Digital certificates explained: from paper to PDF to verifiable record

A quick note on words first. This article is about certificates of achievement: course completion, participation, training and awards. In IT, "digital certificate" can also mean an SSL/TLS certificate that secures a website. In India it can also mean a Digital Signature Certificate (DSC), which is used to sign documents for e-filing. Those are different things, and they are not covered here.

What is a digital certificate?

A digital certificate is an electronic record that a person completed a course, attended an event or earned an award, issued by the organisation responsible. It usually comes as a designed PDF or image that the recipient can download, print or share.

That definition covers two very different things. One is a picture of a certificate. The other is a certificate that can prove itself. The difference is in what sits behind the file.

Paper, PDF and verifiable record: what is the difference?

Paper certificates

The proof is physical: thick paper, a printed letterhead, a wet signature, sometimes an embossed seal. These are hard to copy well, but the only way to check one is to contact the issuer, and a lost original is gone.

PDF and image certificates

Most "digital certificates" today are this kind: a paper design exported as a file. They are fast and cheap to send. They also carry no proof at all. The logo, signature and seal are pixels, and anyone with a PDF editor can change the name or the date.

Verifiable digital certificates

Here the file is only the visible part. The issuer keeps a record of every certificate, and the file points to it, usually through a QR code and a short link. Anyone can open the record and compare it with the copy in front of them.

What makes a digital certificate verifiable?

A verifiable certificate has seven parts. Some you see on the PDF, some live in the record behind it.

1. An issuer you can identify. The organisation's name, and ideally a verification page on a domain people recognise.
2. A unique certificate ID. Printed on the certificate and built into the QR code.
3. The record. The recipient's name, the programme, the date, and any grade or hours that appear on the certificate.
4. An integrity check. A signature over the record, so an edited detail stands out.
5. A status. Valid or revoked, so a withdrawn certificate is not mistaken for a live one.
6. A public verification page. Open to anyone with the link, with no account and no app.
7. Permanence. The page has to outlive the event, the course and the issuer's subscription. A certificate is often checked years after it was issued.

How does a signature catch an edited certificate?

When Saandru issues a certificate, it calculates a signature over the certificate's details using HMAC-SHA256 and a secret key that stays on Saandru's servers. Change any detail, even a single letter of the name, and the signature no longer matches. Because the key never leaves the server, nobody can calculate a valid signature for altered details.

That also tells you where the check happens: on Saandru's verification page. The person verifying is trusting the page they land on, which is why the address in the browser matters. Our QR verification guide covers how to make sure verifiers are on the real page.

This is a different design from a public-key signature embedded in a PDF, which can be checked offline with the right software. For certificates that people check by pointing a phone at them, an online record works better. It also means a revoked certificate stops showing as valid the moment you revoke it.

What about digital badges and Open Badges?

Digital badges are small images with machine-readable details attached, often following the Open Badges standard. Platforms such as Credly and Accredible use them, and they suit skills frameworks and people who collect badges in a wallet.

Saandru focuses on the certificate as most institutions and recipients know it: a designed document they can print, frame or attach to an application, backed by a verification page. If your programme needs Open Badges specifically, a badge platform is the better fit.

Are digital certificates accepted?

That depends on who is asking. Many employers and institutions now accept a verification link, and a QR code on a certificate saves them a phone call. Some processes still ask for a printed or attested copy. A Saandru certificate covers both: print the PDF and the QR code still works, so the printed copy can be checked the same way.

A checklist for issuing digital certificates

• Every certificate has its own ID, printed in text as well as in the QR code.
• The QR code opens a page on a domain you or your recipients recognise.
• The verification page shows the issuer, recipient, programme, date and status, and nothing private.
• You can revoke a certificate, and a revoked one says so.
• The pages stay live even if you change plans or stop issuing.
• The PDF looks right when printed, and the QR code scans from paper.

Frequently asked questions