How Online Course Certificates Can Be Trusted: Issuing and Verifying Them

A certificate looks official the moment it has a border, a name and a date. That is exactly the problem. Anyone with an image editor can make one that looks just as official, and a person reading it has no way to tell the difference.

When I built the e-learning part of my website, with courses, lessons, quizzes and certificates, I wanted the certificates to be something a student could show an employer and the employer could actually check. This post explains how that works, in plain language, and what I think it does and does not prove.

The problem with a certificate that is just a PDF

A PDF is only a picture of a promise. If nothing outside the file can confirm it, then the file proves nothing. Anyone can change the name, the course or the date, and the result looks identical.

The fix is not a fancier design. It is to make the certificate point back to a record that only the issuer controls, so that anyone can check the claim against the source.

Earning it first

The most important part of a trustworthy certificate is that it is hard to get without doing the work. On my platform a student can only receive one after completing every lesson in the course. If the course has a final quiz, they also have to pass it. The passing score for a quiz is set per course, and a common default is seventy percent.

These rules are enforced on the server, not in the app. A student cannot skip ahead by tampering with the app, because the server checks the progress records itself before it will issue anything.

Giving every certificate its own number

Each certificate gets a unique number made of three parts: a prefix, the year, and eight random letters and numbers. The randomness is deliberate. If numbers were sequential, anyone could guess the next one and browse other people's certificates. With random numbers, you only find a certificate if you were given its number.

Issuing it once, on the server

The certificate record is created the first time a student qualifies, and it is created only once per enrollment. If the student downloads the certificate again later, or opens it in the mobile app, they get the same number and the same date, not a fresh one.

The PDF itself is generated on the server at the moment it is requested, using the student's name from their account, the course title, the date and the number. The student never types any of those details, so they cannot be altered at the source.

A public page to check it

This is what makes the certificate trustworthy. There is a public verification page where anyone can type in a certificate number. If the number exists, the page shows the name of the student, the date it was issued and the number itself, with a clear valid message. If it does not exist, it says no certificate was found and suggests checking the number.

An employer does not need an account, an app or a phone call. They look at the number on the PDF, type it in, and see whether the record matches.

Keeping the verification page private enough

A verification page can leak information if it is careless. Mine does not list anyone. You only see a result if you already hold a valid number, and the page tells search engines not to index it, so it does not turn into a public directory of students.

It also only shows what a verifier needs: the name, the date and the number. It does not show an email address, a phone number or anything about the student's account.

What a certificate does and does not prove

I think this part deserves honesty. A certificate from a small online course shows that a person completed that course on that platform and passed its quiz. It is not a degree, it is not a professional licence, and it should not pretend to be. Employers are smart enough to weigh it as evidence of effort and learning, not as a formal qualification.

What I would add next

There are things I would still like to improve. One is a way to revoke a certificate if one was issued by mistake or obtained unfairly. Another is putting the verification address directly on the PDF so that the person reading it does not need to hunt for it. Both are small changes that make the system more trustworthy.

If you are building your own

Tie every certificate to a record you control, and let anyone check it. Use random numbers, not sequential ones. Issue the certificate once, on the server, from data the student cannot edit. Share only the minimum on the verification page, and keep it out of search results. And be honest about what the certificate is worth.

If you want certificates or a course platform on your own website, get in touch through the contact page.