How does QR code document verification work?

Scanning the QR opens a verification page on the issuer's own domain. That page looks up the document by its unique code and recomputes a cryptographic signature over the original data, confirming the document is authentic and unaltered — and showing who issued it.

Can a QR code on a document be faked?

The QR itself is just a link, so anyone can make one. What makes it trustworthy is where it points. If it resolves to a signed record on the issuer's system, a forged or altered document fails verification, because the on-screen details won't match the real record.

What should a document QR code link to?

It should link to a verification page on the issuer's own domain that checks the document against a signed, tamper-evident record — never to the document's own text, which proves nothing on its own.

Do I need an app to scan and verify a document?

No. A well-built verification QR opens in any phone's normal camera and browser, with no app or login required to confirm the document is genuine.

QR Code Document Verification: How It Works

QR code document verification lets anyone confirm that a document is genuine by scanning a small square code with a normal phone camera. It works for certificates, transcripts, offer letters, invoices, ID cards and any other document where the reader needs to know "is this real, and was it changed?". Done properly, it answers both questions in seconds. Done carelessly, the QR code proves nothing at all.

What a QR code for document verification should link to

The single most common mistake is encoding the document's contents — a name, a reference number, a date — directly inside the QR code. That proves nothing: anyone can generate a QR code that says whatever they like. A trustworthy QR code encodes a verification URL on the issuer's own domain. When scanned, it opens a page run by whoever issued the document, and that page independently checks the record.

Trustworthy: the QR opens https://issuer.example/verify?code=AB12CD and the page confirms authenticity against a signed record.
Worthless: the QR contains the document's text as plain data, with nothing to check it against.

What happens when you scan

The camera reads the QR and opens the verification link — no app to install.
The issuer's page looks up the document by its unique code.
It recomputes a cryptographic signature over the document's canonical data. If even one character was altered — a name, a grade, a date — the signature no longer matches and verification fails.
It shows who issued the document and whether their identity was independently confirmed, not just a name someone typed in.

Why it stops forgery

Forging a paper or PDF document is easy; forging a valid signature on the issuer's server is not. Because the check happens on the issuer's system against a tamper-evident record, a photoshopped copy fails the moment it is scanned. A genuine QR that has been copied onto a fake document still resolves to the real record — so the details on screen won't match the forged paper, and the fraud is exposed.

How to add QR code verification to your documents

Give each document a unique code. A single static QR shared across every document can't tell one holder from another. Each document needs its own code resolving to its own record.
Sign the data, not the file. If verification is based on the exact PDF, simply re-exporting it can change the bytes and break the check. Signing the canonical fields means the content is what's protected.
Keep the URL on your domain. Readers and employers trust a verification page that clearly belongs to the issuer.
Use high error correction (level H) so a logo or minor print damage doesn't stop the scan, and print the QR at least 2×2 cm.
Pair the QR with a short human-readable code for anyone who prefers to type it on your verify page.

QR code document verification with QRCertificates

QRCertificates builds this in. Every document you issue gets a unique QR code plus a short code, both resolving to your branded, login-free verification page. Each record is Ed25519-signed over its canonical data, so a tampered copy is rejected automatically, and the page shows your verified issuer identity. You can issue one document or thousands from a CSV, and verification is always free for anyone who scans.