Checking a certificate's authenticity: how the QR code works

The QR code on a certificate is nothing more than a link in machine-readable form. It leads to a page of the issuer and contains a verification code that identifies this one credential. The page reads the code, looks up the credential in the issuer's data and shows the result: valid, expired, revoked or unknown.

For this to be secure, the code must be random and long enough that nobody can guess it. Sequential numbers such as "certificate 1234" are unsuitable, because counting up would reveal other people's credentials. Good verification pages also show only the data needed for the check — name, title, date, issuer, validity — not the whole file.

For HR departments and other verifiers, a smartphone is usually enough. The following steps protect against the most common deceptions.

Most forgeries are simple: an edited PDF, a swapped name, a changed grade. Comparison with the verification page reliably exposes them, because the data are held by the issuer, not in the document. More sophisticated forgeries use a QR code leading to a copycat verification page. That is why checking the address matters so much.

A QR code is only as good as the page behind it. Issuers should run the verification page under their own, well-known domain, use unguessable codes and show clear results — including for unknown and revoked codes, without technical error messages. The page must remain available long-term; a credential that cannot be verified in five years loses its value.

Better still is combining it with a signed digital credential under W3C Verifiable Credentials. Then authenticity does not depend on the verification page alone: the credential can also be checked cryptographically. And revocation via a status list is visible without the issuer learning who is checking.

A public verification page discloses personal data — to anyone who has the code. That is intended, because the holder passes the code on themselves. Data minimisation under Article 5(1)(c) GDPR still applies: the page should show only what is needed for the check. Grades, dates of birth or addresses belong there only if they are part of the credential and the holder has been informed of their publication.

Issuers should also decide how long verification pages remain online and let holders end public verifiability unless legitimate reasons stand against it.

QR verification proves that the issuer knows a credential with these details. It does not prove that the person presenting the document is the person it was issued to. For important decisions — such as hiring into a regulated profession — a comparison with an ID document is therefore part of the process.

The content of a credential also says only as much as the issuer checks. A genuine certificate from a dubious provider remains weak evidence. Anyone assessing credentials should look not only at authenticity but at the issuer, the type of assessment and the learning outcomes described.