Home › Guide › Genuine pages
What a genuine code page asks for
The address printed on a TV screen opens a page with a short, set list of requests: the account, the code, sometimes a consent screen. This page lists what is on that list — and, at greater length, what is not.
Because the printed address is short, the page it opens tends to be plain, and plainness is easy to imitate. The way to tell a genuine code page from a copy is not its look but its requests. Genuine pages ask for very little, in a predictable order, and they never ask for money in exchange for the code.
What follows was read on the services’ own pages and, where the address answered from a browser, on the pages themselves.
Sign-in first, code second
Most code addresses open the company’s ordinary sign-in before they show a code field. Both amazon.com/mytv and primevideo.com/mytv, opened in a browser, show Amazon’s standard Sign in or create account screen, which wants a mobile number or e-mail address; the code is asked for once the account is known. Hulu’s hulu.com/activate is a shortcut into a section of the account page (Watch Hulu on Your Devices), which naturally requires the account first. Peacock’s documentation lists the sign-in before the code. Disney+ lists the code first and the sign-in after; Google and Apple do the same. The order varies, but the two requests are the same two everywhere.
What the page asks for
- The account
A sign-in to the account the TV will be tied to: an e-mail address or phone number and a password, or a passkey, or a sign-in link sent to the inbox. Amazon’s /mytv addresses open this screen before any code field; Hulu’s address lands inside the account page; Peacock’s documentation puts the sign-in before the code.
- The code
The characters printed on the screen, in the shape the service uses. Netflix pre-fills it when the square code was scanned; Google and Apple ask for it before the sign-in; most others after.
- Consent
A screen naming the device or app being connected. Google’s is headed Connect a device. The internet standard recommends exactly this, so that a person who has been handed someone else’s code can see what they are about to agree to.
- Sometimes: an account to create
Roku, Amazon and the video services all allow a new account to be created at the code address. Roku says a payment method may be requested when a Roku account is created, to be charged only if a purchase follows; Amazon says the same of its default payment method, added later for apps and games. Both requests sit inside account creation on the company’s own domain and are not the price of the code.
- Sometimes: a provider
On a broadcaster’s or cable app the page asks which television provider the viewer subscribes through, and then passes the viewer to that provider’s sign-in page. NBC’s apps do this at nbc.com/activate; Xfinity’s at xfinity.com/authorize with a six-digit code.
After the code: what changes
A code, once accepted, leaves a trace that the viewer can read. Every service in this guide keeps a list of signed-in devices inside the account — Hulu’s under Watch Hulu on Your Devices with the date each was activated and a Remove choice beside it; Google’s in the account’s security section; Netflix’s under devices and access. Hulu goes further: each activation produces an e-mail to the account giving the type of device, the town or region, and the time.
Those lists are the answer to the question a code page cannot answer by itself: did that work, and was it mine? An unfamiliar device on the list is removed and the password changed — Hulu’s own page says so — and Disney’s account settings offer a sign-out from every device at once.
What the page never asks for
This is the longer list, and the one that matters most to the readers this guide is written for.
- A fee for the code
In Roku’s words, no money has ever been charged to activate one of its devices, and a Roku account costs nothing. No service in this guide charges for entering a code; subscriptions are bought inside accounts, and a link or a code is never itself a purchase.
- A card ‘to verify’
A card field beside the code field is not something any genuine page in this guide shows. Where a payment method is asked for at all, it is during account creation and is charged only for later purchases.
- Remote access
No service asks to take control of a phone or computer to enter a code. Consumer-protection guidance from the FTC names a request for remote access, together with payment by gift card, wire or cryptocurrency, as the marks of a fraud.
- A telephone number
The genuine pages have a field and a button. None prints a number to ring. Roku’s warning says impostor sites supply fake numbers, and the FTC notes that legitimate companies do not make first contact by telephone about a device problem.
- Software
Nothing is put on the phone or computer to enter a code; the page is an ordinary web page on the service’s domain.
- Someone else’s code
A code passed on by telephone, e-mail or message was printed on a stranger’s screen, and entering it connects that stranger’s device to the viewer’s account.
Search results and advertisements are not verification
Roku’s warning to its own customers includes a sentence worth repeating in substance: impostor pages can appear at the top of search results because their operators pay for advertising there. A result’s position says nothing about its owner. The printed address on the screen is the only instruction the viewer has been given, and typing it — rather than searching for it — is what takes the viewer to the company that printed it.
When a search is unavoidable, the thing to read is the name just before the top-level domain in the result’s address. The guide page on reading the address shows how.