What a QR code proves — and what it does not

A QR code is a convenient link. That is all it is. The trust comes from what the link opens: an issuer-controlled record, a live status and a known issuer. Confusing the two is how fake certificate pages succeed.

What a valid result means

• The record exists in the issuer’s registry.
• The record belongs to the issuer and matches the program version.
• The credential is currently active — not revoked, expired or superseded.
• The program and version shown match the assessed achievement.

Why we show minimal data

A public record needs to be useful to an employer without leaking the learner’s email, birth date, exam transcript or identity documents. We expose the program, status, dates and a consented display name. Everything else stays private.

Designing for the bad outcomes

A verification system is only trustworthy if it can say “no” clearly. Revoked, expired, superseded and unknown are different answers. An unavailable service is never reported as valid. That is not a detail; it is the core of the design.

Our current public records are registry-backed. We do not claim W3C Verifiable Credentials or Open Badges conformance; that requires a tested signing and status profile.