A convincing certificate can be produced in a few minutes with free design tools. For employers, that means a PDF on its own proves almost nothing. For issuers, it means every forgery quietly devalues the real thing.
Why PDFs are easy to fake
A PDF certificate is a picture of a claim. There is no way to check it without contacting the issuer, and most busy recruiters never do. Forgers rely on exactly that.
Four defences
- A unique link and QR code. Every certificate points to its own page on the issuer’s domain. If the page does not exist, neither does the credential.
- A digital signature. The credential is signed with the issuer’s key, so any change breaks the signature.
- A public ledger record. A fingerprint written to a blockchain proves when the credential was issued and that it has not changed.
- A live status. Revoked, suspended or expired credentials show their real status the moment anyone opens them.
Make checking the default
The strongest defence is cultural: teach employers and admissions teams to click the link, not read the PDF. Put the verification URL front and centre on every certificate you issue.
