QR code certificate verification: how it works and 10 best practices

How does QR code certificate verification work?

1. At issue, the platform creates a record for the certificate with a unique ID and a signature over its details.
2. The QR code printed on the certificate holds a link to that record's verification page, with the certificate ID in it.
3. The verifier scans it with an ordinary phone camera, and the page opens in the browser.
4. The page looks up the record, checks the signature and the status, and shows the result.

The QR code itself proves nothing. It is a link, and anyone can make one. The proof is the signed record on the page it opens. Everything below follows from that.

What should a verification page show?

A verifier wants one answer quickly: is this certificate genuine? A good page gives it at a glance, then shows the details to compare with the copy in hand.

• A clear verified or not-verified result, in words and colour.
• The issuer's name, and their logo where possible.
• The recipient's name, exactly as issued.
• The programme, course or event, and the issue date.
• The certificate ID, so it can be matched to the printed one.
• The status: valid, or revoked by the issuer.

What it should not show is anything private: phone numbers, dates of birth, addresses or marks the recipient did not choose to share. The page is public by design.

10 best practices for QR code verification

1. Put the QR code where people expect it

A bottom corner works best, clear of signatures, seals and borders. Verifiers look there first, and it keeps the design balanced.

2. Print it large enough, with a clear margin

Aim for at least about 2 cm square on an A4 certificate, and larger if it will be scanned from a projector or a screen across a room. Leave a clear margin around it: the QR standard calls for a quiet zone at least four modules wide, where a module is one of the small squares.

3. Keep the contrast high

Dark squares on a light background scan most reliably. Avoid placing the code over a pattern, a photo or a gradient, and avoid inverted colours.

4. Print the certificate ID next to it

If the QR code is damaged or the camera struggles, a verifier can type the ID or the short link instead. Use a typeface that keeps 0 and O, 1 and I clearly apart.

5. Use a domain people recognise

A verifier trusts the page they land on, so it should sit on a domain that clearly belongs to the issuer or their certificate platform. On Saandru's Growth plan, verification pages can sit on your own domain.

6. Put only a link in the QR code

Do not encode the recipient's details in the code itself. A link to the record keeps personal data off the paper and lets you correct or revoke the record later.

7. Keep verification permanent

Certificates are checked years after they are issued, often when the recipient applies for a job. If the page disappears when an issuer changes software or stops paying, every certificate becomes unverifiable at once. Saandru keeps verification pages live permanently, on every plan.

8. Show revocation instead of deleting

When a certificate was issued in error, revoke it rather than deleting it. A page that says "revoked by the issuer" tells the verifier exactly what happened. A missing page just looks broken.

9. Test before you send

Print one certificate and scan it from paper. Scan it again from a phone screen, in poor light and from a little further away. Check that the page shows the right name and the right status.

10. Teach verifiers to check the address bar

Fraud with QR codes, sometimes called "quishing", works by pointing a code at a lookalike page. Tell recipients and the people who check their certificates which domain the real page lives on. For Saandru certificates it is certificon.gemscorp.app, or the issuer's own domain on Growth.

What if a QR code will not scan?

• Wipe the camera lens and add light, without glare on glossy paper.
• Hold the phone steady and move it closer or further until the code fills most of the frame.
• Flatten creased paper.
• Type the certificate ID or short link printed beside the code.

If several people report problems, the code is probably too small or too close to the design. Make it larger in the template and reissue.

How does Saandru handle QR verification?

• Every certificate on every plan, including Free, gets a unique ID and a QR code.
• Each record is signed with HMAC-SHA256, so an edited copy shows up as a mismatch.
• The verification page shows the issuer, recipient, date and status, with no account or app needed.
• Revoked certificates say so on their page, and every revoke is in the audit trail.
• Pages stay live permanently, including after you cancel.
• The QR code is a field in the designer, so you can place and size it on every template.

To see the whole idea in one place, try the tamper check on our home page: edit the name on a sample certificate and watch the verification fail.

Frequently asked questions