Confirm any certificate is genuine — in seconds.
Employers, clients and institutions can check any credential you issue against the registry. No account, no phone calls, no waiting on an email reply.
Issue credentials for your organization? Create an account or sign in.
Three steps, one source of truth
The certificate proves itself, and the registry keeps it current. Together they answer the only question that matters: is this real, right now?
Issue and sign
You enter the holder and course details. The certificate is signed with your private key the moment it is created — a fingerprint no one else can reproduce.
Hand over the QR
Each certificate carries a QR code and a number. The holder shows either one to an employer, client or reviewer who needs to check it.
Anyone verifies
A scan or a typed number returns an unambiguous result: authentic, expired, or revoked — with the details drawn straight from the registry.
A forged certificate has nowhere to hide
Two independent checks run on every verification. One proves the record was not altered; the other proves it is still valid today.
- Tamper-evident by signatureChange a single character of the name or date and the signature stops matching. Copying a real certificate onto a fake one fails the same way.
- Revocable at any timeIssued a certificate in error, or need to withdraw one? Revoke it and every future check shows the change immediately.
- No central authority requiredRecords are anchored on the public Base blockchain and verified with open public-key cryptography — no private database and no third party to depend on.
Three layers of proof — all of them cryptographic
Every certificate is signed, notarized in a Merkle tree, and — when you choose — anchored on a public blockchain. Each layer is something anyone can verify for themselves.
Cryptographically signed
Every certificate is hashed with SHA-256 and signed with ECDSA on the NIST P-256 curve — the same public-key cryptography behind HTTPS and e-passports. The signing key lives inside AWS KMS and can never be exported, so even a full breach of the site can’t forge one.
ECDSA P-256 · SHA-256Notarized in a Merkle tree
Each day, every certificate’s fingerprint is folded into a Merkle tree and reduced to a single value — the root. That one root proves the whole day’s records existed and were never altered, and it’s published openly for anyone to recompute.
Daily public rootAnchored on the blockchain
Turn it on and each daily root is written to Base — Coinbase’s Ethereum layer-2 — as a permanent, public timestamp anyone can confirm on a block explorer, independently of us. Optional by design; verification never depends on the chain.
Base · Ethereum L2More than a verify page
Issue, sign, notarize, revoke and audit — every credential tamper-evident and independently checkable, with no third party to depend on.
Instant public verification
Anyone confirms a credential by number or QR code — no account, no phone call. The result shows the holder, the issuer and the live status.
Signed the moment it is issued
Every certificate is signed with ECDSA P-256 and SHA-256. Alter one character and the signature stops matching, so records cannot be forged or edited.
Merkle notarization
Each day’s certificates are folded into one public root that proves the whole day’s records existed unaltered — with an optional public timestamp on Base.
Cryptographic revocation
Revocations build a Certificate Revocation Tree with a notarized root. The verify page checks both the issuance and the revocation proof in your own browser before it shows a credential as valid.
Tamper-evident audit trail
Every issuance, signature, identity check and revocation is hash-chained into an append-only record you can verify for integrity and export.
Identity verification records
Capture how each signer’s identity was confirmed — in person, by video, or by government ID — recorded to the audit trail. Method and document type only, never ID numbers.
Employee digital signatures
Issue each staff member a personal signing certificate — a password-protected .p12 chained to your company’s own signing authority — so they can sign PDFs in your organization’s name. (Pro)
Signed, verifiable PDFs
Produce a server-signed PAdES certificate PDF with an embedded QR that always points back to the live record — plus transcript tables and a custom PDF design builder. (Pro)
Your own branded portal
Each company gets a page at your own address and a dashboard to issue, revoke and manage credentials — with its own independent signing key.
CertAttestor makes credentials tamper-evident, signed and independently verifiable, and supports notarization-facility workflows. It is not itself a notary — legal notarization requires a commissioned electronic notary and, in the Philippines, a Supreme Court–accredited facility.
Carried in Google Wallet and Apple Wallet
The holder adds their credential to the wallet app they already use. It sits alongside their boarding passes and loyalty cards — always on hand, and always showing its current status.
- One tap from the issue email. No app to install and no account to create — the pass is added straight from the message you send.
- Revoke, and the pass follows. Revoking a credential pushes the change to the holder's phone, so a withdrawn pass stops presenting itself as valid.
- Your branding on the card. Each issuing company gets its own pass class, carrying its own logo and colours.
- The QR still decides. Anyone can scan the pass and reach the same public verification page — the wallet displays the credential, the registry proves it.
Displaying a pass works offline; confirming it is still valid needs a connection, because only the live registry knows about revocation.
Why a signed registry beats the alternatives
| CertAttestor | PDF file | Paper + stamp | Call / email issuer | |
|---|---|---|---|---|
| Confirms authenticity instantly | ||||
| Tamper-evident by cryptography | ||||
| Can be revoked after issue | ||||
| Verifiable by anyone, no account | ||||
| Publicly timestamped (optional) |
Common questions
How do I verify a certificate?
Can a certificate be forged?
What happens if a certificate is revoked?
Do people need an account to verify?
Is this based on blockchain?
Put a verifiable mark on every certificate you issue
Stop fielding "is this real?" emails. Issue signed certificates from one dashboard and let anyone confirm them in seconds.
The infrastructure and open cryptographic standards CertAttestor runs on today — the same building blocks that secure banking, HTTPS and public blockchains.
All product names, logos and brands are the property of their respective owners and are shown only to describe the technologies CertAttestor is built with. Their use does not imply any endorsement, sponsorship or affiliation.