Tamper-proof certificates with QR codes: how signed records stop forgery

Why are ordinary certificates easy to fake?

A paper certificate can be scanned and reprinted. A PDF can be opened in an editor and given a new name, a better grade or a new date in under a minute. In both cases the result looks as real as the original, because nothing about the file or the paper records what the original said.

That leaves the person checking with two poor choices: trust it, or write to the issuer and wait. Most trust it, and the cost lands on honest recipients when a fake is later found and every certificate from that issuer is doubted.

How does a tamper-proof QR certificate work?

1. The issuer creates a record for each certificate with the recipient's name, the programme, the issue date and a unique certificate ID.
2. The record is signed. Saandru signs it with HMAC-SHA256, a method that uses a secret key held by the platform. Changing any signed detail breaks the signature.
3. A QR code is added to the PDF. It holds a link to the record's public verification page, with the certificate ID in it.
4. Anyone can scan it. The page looks up the record, checks the signature and the status, and shows the issuer, recipient, date and whether the certificate is still valid.

The PDF is only a copy. The record on the issuer's side is the source of truth, and that is what makes it hard to forge.

What happens when someone edits one?

Take a certificate issued to Ananya Raghavan for a 120-hour programme in Full-Stack Web Development. Someone edits the PDF and changes the name to their own.

• The edited PDF looks genuine and still carries the QR code and ID SAA-2026-004182.
• An employer scans the code. The verification page opens and shows the name that was signed: Ananya Raghavan.
• The name on the PDF does not match the name on the page. The employer sees this at once, with no email to the issuer.

You can try this yourself with the tamper check on our home page. Edit the name on the sample and watch the check run.

The five layers of protection

1. A unique ID on every certificate

Every certificate has its own ID, so each one can be looked up on its own and a duplicate or invented ID finds nothing.

2. A signed record

The record is signed when it is issued. A changed name, course or date does not match the signature.

3. A public verification page

The page shows the facts from the record. It needs no account and no app, so checking is quick enough that people actually do it.

4. Revocation

If a certificate was issued by mistake or has to be withdrawn, the issuer revokes it. The page then says "revoked", so a copy that was valid yesterday does not pass today.

5. An audit trail

Every issue and revoke is logged with the time, and the log can be exported to CSV or JSON. If a dispute arises, you can show what happened and when. On Growth the log is kept for up to seven years.

What tamper-proof does not mean

It helps to be clear about what the signature does and does not cover.

• It does not lock the PDF. Anyone can still edit the file. What they cannot do is change the record, so the edit shows up when the code is scanned.
• It does not stop a lookalike QR code. Someone can print a code that points to a fake page. Verifiers should check that the address in the browser is the issuer's real domain. For Saandru certificates it is certificon.gemscorp.app, or the issuer's own domain on Growth.
• It does not help if nobody scans. The check only works when a verifier uses it. Print the QR code at a readable size and mention it in your recruitment and admission checklists.
• It cannot check the person. It confirms that a certificate was issued with those details. Matching it to the person in front of you is still a job for ID checks.

A verifier checklist

1. Scan the QR code with a phone camera.
2. Check the address bar shows the issuer's real domain.
3. Check the page says the certificate is verified and not revoked.
4. Compare the name, programme and date on the page with the copy you were given.
5. Match the certificate ID on the page with the one printed on the certificate.

It takes under a minute and needs nothing installed. For more on building a good verification page, read our guide to QR code certificate verification and 10 best practices.

Frequently asked questions