FAQ
Answers, in full.
Covering how AcadCert works, who it’s for, and what the cryptographic verification actually guarantees.
General
AcadCert is a platform for issuing and verifying academic credentials using Ed25519 cryptographic signatures. Institutions issue digitally signed credentials: degrees, transcripts, certificates, diplomas, letters of recommendation. Students access and share them. Anyone can independently verify their authenticity, with no account required.
Three groups:
- Students receive, view, download, and share credentials issued to them.
- Issuers (registrars, faculty, authorized staff) sign and manage credentials on behalf of their institution.
- Administrators manage institutional settings, user accounts, signing keys, and audit logs.
A regular PDF or paper document can be forged or altered without detection. AcadCert credentials carry a cryptographic signature that proves mathematically that the document came from the stated institution and has not changed since issuance. Any modification, including a single byte, causes verification to fail immediately.
Blockchain credentials write data to a decentralised ledger, which means verification can happen without a central service, but it also means revocation is complicated (you cannot truly delete a blockchain record), costs money per transaction, and depends on a specific chain surviving. AcadCert uses Ed25519 signatures stored on controlled infrastructure. Revocation is immediate and definitive. Verification is fast, free, and does not require blockchain infrastructure. The cryptographic guarantees are equivalent; the operational model is simpler and more suitable for institutional use.
No. AcadCert is a technical platform. The academic authority, validity, and meaning of every credential rests entirely with the issuing institution. We provide the infrastructure for digital signing and verification.
AcadCert is available globally. Institutions in any country can participate. AcadCert is incorporated in Singapore; its data infrastructure may reside in jurisdictions outside your country of residence. See the Privacy Policy for data transfer details.
Verification is free for anyone, forever. Credential issuance and account access are institution-level subscriptions: see the pricing page for tiers. Founding institutions currently get three months free.
For students
Once your institution issues a credential, you receive a notification at your registered email. Log in with that email using the one-time code sent to it, and all credentials issued to you appear on your dashboard.
Yes. All credentials can be downloaded as signed files in their original format. The downloaded file retains its cryptographic signature and can be independently verified without needing an AcadCert account. Send it anywhere.
Two options: download the file and send it directly (via email, job portal upload, application system), or share the verification URL from your dashboard. Either way, the recipient can verify authenticity without creating an account.
A revoked credential has been marked no longer valid by the issuing institution. Common reasons include administrative error, fraudulent issuance, or disciplinary action. Revocation is permanent and includes a documented reason. Anyone verifying the credential sees the revoked status and reason. Contact your institution's registrar for details.
A newer version of the credential has been issued: for example, an updated transcript. The superseded version is preserved for historical reference but the newer one is the current record.
No. Students cannot modify, delete, or revoke credentials. Only authorized institutional issuers and administrators can. This is by design: credentials are official institutional records, not personal documents.
Contact your institution's credential administrator. They can verify your identity through their own procedures and assist with account recovery. Your credentials remain securely stored regardless of account status.
Some credentials have a validity window set by the issuing institution at the time of issuance. An expired credential is no longer considered current but remains on your dashboard as a historical record.
Yes. Enable your public portfolio from the dashboard. This creates a shareable page at acadcert.com/portfolio listing all your active credentials with verification links. You control whether it is on or off.
Yes. Your credentials remain accessible and verifiable for as long as your institution maintains its relationship with AcadCert. Graduation does not affect access.
For issuers
Go to the Upload page, select the student, choose a credential type (Certificate, Degree, Diploma, Transcript, or Letter of Recommendation), upload the document, and submit. The system signs the document and notifies the student.
Three modes:
- Single upload: one student, one document type, one file.
- Smart Table: drop multiple files at once. The system auto-detects students from filenames and lets you review, reassign, or remove matches before submitting.
- CSV + ZIP: bulk matching via a CSV manifest and a ZIP archive of documents. Batches run as background jobs, up to 1,000 documents and 5 GB per ZIP.
PDF (up to 50 MB), DOCX (up to 20 MB), and JPEG or PNG images (up to 10 MB). Each file is validated before signing; unsupported or corrupted files are rejected.
Yes. Revocation permanently marks a credential as invalid with a documented reason. Supersession replaces it with an updated version while preserving the original. Both are logged in the audit trail and cannot be undone.
Only students registered under your institution by an administrator. You cannot issue credentials to students at other institutions.
Yes. The upload form includes an optional expiry date field. Once set, the date is embedded in the credential and shown on the document detail page and in verification results.
Revoke immediately with a clear reason (e.g. “Issued to wrong recipient, administrative error”), then issue to the correct student.
For administrators
Individually through the admin panel, or in bulk via CSV upload. Each user needs a valid email address, a role (Student, Issuer, or Administrator), and institutional affiliation.
Key rotation generates a new Ed25519 signing key pair for your institution. Previously signed documents remain valid because old public keys are preserved in key history. As a routine practice, rotate at least once a year. Rotate immediately if you suspect key compromise, a signing account was accessed without authorisation, or a staff member with issuer access leaves the institution.
Audit logs record every significant action on the platform: credential issuance, revocations, login attempts, administrative changes, security events. Logs are append-only and tamper-evident. Administrators can review the full log history from the admin panel.
Yes, but with significant consequences. Deleting a user removes account access. Deleting an institution removes all associated users, credentials, and files permanently. Institution deletion requires typing the institution name to confirm and cannot be undone.
Previously issued signatures remain cryptographically valid. For the full answer, including data export and transition support, see the Trust page.
Verification
When a credential is issued, AcadCert:
- Computes a BLAKE3 hash of the document and its metadata.
- Signs that hash with the institution’s private Ed25519 key, producing a 64-byte signature.
- Stores the signature alongside the document.
When someone verifies, the system recomputes the hash, then uses the institution’s public key to check whether the signature matches. If it does, the document is authentic and unaltered. No trust in AcadCert required. The math either works or it does not.
- Cryptographic signature: Was the document signed by the institution’s key?
- Issuer authority: Was the signing key valid and associated with a registered institution at the time of issuance?
- Revocation status: Has the credential been revoked?
- Data integrity: Has document metadata been altered since issuance?
- Validity period: Is the credential within its validity window, for credentials issued with an expiry?
- Timestamp: Does the signing timestamp match the expected issuance window?
No. Forging one would require the institution’s private signing key, which is never exposed. See Can a diploma be faked or forged? for the full explanation.
No. verify.acadcert.com is a public service. Anyone with a credential file or verification link can check its authenticity without creating an account or logging in.
It means the signature is valid and the credential hasn’t been altered or revoked, not an endorsement of the institution or holder. See What “verified” means, and what it does not for the full breakdown, or our Terms of Service.
Security & privacy
On encrypted servers with role-based access controls. Private signing keys are stored separately from document files, encrypted with AES-256-GCM and a unique salt per institution, and custodied in AcadCert Vault, a dedicated Key Management Service reachable only over mutual TLS. The application itself never holds a key in memory. Infrastructure is protected by TLS in transit and encryption at rest.
Passwordless: via one-time codes sent to your registered email. Codes expire in minutes. Sessions use httpOnly cookies and are protected by CSRF tokens. There are no passwords to steal, phish, or brute-force.
Yes. Institution administrators can create verification API keys from the admin dashboard. Each key is shown in full exactly once at creation, runs the same five cryptographic checks as public verification at a higher rate limit, and returns results with the credential holder’s email redacted. Institutions can also register webhooks that deliver signed notifications the moment a credential is issued or revoked. For programmatic issuance, contact us.
Yes. An institution administrator can cryptographically erase a stored document file, which destroys it permanently for everyone, including AcadCert; there is no recovery path. The credential record itself remains listed and verifiable, the erasure is permanently recorded in the immutable audit trail, and revocation history is never affected. Consider it carefully: erasure cannot be undone.
Yes. AcadCert provides an embeddable verification widget, a single script snippet institutions can add to their own website so applicants and employers can verify a credential without leaving your page. Reach out to the team or check your institution’s admin settings for the embed snippet.
No. We do not sell, rent, license, or trade personal information to third parties for any purpose. See our Privacy Policy for full details.
The cryptographic signatures embedded in signed PDFs do not expire and do not depend on AcadCert being live. Anyone can verify a signature using the institution’s public key independently. The public verification service, revocation registry, and key hosting would be unavailable: which is why we provide institutions with export access to their public key material and credential records for continuity planning.
AcadCert maintains tamper-evident audit logs and security event monitoring. In the event of a security incident, affected institutions and users will be notified in accordance with applicable law. Signing key rotation can be performed immediately to mitigate compromised key material.
Please contact us privately before disclosing publicly. Email security@acadcert.com with details of the issue. We acknowledge within 24 hours and treat security reports as the highest priority. Do not publish or share the vulnerability until we have had the opportunity to address it. We are grateful for responsible reports and will credit you.
Credits
We are grateful to everyone listed here.
AnonymousInformation disclosure
Fixed Feb 2026AnonymousMissing rate limiting
Fixed Feb 2026MiserableTacoCross-site request forgery (CSRF)
Fixed Mar 2026AnonymousImproper session invalidation
Fixed Mar 2026AnonymousCross-site scripting (XSS)
Fixed Apr 2026AnonymousMissing security header
Fixed Apr 2026AnonymousOpen redirect
Fixed May 2026Still have questions?