Moodle certificates: how to add verification your students can actually prove

Moodle issues certificates perfectly well. The question that decides whether they are worth anything is what happens after the student downloads the PDF, specifically, whether a recruiter who has never heard of your institution can confirm it is genuine.

What Moodle gives you out of the box

The main certificate plugins in the Moodle ecosystem let you build templates, issue on course completion, and place a verification code, link or QR code on the certificate. There is also a verification block that lets an administrator look up a certificate by its code.

That is a real feature set, and for internal use it is often enough. One planning note: the Moodle Plugins Directory was replaced by Moodle Marketplace on 20 July 2026, so older articles about where to find these plugins now point at the wrong place.

The four questions that decide whether it is enough

Rather than comparing feature lists, test your own setup against these.

1. Can a stranger verify without logging in? Scan the QR on a real certificate from a private browser window with no Moodle session. If you land on a login page, the certificate is only verifiable by people who already have accounts, which excludes every employer.

2. Is the site reachable from outside? Many institutional Moodle instances sit behind a VPN or an IP allowlist. If yours does, the verification URL printed on every certificate resolves to nothing for the outside world.

3. Would you notice a forged copy? A verification code proves a record exists. It does not prove this PDF matches that record. If somebody edits the name and leaves the code intact, a lookup that only confirms "code exists" will validate it happily. Signing the certificate's contents is what closes that gap.

4. What happens in five years? Certificates outlive courses. When a course is deleted, a category restructured or the LMS migrated, do the old verification URLs still resolve? Learners present credentials long after they stop being students.

Three sensible setups

Moodle alone. Right for internal training, compliance records and anything where the audience sits inside your organisation. Cheapest and simplest, keep it if it fits.

Moodle plus a public verification layer. Moodle stays the system of record for learning; completion triggers issuance of a signed certificate on a public domain. Right when learners show credentials to outsiders and your Moodle is not publicly reachable.

Replacing Moodle certificates entirely. Rarely necessary and usually more disruptive than it is worth. Moodle knows who completed what, and that part was never the problem.

Connecting the two

You do not need a bespoke plugin. Course completion is an event, and there are three ordinary ways to act on it: call an issuing API from a small integration, route the event through an automation tool such as n8n, Zapier or Make, or export completions periodically and issue in bulk from a CSV. The first is tidiest; the third is often the fastest to try, because you can run it once by hand before committing to any automation.

Whichever you pick, keep the learner's identifier stable across both systems. The commonest failure is issuing against an email address that later changes, leaving a certificate nobody can match back to a person.

A five-minute check

Take one real certificate from your last cohort. Open the QR on a phone using mobile data, no VPN, in a private window. If you reach a page naming the learner, naming the course and stating clearly that the document is valid, you are fine. If you reach a login screen, a timeout, or a page that only echoes back a code, you have found the gap before an employer did.