CertChain: ending fake degree certificates with credentials anyone can verify in seconds
A university consortium was spending weeks answering employer verification requests, and forged certificates were slipping through. We built CertChain: digitally signed credentials anchored on a public blockchain, a student wallet, one-click verification for employers and bulk issuance for registrars — 24 features where the blockchain does one job well and stays out of everyone's way.
Verification requests by the thousand
CertChain's project director oversaw examinations for a consortium of universities. Every year, employers and foreign universities sent thousands of verification requests by email and post. Each took registrar staff time to check against archives, and turnaround stretched to weeks. Meanwhile, convincing forgeries of consortium certificates were appearing on job applications.
The consortium had heard a lot about blockchain. The director's question was practical: could it make verification instant and forgery pointless, without making life harder for students or staff?
“A student's degree should be as easy to check as a UPI payment.”
Using blockchain for one thing only
We were deliberate about what the blockchain should do. Personal data never goes on a public chain. Instead, each certificate is issued as a digitally signed credential held by the student, and only a cryptographic fingerprint of each batch is anchored on a public blockchain. Anyone can verify that a credential was signed by the registrar and has not been altered or revoked — without trusting CertChain's servers and without seeing anyone else's data.
- No personal data on the blockchain, ever
- Students own and control their credentials
- Verification works even if CertChain is offline
- Registrars issue in bulk from existing result data
Hiding the complexity
Students never see the word blockchain. They receive their degree in a wallet app and share it with a link or QR code. Employers open the link and see a clear answer: authentic, issued by whom, when, and whether it has been revoked. Registrars upload result files they already produce, review, and issue a whole graduating batch in one signed operation.
The team
Cryptography and key management needed a specialist, working alongside product and web engineers.
Consortium workshops and convocation deadline.
Wallet, verification portal and registrar console.
Credential signing, key management and anchoring.
Issuance console, verification portal and API.
Student wallet app.
6 people in total, working as one team.
Decisions we made
Agreed with the consortium's technical committee.
What goes on the blockchain?
- Full certificate records
- Only batch fingerprints
Our call: Only batch fingerprints. Personal data on a public chain can never be deleted. Fingerprints give tamper-evidence without privacy risk.
Proprietary format or open standard?
- Custom certificate format
- W3C Verifiable Credentials
Our call: W3C Verifiable Credentials. An open standard lets credentials be verified by any compatible tool, now and in future.
Where are signing keys held?
- Application servers
- Hardware security modules with multi-officer approval
Our call: Hardware security modules with multi-officer approval. The signing key is the root of trust. HSMs and dual approval protect it from misuse.
Can credentials be revoked?
- No revocation
- Revocation registry checked at verification
Our call: Revocation registry checked at verification. Errors and misconduct happen. Revocation keeps verification truthful.
The 24 features
Everything that shipped for registrars, students and verifiers.
- 01Result file import
Upload results in the formats registrars already use.
- 02Validation checks
Mismatches flagged before issuance.
- 03Dual approval
Two officers approve each batch.
- 04Bulk signing
Whole batches signed in one operation.
- 05Blockchain anchoring
Batch fingerprints recorded publicly.
- 06Revocation
Revoke credentials with reasons.
- 07Credential wallet
Degrees and mark sheets in one app.
- 08Share by link or QR
Share with employers in seconds.
- 09Selective sharing
Share a degree without every mark sheet.
- 10Download as PDF
Printable copy with verification QR.
- 11Wallet recovery
Secure account recovery.
- 12Verification portal
Clear authentic, altered or revoked result.
- 13Offline-capable verification
Signatures verifiable without CertChain's servers.
- 14Verification API
Background-check firms verify at scale.
- 15Bulk verification
Upload many credentials at once.
- 16HSM key management
Signing keys protected in hardware.
- 17Multi-university support
Each member university as its own issuer.
- 18Verification analytics
Verification volumes by issuer.
- 19Audit trail
Every issuance and revocation recorded.
- 20Role-based access
Registrars, officers, students and verifiers.
- 21Legacy certificate digitisation
Past graduates issued credentials on request.
- 22Open standard compliance
W3C Verifiable Credentials format.
- 23Status monitoring
Anchoring and service health monitored.
- 24Data protection controls
Consent and minimal data retention.
The first graduating batch
The first batch of credentials was issued in time for convocation. Students received them in the wallet, and employers began verifying within days. Registrar staff stopped answering most verification emails, because the answer was now a link.
- Weeks 1–2Discovery
Registrar workflows and verification requests reviewed.
- Weeks 3–4Architecture
Standards, anchoring and key management agreed.
- Weeks 5–12Build
Issuance, wallet, verification and API.
- Weeks 13–15Pilot batch
One programme's results issued and verified.
- Week 16Convocation
First full graduating batch issued.
What we learned
Use the technology for what it is good at. Anchoring fingerprints gave tamper-evidence without the privacy and cost problems of putting records on-chain.
The best infrastructure is invisible. Nobody using CertChain needs to know how it works.
- Next.js
- React Native
- NestJS
- PostgreSQL
- W3C Verifiable Credentials
- Public blockchain anchoring (hashes only)
- HSM-backed signing keys
- AWS Mumbai
