How to create a certificate with a QR code
Adding a QR code turns a static certificate into something anyone can verify in seconds. Here is how to do it properly — and what most templates get wrong.
A QR code is the difference between a certificate that looks official and one that anyone can actually prove is real. Scan it, and a verifier lands on a page that confirms who issued the certificate, who it was issued to, and that nothing has been altered. This guide walks through how to add one the right way.
What a QR code on a certificate should actually do
The most common mistake is encoding the certificate data (the name, course and date) directly into the QR. That proves nothing — anyone can generate a QR that says whatever they like. A trustworthy QR code should encode a verification URL that points back to the issuer's system, where the credential is checked against a signed, tamper-evident record.
- Good: the QR opens
https://your-issuer.com/verify?code=ABC123and the page independently confirms authenticity. - Bad: the QR contains the recipient's name as plain text, with nothing to check it against.
Step by step
- Design the template once. Place your logo, border, signatures and a reserved spot for the QR — bottom-right corner is conventional and scans well.
- Make the QR a dynamic field. Each recipient gets a unique code, so each QR resolves to a different verification record. A static QR shared across every certificate cannot distinguish one holder from another.
- Issue and sign. When the certificate is generated, the underlying data should be cryptographically signed so the verification page can detect any later change.
- Test the scan. Print it (or view at final size) and scan with a normal phone camera. Confirm the link opens the verification page, not a raw text blob.
Best practices that prevent fraud
- Use high error correction (level H) so a logo or slight print damage doesn't stop the scan.
- Keep the URL on your own domain — recipients and employers trust a verification page that clearly belongs to the issuer.
- Pair the QR with a short human-readable code for people who type instead of scan.
- Sign the data, not the PDF. If verification is based on the file, re-exporting the PDF can quietly change it. Signing the canonical fields means altering even one character fails verification.
Doing it with QRCertificates
QRCertificates builds this in: design a template, drop in a dynamic QR field, and every issued certificate gets a unique QR plus a short code that resolve to your branded, login-free verification page. Each credential is Ed25519-signed, so a tampered copy is rejected. You can issue one or thousands from a CSV, and verification is always free.
