Vasil Georgiev
Demo ready2026

VeriCert

Issue credentials anyone can verify in seconds

A platform where universities and training centres issue digitally signed diplomas and certificates as W3C Verifiable Credentials. Employers verify one by scanning its QR code, entering its ID or uploading the PDF, and the platform never stores the holder's documents or personal data.

Open live app

Demo access

VeriCert

Verifying a credential needs no account: open the live app and use Verify.

  • Institution issuer · Demo Academy

    Loginissuer@demo-academy.test
    Password••••••••••••

    Issue single or bulk credentials and revoke them.

  • Institution admin · Demo Academy

    Loginadmin@demo-academy.test
    Password••••••••••••

    Also manages staff and signatories, and sees the audit log.

Open VeriCert

Demo accounts with example data only.

vericert.demodomain.site

Role
Solo: product, cryptography, front end, deployment
Platforms
Web: public verifier · Web: issuer portal · Public API
Tech
Next.js 16React 19TypeScriptPostgreSQLDrizzle ORMBetter AuthW3C VC 2.0ES256 / did:webpdf-libPlaywrightDocker

  • 5

    checks on every verification

  • 0

    holder documents or personal data stored

  • 200

    rows per bulk upload, each checked first

  • 118k

    credentials per revocation list

The problem

Checking a diploma shouldn't take a phone call

Today an employer who wants to check a diploma emails or calls the registrar's office and waits. Paper and PDF certificates are easy to edit, and a cancelled certificate looks exactly like a valid one.

VeriCert gives every credential the institution's digital seal. Anyone can check it in seconds, without an account, and if a single character changes the seal breaks. The platform keeps only a fingerprint and the revocation status, never the graduate's documents.

Walkthrough

01 · Verify

Forged, edited and cancelled credentials are caught

Verification runs five checks: the issuer's public key, the signature, the registered fingerprint, the revocation list and the validity dates. A verifier sees a clear verdict with the reason, and can download a receipt.

  • Verify by credential ID, QR camera scan, PDF upload or pasted JWT
  • An edited PDF no longer matches its registered hash and is flagged as altered
  • Revocation is a signed Bitstring Status List: public status, without revealing who holds a credential

02 · Issue

One credential, previewed as you type

Issuers fill in the holder, the achievement, the dates, the department and the signatories, and see the certificate update live. Signing produces a PDF with the signed credential embedded, plus a .jwt file.

  • Institutions can also upload an existing PDF diploma and seal it
  • Every institution gets its own signing key, published through did:web
  • QR code on the document links straight to its verification page

03 · Bulk

A whole graduating class in one upload

Upload a CSV or XLSX of up to 200 rows. Every row is validated before anything is signed, problems are flagged per row, and the batch is issued in one click with every PDF downloadable at once.

04 · Manage

Revoke with a reason, audit everything

Institutions see every credential they issued with its status, revoke with a reason, and get an audit log of every action. The platform admin approves, suspends and invites institutions.

  • Roles for platform admin, institution admin and issuer
  • Optional TOTP two-factor sign-in and invitation flow

05 · Developers

A public API for verifiers

HR systems and admissions portals can verify credentials automatically through a JSON API: look up an ID, or post a signed JWT for full verification. Rate-limited, CORS-enabled and documented on a developers page.

Under the hood

How it's built

  • 01

    Open standards

    Credentials follow W3C Verifiable Credentials 2.0 and Open Badges 3.0, signed with ES256 (P-256) and published through did:web, so any standards-compliant verifier can check them.

  • 02

    Privacy by design

    The database keeps metadata, the revocation bit and a SHA-256 fingerprint, never the holder's documents or personal data. Holder details come from the signed credential itself.

  • 03

    Signing keys per institution

    Each institution gets its own encrypted private key, its public did:web document and its own revocation list (room for about 118,000 credentials) the moment it is created.

  • 04

    PDF handling

    pdf-lib and fontkit render certificates and embed the signed credential; pdfjs reads uploaded diplomas so an existing PDF can be sealed instead of re-designed.

  • 05

    Stack and quality

    Next.js 16 and React 19, PostgreSQL with Drizzle, Better Auth with TOTP. Vitest for the cryptography and parsing, Playwright for the flows, and sample valid, revoked, expired and forged PDFs for demos.

  • 06

    Deployment

    A Docker image with migrations and seeding, behind Caddy on a VPS, with GitHub Actions running the checks.

PreviousForgeNextLogistic