Guides ›

How to verify a certificate: a checklist for employers and schools

Anyone can edit a PDF, so a certificate on its own proves little. Checking one properly takes a few minutes: read the document, check the issuer exists, then confirm the certificate with the issuer or its verification page. Here's what to look for at each step, and what a QR code can and can't tell you.

1. Read the certificate itself

• Who issued it? There should be a named organisation, not just a course title. Be wary of vague issuers such as “International Institute of Training”.
• Does the wording match the claim? “Attended” and “participated in” mean the person was present. “Completed” means they finished the work. Neither is a degree, diploma or licence, however grand the design.
• Are the details consistent? Name spelled as on the CV, a plausible date (not a weekend course dated before the course existed), and hours that fit the dates.
• Is there a way to check it? A certificate ID, a QR code or contact details. A certificate with none of these can only be checked by contacting the issuer.
• Does it look edited? A name in a slightly different font, size or alignment from the other text, or a PDF whose properties show it was saved in an image editor, are reasons to look harder.

2. Check the issuer exists

Search for the organisation yourself rather than using a website or phone number printed on the certificate, since a forger can print any details they like. Look for a real website, an address, and evidence that it runs the course in question. For formal qualifications, use the official route:

• Degrees and diplomas: the institution's registrar or records office. Many universities confirm awards by email.
• Professional licences: the licensing body's public register.
• Accredited programmes: the accreditation body. In Jamaica, for example, the University Council of Jamaica lists accredited tertiary programmes.

3. Use the QR code or ID, carefully

A verification QR code links to a page held by the issuer or its certificate provider. That page shows the details recorded when the certificate was issued. Because the record sits on a server the candidate doesn't control, editing the PDF doesn't change it.

1. Scan the code, then look at the address before reading the page. A QR code can point anywhere, including a fake page made to look official. The domain should belong to the issuer or a provider you recognise, e.g. certsheet.com/v/…, not a lookalike.
2. If the code won't scan, type the printed ID into the issuer's or provider's site yourself.
3. Compare every detail: name, title, date and issuer. A difference in any of them means the document has been changed, or the code belongs to someone else's certificate.
4. Read the status. “Revoked” means the issuer withdrew it. “Not found” means no record exists for that ID: it was mistyped, never published for verification, or the document isn't genuine.

A worked example

An HR officer at a hotel in Ocho Rios is checking an applicant's “Customer Service Excellence” certificate. It has a QR code in the corner and the ID CS-8HQT-4WVN-R2MC printed underneath. She scans it and the phone opens https://certsheet.com/v/CS-8HQT-4WVN-R2MC:

The name, title and date match the PDF. The issue and publish dates are the same day, which is what you'd expect from a training company issuing certificates after a course. She then searches for North Coast Hospitality Training, finds its website and phone number, and calls to confirm Jordan was on the August course. Total time: about five minutes.

Had the page said “Revoked”, “not found”, or shown a different name, she would ask the applicant about it and contact the issuer before going further. A publish date long after the issue date isn't proof of anything, but it's worth a question.

What a verification page doesn't prove

A verification page proves that this record was published by whoever controls the issuer's account. It doesn't prove the issuer is legitimate or accredited. On CertSheet's pages the issuer name is shown exactly as the publisher typed it, and each page says so: CertSheet is a certificate tool, not an accreditation body, and doesn't vet issuers. That's why step 2, checking the issuer yourself, still matters.

Each CertSheet verification page also shows the issue date, the date the record was published, and a Report this certificate link. If you think a certificate imitates a university or government body, or was issued by someone with no right to issue it, report it. Publishers who break the acceptable use rules have their accounts ended and their certificates revoked.

The short checklist

1. Named issuer, wording that fits the claim, consistent details.
2. Issuer found independently; formal qualifications checked with the official body.
3. QR address checked before reading the page; details compared line by line.
4. Status is Valid, not Revoked or not found.
5. For anything that matters, a call or email to the issuer using contact details you found yourself.

Issuing certificates yourself? See how to add a QR verification code to certificates.