signal to investigate, not proof of a legal demand. Check the canary page and the operator's announcements, and keep your own archived copies of previous canaries for comparison.

FAQ