Anyone can deploy a token, call it AAPL, and give it the right name and the right number of decimals. Nothing stops them, because the chain treats a symbol as a label rather than as an identity.
The contract address is the identity.
The one thing to check
Every token lives at exactly one address on exactly one chain. An address matching the issuer's published address means you are looking at the issuer's token. An address that does not match makes everything else about the token beside the point.
You can check an address on a public block explorer, with no account and no signature of any kind. Reading a chain is free and anonymous, which is the property that makes this check available to everybody.
What we publish, and how to use it
Every contract address we track has a page at /verify/<chain>/<address>, reachable
from the address itself anywhere it appears on this site. Those pages are built from
our own registry ahead of time. An address we do not have does not resolve, which is
deliberate: a page that would take any address you handed it and present it as
checked would be a tool for laundering a fake through a domain you trust.
The full list is at /developers/contracts, and each stock page carries the addresses for that stock's tokens.
Do not stop at us. Cross-check against the issuer's own published list. We are a third party, and a third party is one more thing that can be wrong or compromised. Two independent sources agreeing is the standard worth holding to.
How the deeper check works
For most EVM tokens the issuers we track deploy behind a proxy with a beacon, and the beacon points at an implementation contract. Comparing the beacon and implementation against the issuer's known ones is a stronger test than comparing an address alone, because a lookalike can copy a symbol but cannot get itself pointed at by the issuer's beacon.
Some issuers also keep an allowlist contract that answers whether a given address is one of theirs. That is a second independent test, and a copy cannot add itself to it.
Not every token supports either test. Solana tokens are Token-2022 mints with no proxy at all, so there is no beacon to compare and the check falls back to matching the mint address against the issuer's list. A chain where a beacon test does not exist is a different situation from a token that fails one, so we say which test applies where.
The rule that protects you from all of this
No legitimate token check ever asks you to connect a wallet.
Verifying an address is reading public data. It cannot require a signature, because there is nothing to authorise. Any page that responds to "is this token real" by asking you to connect a wallet, approve a transaction, or type a recovery phrase is attempting something other than what it says.
This site never asks you to sign in or use your wallet, and that promise is on every page for exactly this reason: it is what makes a clone of this site obvious to someone who reads here regularly. If a page that looks like this one asks you to connect anything, it is not us.
The short version
The address identifies a token and the symbol does not. Cross-check the address against the issuer's own list, on a block explorer, without connecting a wallet to anything.
How to buy covers the practical routes, and the glossary defines contract address, block explorer and wallet.