diff --git a/platform/windows/scripts/common.ps1 b/platform/windows/scripts/common.ps1
index fa25a33..09e6ec7 100644
--- a/platform/windows/scripts/common.ps1
+++ b/platform/windows/scripts/common.ps1
@@ -34,7 +34,7 @@ function Get-VeraeTargetUser {
 function Get-MaskedToken([string]$t) {
   if (-not $t) { return "" }
   $t = $t.Trim()
-  if ($t.Length -le 12) { return ($t.Substring(0, [Math]::Min(4, $t.Length)) + "...") }
+  if ($t.Length -le 12) { return "***" }
   return ($t.Substring(0, 7) + "..." + $t.Substring($t.Length - 4))
 }
 
diff --git a/platform/windows/scripts/user-token.ps1 b/platform/windows/scripts/user-token.ps1
index 25eeefc..2009865 100644
--- a/platform/windows/scripts/user-token.ps1
+++ b/platform/windows/scripts/user-token.ps1
@@ -13,8 +13,27 @@ $ErrorActionPreference = "Continue"
 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
 $ValidateUrl = "https://zap.verae.ai/v1/status"   # documented as free; 401 = bad key
 
-function Test-VeraeKey([string]$tok) {
+# Prefer the Go validator (verae-print.exe validate-key): PowerShell 5.1's
+# Invoke-WebRequest was seen timing out on nimo (proxy auto-detect) while Go and
+# curl answered in <1 s. The key is read from a file and never on a command line.
+function Find-VeraeExe {
+  foreach ($c in @((Join-Path $PSScriptRoot "verae-print.exe"), (Join-Path (Split-Path -Parent $PSScriptRoot) "bin\verae-print.exe"))) {
+    if (Test-Path $c) { return $c }
+  }
+  return $null
+}
+function Test-VeraeKey([string]$tok, [string]$file) {
   if ($tok -notmatch '^(xVerae-|key-)\S{8,}$') { return @{ result = "badformat"; detail = "must start with xVerae- (or legacy key-)" } }
+  $exe = Find-VeraeExe
+  if ($exe -and $file -and (Test-Path $file)) {
+    $ini = Join-Path $env:TEMP ("verae-val-" + [guid]::NewGuid().ToString("N") + ".ini")
+    try {
+      & $exe validate-key --token-file $file --out $ini 2>&1 | Out-Null
+      $kv = @{}
+      if (Test-Path $ini) { Get-Content $ini | ForEach-Object { if ($_ -match '^([^=\[]+)=(.*)$') { $kv[$Matches[1]] = $Matches[2] } } }
+      if ($kv.result) { return @{ result = $kv.result; detail = $kv.detail } }
+    } finally { Remove-Item $ini -ErrorAction SilentlyContinue }
+  }
   try {
     $r = Invoke-WebRequest -UseBasicParsing -TimeoutSec 10 -Uri $ValidateUrl -Headers @{ "x-api-key" = $tok }
     return @{ result = "valid"; detail = "HTTP $($r.StatusCode)" }
@@ -37,7 +56,7 @@ switch ($Mode) {
     if (Test-Path $tokPath) { $existing = (Get-Content $tokPath -Raw -ErrorAction SilentlyContinue) }
     if ($existing) { $existing = $existing.Trim() }
     $v = @{ result = "none"; detail = "" }
-    if ($existing) { $v = Test-VeraeKey $existing }
+    if ($existing) { $v = Test-VeraeKey $existing $tokPath }
     Write-Host "existing key: $([bool]$existing) $(Get-MaskedToken $existing) check=$($v.result) $($v.detail)"
     Write-VeraeIni $IniOut "token" ([ordered]@{
       account = $u.Account; sid = $u.Sid; profile = $u.Profile; source = $u.Source; path = $tokPath
@@ -46,7 +65,7 @@ switch ($Mode) {
   }
   "validate" {
     $tok = (Get-Content $TokenFile -Raw).Trim()
-    $v = Test-VeraeKey $tok
+    $v = Test-VeraeKey $tok $TokenFile
     Write-Host "validate $(Get-MaskedToken $tok): $($v.result) $($v.detail)"
     Write-VeraeIni $IniOut "validate" ([ordered]@{ result = $v.result; detail = $v.detail; masked = (Get-MaskedToken $tok) })
   }