1. Decide exactly what you are certifying
Before any design work, write down what the certificate states. Is it attendance, completion, or an assessed achievement with a grade? How many hours or credits? Does it expire, as many professional certifications do, or does it record a fact that stays true for life, like a degree?
The answers become the certificate's words, and a reader will take them literally. "Completed" and "passed" are different claims. So are "30 hours" and "3 ECTS credits".
2. Design one template per award
A template fixes the layout and the wording, and leaves placeholders for what changes from one person to the next: the recipient's name, the date, the grade or distinction, the reference number. Designing the template once and filling it for each recipient keeps every certificate consistent, which is itself a defence against forgery: a fake that deviates from the pattern stands out.
Our certificate design checklist lists what a professional certificate should carry, and how to keep it legible for every reader, including those using assistive technology.
3. Give every certificate a unique, unguessable reference
Each certificate needs an identifier that belongs to it alone. A human-friendly serial (2026-0042) is useful for your own records; a long random code is what makes a verification link private and impossible to guess. Print both, or print the code as a QR code alongside a short link.
4. Sign it
A cryptographic signature computed over the certificate's exact words lets anyone confirm that the certificate came from you and has not been altered. A scanned autograph cannot do that. Our guide to digital signatures on certificates explains the difference and what the law says about each.
5. Deliver it in the formats people use
Graduates expect a PDF they can print and attach. Employers expect a link they can click. Admissions systems and digital wallets increasingly expect a machine-checkable credential, such as an Open Badges 3.0 credential, which follows the W3C Verifiable Credentials data model. Issue all of them from the same record, so they cannot disagree. Our comparison of PDF certificates and verifiable credentials goes into the details.
6. Publish a verification page
A verification page answers the only question a reader really has: did this institution grant this certificate to this person, and does it still stand? It should show the recipient, the award, the date and the issuer, and state plainly whether the certificate is valid, expired or withdrawn. It must not require the reader to create an account.
7. Plan for corrections and withdrawals
Mistakes happen: a misspelt name, the wrong date. Do not edit a certificate that has already been issued: its signature covers the original words, and a silently edited certificate is one nobody can trust. Issue a corrected certificate, withdraw the original, and make the verification page for the old one point to the new one. The same mechanism handles a certificate that must be revoked for other reasons.
8. Keep the register
Keep a record of every certificate: who received it, what for, when, from which template, and every later change of status. That record is what lets you answer a verification request years later. Our guide to certificate record retention covers how long to keep it.
Issuing in bulk and through an API
A course of three hundred students should not mean three hundred manual steps. Look for a way to import a list, or to issue from your learning platform through an API, so that the certificate is granted the moment the student completes the course. Make sure a repeated request cannot issue the same certificate twice.
How this works in Emitcert
In Emitcert, an institution designs its templates (words, layout, colours, crest and up to three signatures), then grants certificates from the panel or through its API. Each certificate gets a unique serial and an unguessable code; its words are copied in at the moment of issue and signed with the institution's own Ed25519 key. The graduate receives a link to a public verification page, a PDF and an Open Badges 3.0 credential. A mistake is put right with "correct and reissue": the original is withdrawn and its page points to the corrected certificate.
Frequently asked questions
What makes a digital certificate verifiable?
A way for any reader to confirm, with the issuer or with the issuer's key, that the certificate was granted and has not been changed: typically a unique code, a verification page kept by the issuer and a cryptographic signature over the certificate's words.
Can we edit a certificate after it is issued?
You should not. The signature covers the original words, so an edited certificate stops matching it. Issue a corrected certificate, withdraw the original and make the old verification page point to the new one.
Do we need a blockchain to issue verifiable certificates?
No. The W3C Verifiable Credentials data model relies on cryptographic proofs that can be checked with the issuer's public key. A signature and a published key are enough.
Should a certificate have an expiry date?
Only if what it certifies expires. A professional certification that must be renewed should carry an end date; a degree or a course completion records a fact that stays true.
Sources
Every factual claim on this page comes from the documents below. Laws and services change; check the current version before relying on one.