How we verify
A public number has to be able to explain itself
This isn't a promise of trust — it's the exact list of mechanisms running in this product today, with what each one stops and what it doesn't. None of this accuses anyone in public: it lowers an internal trust score, and below a threshold that startup drops out of the rankings without its profile ever hiding its real numbers.
Every project has a real owner
Creating a HowManyUsers account goes through Google — no anonymous signup, no throwaway email. This does NOT prove a project's numbers are real: the mechanisms below do that. It proves there's an identifiable person behind every account, and nobody competes in the rankings hidden behind an empty form.
Only the owner can create users
Two keys, two permissions. The public one lives in anyone's browser — with it, nobody can create or delete a user. Only the secret key, which never leaves your server, can do that. So if a number gets inflated, it can only be the project's own owner — never a third party.
Every person counts once
The same user sent twice, ten times, or a thousand times still counts once. It's not a business rule you can route around: it's a unique index in the database — resending the same signup doesn't duplicate anything, even if the integration is broken and keeps retrying.
Dates that don't add up get dropped
A signup dated in the future, or sent as if it happened more than ten years ago, gets rejected on the spot — it's the simplest way to fabricate a growth curve that never happened, and it never even gets saved.
A burst gets flagged
More than 200 new signups in 10 minutes for the same project isn't rejected — a real startup can have a real spike — but it does get flagged. No integration this size needs that pace from real people.
Cohorts that never come back, too
A thousand users created and never seen again — no session, no activation, ever — get compared against the project's own history, never against a fixed number. If that same startup DOES have real users who come back in other cohorts, one that never does stands out.
The seal: three days of data, held
Everyone competes from minute one: making a startup wait three days never stopped anyone who wanted to inflate, it only punished the ones who showed up. Those three days are now the seal, earned by sending data we watch arrive — a declared import doesn't count toward it, and the seal is lost if the data stops.
Trust goes down; it never accuses in public
Every suspicious signal costs points off an internal score, never in view of anyone. Below the threshold, that startup drops out of the rankings — but its profile keeps showing its real numbers. Nobody gets called a cheater automatically: someone on our side reviews the evidence before anything is final.
Verification is earned, not granted
Four levels, and each one describes exactly one checkable fact — none of them says "these users are real people", because we can't check that, and saying it would be faking verification.
The signals on a profile
Each badge on a public profile states one checkable fact, with a fixed threshold — never a score we invented. "10,000+ verified users" means we counted at least that many ourselves, imported ones excluded. "90 days verified" means we've been receiving data that long. "Fast growing" is +20% or more in 30 days, and only above 25 counted users — without that floor, going from 2 to 6 users would be the loudest badge on the site. "Consistent growth" is 6 or more of the last 9 weeks closing higher than the one before. "Accelerating" means this week's pace, projected to 30 days, is above the last 30. If a threshold isn't met, nothing is said — we never publish a negative signal about a startup.
Check it without us
Everything on a public profile is also a public endpoint: no key, no account. Call it for any startup on the board and compare it with whatever it claims elsewhere — that's the whole point of the scoreboard being ours and the data being theirs.
curl https://howmanyusers.wtf/api/v1/verify/<slug>Every public startup also has a page that puts that evidence together: howmanyusers.wtf/<lang>/s/<slug>/proof
What this doesn't solve, said plainly
A startup running its own server can fabricate believable, sustained signups over weeks, carefully. There's no purely automatic check against that — only external verification, which doesn't exist for this product yet. What these mechanisms do achieve is making inflating a number expensive and slow, never free or instant.