A paper diploma or a plain PDF can be faked. A cryptographically signed credential cannot, because any change to it breaks the signature and fails verification. The difference is whether the proof lives in the document itself.
How fakes are usually made
- Editing a real PDF or scan to change the name, grade, or date.
- Buying a convincing template from a diploma mill.
- Inventing an institution that will confirm anything for a fee.
- Reusing a genuine document that has since been revoked.
These work against paper and unsigned files because there is no reliable way for a busy verifier to check authenticity at a distance.
Why a signed credential resists forgery
When an institution issues a signed credential, it signs the exact contents with a private key that it never shares. Verification recomputes the check against the institution’s public key. Change a single byte and the signature no longer matches, so a tampered file is detected immediately. Producing a convincing fake would require the institution’s private key, which is the part that is kept secret.
How to catch a fake
- Ask for the original signed file, not a screenshot or printout.
- Verify it: upload the file or enter its ID at the public verifier.
- Read the status. Valid means signed by the stated institution and unaltered. Tampered, revoked, or not found means do not rely on it.
Verification is free and needs no account, so there is no reason to accept a credential you cannot check.