Credentials That Can’t Be Forged: Verifiable Credentials on the Blockchain

Introduction: From Document Forgery to the Verifiability of Academic Credentials

Fraud, Administrative Inefficiency, and Loss of Institutional Trust

The forgery of diplomas and certificates undermines the credibility of educational institutions, the hiring process, and the assessment of acquired competencies (Said et al., 2025). Manual procedures force employers and institutions to request individual confirmations, while isolated systems make it difficult to verify credentials issued by different entities (Delgado‐von‐Eitzen et al., 2025). This fragmentation also extends to microcredentials and non-curricular learning, for which validation often lacks uniform mechanisms (Syaifudin et al., 2025). The problem, therefore, is not merely a matter of altering a document: it involves the inability to demonstrate its origin, validity, and association with a specific individual.

The Promise of a Portable, Tamper-Resistant Digital Certificate

Blockchain allows for the recording of a verifiable record of issuance and its storage across distributed nodes, so that any subsequent modification is detectable (Cardenas-Quispe & Pacheco, 2025). In this model, the holder can present a digital credential, a QR code, or a cryptographic proof, and the verifier checks its authenticity without relying on a single administrative chain (Chotikakamthorn et al., 2024). The promise must be precisely defined: while the record may be tamper-resistant, it does not guarantee that the institution correctly issued the credential or that the initial identity was authentic. This distinction guides the analysis of the credential’s entire lifecycle.

Issuance, Verification, and Revocation: Blockchain vs. the Weaknesses of Centralized Systems

Immutable records, smart contracts, and automation of the credential lifecycle

The literature converges on an architecture consisting of three operations: issuing, verifying, and updating the status of a credential. Smart contracts encode rules for registering credentials, associating authorized issuers, and responding to queries, thereby reducing manual intervention in repetitive processes (Rustemi et al., 2024). DIAR proposes contracts to generate and authenticate diplomas, while other designs incorporate role-based access control and tracking of non-curricular achievements (Rustemi & Dalipi, 2026; Syaifudin et al., 2025). Automation improves traceability, although it shifts some of the trust toward the code, issuers’ keys, and governance rules.

A distributed ledger also alters the relationship between issuance and verification. In the prototype by Cardenas-Quispe and Pacheco, data is recorded, validated through associative signatures, and replicated across six nodes in a hybrid network; the resulting certificates include QR codes for verification (Cardenas-Quispe & Pacheco, 2025). The system reported 2.97 seconds for initial registration, 0.96 seconds for signing, and 0.12 seconds for Byzantine consensus, but the authors note that scalability in more complex applications still needs to be evaluated (Cardenas-Quispe & Pacheco, 2025). These results describe a prototype, not performance that can be generalized to universities with different workloads, policies, and networks.

The workflow highlights the separation between the issuing authority, the submitting holder, and the verifying third party. This separation reduces the need to exchange copies by mail or to request case-by-case confirmations, but it does not eliminate institutional responsibility for issuance. In EduCert-Chain, the combination of ECDSA, SHA-256, Raft consensus, CouchDB, and Docker containers was evaluated with two institutions of higher education; the average performance was 34.95 transactions per second for queries and 32.23 for opening, with average latencies of 4.21 and 2.05 seconds, respectively (Rani et al., 2024). The measurement illustrates that the choice of network and state database affects both the verifier’s experience and operational capacity.

Verification of diplomas, certificates of competence, and microcredentials

Verification can be limited to a single diploma or can encompass diverse educational pathways. ElimuChain proposes a decentralized application for certificates from different levels and institutions, using IPFS and smart contracts on the Binance Smart Chain, and aims to provide employers with a single point of reference (Said et al., 2025). BlockMEDC applies a similar concept to the Moroccan context and automates issuance, management, and verification through contracts on Ethereum Layer 2 and storage on IPFS (Fartitchou et al., 2025). In both cases, the utility depends on institutions adopting compatible formats and on verifiers accepting the credential as sufficient evidence.

Microcredentials require additional attributes: competencies, levels, evidence, the assessing entity, and the possibility of accumulation within a learning pathway. The system, based on Hyperledger Besu and IPFS, records metadata and enables the tracking of non-curricular achievement credits through role-based access control (Syaifudin et al., 2025). A verifiable credentials approach can break down the document into a reusable template and value matrices, reducing the size of the representation and allowing a compact fingerprint to be exchanged via a QR code (Chotikakamthorn et al., 2024). Portability, therefore, requires more than simply storing a PDF: it demands describing the meaning of each attribute and its relationship to the issuer.

Revocation, recovery, and traceability as conditions for trust

Immutability does not equate to permanent validity. A credential can be revoked due to administrative error, proven fraud, or loss of institutional authorization, and the system must distinguish between the historical issuance record and the current status. A proof-of-authority-based model incorporates a list of files to revoke issued certificates (Chandra et al., 2024). The study on Morocco adds a Byzantine-fault-tolerant distributed revocation mechanism, using smart contracts to automate both verification and revocation (Alj et al., 2025).

Recovery raises a different issue: the holder may lose a key, switch devices, or need to prove a credential years later. The GAVIN architecture addresses issuance, verification, and recovery through multiple chains, but the qualitative assessment identified concerns regarding costs, official standardization, feasibility, and sustainable governance models (Delgado‐von‐Eitzen et al., 2025). Therefore, a reliable design must record who revokes, why, under what authority, and how the change is communicated to verifiers who retain older copies. These conditions directly lead to privacy and interoperability.

Privacy and Interoperability: From On-Chain Anchoring to Verifiable Credentials

Zero-knowledge proofs to reveal only the necessary attributes

Directly publishing diplomas on a public blockchain can expose names, dates, identifiers, and academic results. Zero-knowledge proofs allow one to demonstrate a proposition—such as possession of a qualification or fulfillment of a requirement—without revealing all the underlying data. ZKBAR-V integrates zkEVM contracts to verify credentials without exposing their content and combines decentralized identifiers with a separation between public and private information (Moya et al., 2025). The VeriZKP architecture offloads cryptographic computation off-chain and uses verifier contracts to perform gas-free checks on Ethereum query functions (Gatea et al., 2025).

Selective disclosure changes the focus of the verification. An employer might need to confirm a specific credential, while a regulatory authority might also require the issuing institution and the validity date. The hybrid design by Surekha and her co-authors uses PLONK-style zero-knowledge proofs to reveal limited attributes; in their synthetic evaluation, it disclosed a maximum of 42 bytes of attributes and achieved a false acceptance rate of 0.12% (Surekha et al., 2025). These results are based on 100,000 synthetic attestations, including 25,000 adversarial samples; therefore, they do not replace an evaluation using real credentials and diverse users.

Privacy also depends on metadata. A cryptographic fingerprint does not reveal the document itself, but repeated public queries may allow one to infer that a person possesses a certain credential. The Oasis Sapphire model keeps records encrypted using confidential contracts executed in a trusted execution environment; its costs and times are theoretical projections, not measurements from an operational educational deployment (Sharma et al., 2025). The comparison indicates that confidentiality can be achieved through different techniques, with varying trust assumptions: cryptographic proofs, layer separation, or trusted hardware.

Self-Sovereign Identity, W3C Standards, and Inter-Institutional Portability

Self-sovereign identity shifts control over the presentation of their data to the student. A review of the field links this approach to greater portability, a reduction in silos, and less dependence on central repositories, although it also identifies issues related to scalability, privacy, and key management (Chan et al., 2025). Instead of asking each institution to rebuild the record, the holder retains signed credentials and presents them to different verifiers. Independence, however, does not mean the absence of authorities: issuers must be recognizable, their keys must be managed, and their claims must be revocable.

Technical compatibility requires common models. The W3C Verifiable Credentials standard provides a general framework for expressing issuer, holder, attributes, and proof, but some blockchain proposals do not adopt this model (Chotikakamthorn et al., 2024). Their method separates a template from the corresponding values and proposes full or partial on-chain storage, which reduces resource requirements and enables the use of a concise hash for exchange. This approach facilitates small credentials, although compression alone does not resolve the semantic equivalence between academic programs.

Interoperability also has an institutional dimension. A Moroccan consortium brings together universities and accreditation agencies to foster shared trust (Alj et al., 2025). GAVIN aims to cover formal, non-formal, and informal learning, but its participants noted that official standardization remains a prerequisite for adoption (Delgado‐von‐Eitzen et al., 2025). Thus, portability depends on three interrelated layers: a common syntax, understandable semantics, and agreements on who can issue, recognize, and revoke credentials.

IPFS, hashes, and hybrid architectures to separate proofs and personal data

IPFS allows files to be addressed by their content, while the blockchain retains a reference, a hash, or minimal metadata. ZKBAR-V uses IPFS in conjunction with two blockchains to separate public and private information (Moya et al., 2025). BlockMEDC and ShikkhaChain follow a similar approach, with off-chain storage and contracts for issuance, verification, and revocation (Ahsan et al., 2025; Fartitchou et al., 2025). This separation reduces data exposure but does not eliminate the need to control access to the file nor does it guarantee that a distributed reference can be deleted from all nodes.

Hash-anchoring systems offer a more austere alternative. An academic platform computes the SHA-256 hash of the submitted PDF file and records only that hash in a minimal smart contract; verification consists of recalculating it and comparing it to the record (Linn et al., 2025). The method verifies integrity byte by byte, not the truth of the statements contained in the document. If the issuer generates an incorrect credential, the hash will preserve precisely that incorrect version.

The hybrid architecture therefore combines three decisions: what data is retained, who can access it, and what evidence is published. Hyperledger Fabric can isolate diplomas and competency certificates in separate channels, with immutable storage and backup on IPFS (Afrianto et al., 2025). This design reduces exposure among authorized groups but increases administrative and coordination demands. Privacy is not an automatic property of blockchain; it results from data selection, cryptography, access policies, and recovery procedures.

Architectures and Institutional Adoption: Public, Permissioned Networks, and Regulatory Compliance

Hyperledger Fabric and Other Permissioned Networks for Secure Credential Archiving

Permissioned networks restrict validation to identified organizations, a suitable configuration when universities, agencies, and certifying authorities share responsibilities. EduCert-Chain uses Hyperledger Fabric, ECDSA signatures, SHA-256, and Raft consensus, with experimental performance results obtained using Hyperledger Caliper (Rani et al., 2024). Fabric’s two-channel archiving system separates diplomas and competency certificates and assigns validation tasks to administrators, academic authorities, and certifying entities (Afrianto et al., 2025). Hyperledger Besu offers another permissioned variant, featuring smart contracts, access control, and IPFS storage for curricular and non-curricular credentials (Syaifudin et al., 2025).

These architectures maintain explicit institutional governance. This feature can facilitate compliance and revocation, although it reduces decentralization compared to a public blockchain. The Moroccan consortium seeks to distribute trust among universities and accreditation agencies, rather than concentrating it in a single repository (Alj et al., 2025). This choice should not be framed as a trade-off between security and centralization: the empirical question is which actors validate, which information they control, and how disagreements are resolved.

Cost, gas fees, scalability, and update speed on public blockchains

Public blockchains expand open verifiability but introduce transaction costs, congestion-related dependencies, and difficulties in updating states. BlockMEDC uses Ethereum zk-Rollups to reduce costs associated with issuance, management, and verification (Fartitchou et al., 2025). VeriZKP separates the trust anchor from the cryptographic computation and enables gas-free verification in query functions, with proof generation taking 1.02 to 1.63 seconds on standard hardware (Gatea et al., 2025). The result applies only to read queries and should not be extrapolated to operations that modify the chain’s state.

Public prototypes also demonstrate data reduction strategies. The W3C-compliant method reuses templates and compact fingerprints to limit the space occupied on Bitcoin (Chotikakamthorn et al., 2024). ElimuChain is deployed on Binance Smart Chain and compares latency and transaction throughput with previous solutions, while ShikkhaChain combines Ethereum, IPFS, and a decentralized application for validation and revocation (Ahsan et al., 2025; Said et al., 2025). Without standardized metrics across these systems, it is not possible to establish an overall performance ranking.

GDPR, Governance, and Implementation Experiences in Morocco, Bangladesh, and Other Contexts

The GDPR raises tensions between permanent records and rights regarding personal data. One response is to keep identifiable documents off-chain, publish hashes or selective proofs, and limit functions that reveal attributes. GAVIN was designed with a multi-chain architecture geared toward GDPR compliance; the workshop with educational stakeholders revealed perceived utility, but also raised concerns about costs, standardization, and sustainability (Delgado‐von‐Eitzen et al., 2025). DIAR also identifies the protection of student identification and privacy as legal issues related to its implementation (Rustemi & Dalipi, 2026).

National experiences show that adoption depends on the administrative context. BlockMEDC aligns with Morocco’s digital strategies and seeks to connect universities through a low-cost platform (Fartitchou et al., 2025). Another Moroccan design incorporates accreditation agencies and distributed revocation (Alj et al., 2025). In Bangladesh, ShikkhaChain addresses manual procedures through Ethereum contracts, IPFS, QR validation, and permissions for the government, regulators, institutions, and public verifiers (Ahsan et al., 2025). These are proofs of concept, not demonstrations of sustained national adoption, and the literature does not yet provide longitudinal comparisons across these contexts.

Critical Synthesis and Research Gaps: Toward Truly Forgery-Proof Digital Credentials

Convergences in the literature: verifiable authenticity without relying on a single intermediary

The proposals converge on recording a signed assertion, preserving a tamper-resistant fingerprint, and allowing authorized third parties to verify it. Smart contracts automate issuance and status tracking; IPFS separates the file from the record; verifiable credentials provide a portable structure; and zero-knowledge proofs reduce disclosure (Chotikakamthorn et al., 2024; Moya et al., 2025; Syaifudin et al., 2025). The result is verifiable authenticity without each verifier having to contact the issuing university directly.

This convergence, however, does not prove that degrees are literally impossible to forge. An attacker could still steal passwords, enter incorrect data, create a deceptive interface, or present a legitimate credential belonging to someone else. The blockchain protects the consistency of the record, while identity, issuance, and academic interpretation require external controls. A systematic review of blockchain initiatives specifically identifies persistent challenges related to privacy, standardization, adoption, and the relationship with institutional practices (Silaghi & Popescu, 2025).

Ongoing debates between transparency, privacy, decentralization, and institutional control

Transparency facilitates auditing but may reveal the existence of a credential or allow inferences to be drawn about its holder. Privacy protects the student, although it introduces passwords, cryptographic proofs, and access policies that are difficult to manage. Public networks maximize open access; permissioned networks offer organizational control and more predictable updates. No single option alone resolves the governance of issuers, verifiers, and revocations.

The distribution of control also remains an open question. Self-sovereign identity grants the holder the ability to present credentials, but it does not eliminate dependence on recognized issuers or the need to recover lost credentials (Chan et al., 2025). Hybrid designs balance public and private layers, although they multiply components and coordination points (Surekha et al., 2025). The evaluation must simultaneously measure privacy, cost, latency, accessibility, and the legal capacity for revocation.

Empirical gaps: real-world interoperability, adoption at scale, and longitudinal evaluation

The available evidence focuses on prototypes, simulations, testbeds, and synthetic datasets. Although measurements of latency, performance, and evidence generation exist (Cardenas-Quispe & Pacheco, 2025; Gatea et al., 2025; Rani et al., 2024), the studies use different architectures, workloads, and definitions of success. There is a lack of comparisons with existing institutional systems and data on long-term use by students, employers, and regulatory bodies.

Interoperability is also claimed more often than it is demonstrated. There is a need to test exchange between universities in different countries, semantic equivalence of competencies, cross-border revocation, and key recovery. Studies from Morocco and Bangladesh demonstrate contextual adaptation but have not yet established sustained national-level operation (Ahsan et al., 2025; Fartitchou et al., 2025). Future research should combine technical audits, legal studies, cost analyses, and longitudinal tracking of adoption.

Conclusion: Criteria for a Trustworthy Verifiable Credentials Infrastructure

From an immutable registry to a holder-centered educational ecosystem

A trustworthy infrastructure must distinguish between record integrity, issuer authenticity, holder identity, and credential validity. Blockchain provides traceability, but its value depends on auditable contracts, protected keys, explicit revocation, interoperable formats, and privacy-preserving storage. Verifiable credentials, self-sovereign identity, and zero-knowledge proofs allow students to present only the necessary evidence (Chan et al., 2025; Moya et al., 2025).

Priorities for Future Implementations and Comparative Evaluations

Implementations should compare public, permissioned, and hybrid networks using common metrics for cost, latency, recovery, privacy, and adoption. They should also test W3C standards across real-world institutions, include non-curricular credentials, and evaluate the governance of issuers and accrediting agencies. The ultimate goal is not to store more information on a blockchain, but to provide the holder with a portable, understandable, and revocable proof whose validity can be verified without unnecessarily exposing their data.

References

• Afrianto, I., Atin, S., Aldiansyah, R., & Hasibuan, Z. A. (2025). Secure and private archiving of academic credentials: A multi-channel blockchain approach for diplomas and certificates of competency. In International Conference on Informatics and Computing (ICIC) (pp. 1–7). https://doi.org/10.1109/icic68054.2025.11309380
• Ahsan, F., Israt, K., Jayed, A., Khalil, S., Ibrahim, Nusrat, J., & Jarif, K., Md. (2025). ShikkhaChain: A Blockchain-Powered Academic Credential Verification System for Bangladesh. ArXiv.Org. https://arxiv.org/pdf/2508.05334
• Alj, K. S., Akkaoui, R., & Alj, Y. S. (2025). A blockchain-based framework for academic credential verification and revocation: Morocco case study. In IEEE Congress on Information Science and Technology (CiSt) (pp. 571–576). https://doi.org/10.1109/cist65886.2025.11224125
• Cardenas-Quispe, M. A., & Pacheco, A. (2025). Blockchain ensuring academic integrity with a degree verification prototype. Scientific Reports, 15(1), 9281. https://doi.org/10.1038/s41598-025-93913-6
• Chan, W., Gai, K., Yu, J., & Zhu, L. (2025). Blockchain-Assisted Self-Sovereign Identities in Education: A Survey. Blockchains, 3(1), 3. https://doi.org/10.3390/blockchains3010003
• Chandra, T. M., Kaur, M., Rakesh, N., Gulhane, M., & Maurya, S. (2024). A novel blockchain-based framework for publishing, verifying, and storing digital academic credentials from universities. International Journal of Information Technology, 16(5), 3273–3281. https://doi.org/10.1007/s41870-024-01842-w
• Chotikakamthorn, N., San, A. M., & Sathitwiriyawong, C. (2024). On-chain verifiable credentials with applications in education. ECTI Transactions on Computer and Information Technology (ECTI-CIT), 18(3), 342–355. https://doi.org/10.37936/ecti-cit.2024183.256091
• Delgado‐von‐Eitzen, C., Anido, L., Iglesias, M. J. F., & Molina, M. R. (2025). Qualitative analysis of a blockchain-based system for verifying academic credentials that complies with the GDPR: The GAVIN project. Applied Sciences, 15(22), 11958. https://doi.org/10.3390/app152211958
• Fartitchou, M., Lamaakal, I., El Makkaoui, K., El Allali, Z., & Maleh, Y. (2025). BlockMEDC: A blockchain smart contracts system for securing Moroccan higher education digital certificates. IEEE Access, 13, 39152–39175. https://doi.org/10.1109/access.2025.3546177
• Gatea, K. A., Shoja, E., Khazaee, P. R., & Nahid-Titkanlue, H. (2025). VeriZKP: A privacy-preserving, gas-free, and granular educational credential verification system on Ethereum using zero-knowledge proofs. Management Strategies and Engineering Sciences, 1–12. https://doi.org/10.61838/msesj.314
• Linn, H. P., Myat, A. K., Naing, H. K., Zaw, H. M., Min, S. M., Aung, C. K. K., & Mon, A. C. (2025). Blockchain-Enabled Verifiable Credentials and Skill Endorsements in an Academic-to-Career Platform. In International Conference on Advanced Information Technologies (ICAIT) (pp. 1–6). https://doi.org/10.1109/icait68809.2025.11236750
• Moya, J. A. B., Ayoade, J., & Uddin, Md. A. (2025). A zero-knowledge proof-enabled blockchain-based academic record verification system. Sensors, 25(11), 3450. https://doi.org/10.3390/s25113450
• Rani, P., Sachan, R. K., & Kukreja, S. (2024). Educert-chain: a secure and notarized educational certificate authentication and verification system using a permissioned blockchain. Cluster Computing, 27(7), 10169–10196. https://doi.org/10.1007/s10586-024-04469-5
• Rustemi, A., & Dalipi, F. (2026). From concept to practice: A blockchain-based solution for secure and efficient academic credentials in higher education. IET Blockchain, 6(1). https://doi.org/10.1049/blc2.70030
• Rustemi, A., Dalipi, F., Atanasovski, V. M., & Risteski, A. (2024). DIAR: a blockchain-based system for the generation and verification of academic diplomas. Discover Applied Sciences, 6(6). https://doi.org/10.1007/s42452-024-05984-1
• Said, S. H., Sinde, R., Kosia, E., & Dida, M. A. (2025). A comprehensive blockchain-based system for educational qualifications management and verification to counter forgery. IEEE Access, 13, 31562–31589. https://doi.org/10.1109/access.2025.3542545
• Sharma, M., Garg, S., Ranjan, P. K., Gautam, A., Sharma, A., Thakur, G., & Kumari, N. (2025). Confidential credentials: Privacy-First academic verification on Oasis Sapphire. In International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO) (pp. 1–5). https://doi.org/10.1109/icrito66076.2025.11241228
• Silaghi, D. L., & Popescu, D. E. (2025). A systematic review of blockchain-based initiatives in comparison to best practices used in higher education institutions. Computers, 14(4), 141. https://doi.org/10.3390/computers14040141
• Surekha, S., Kumar, B. S., P.K. Dhanalakshmi, Usha, R., Dhasarathan, N., & Selvan, R. S. (2025). Blockchain-Enabled Digital Credentialing: An Interoperable Hybrid Architecture for Academic Integrity and Verification (pp. 481–486). https://doi.org/10.1109/ic-eeta66496.2025.11548387
• Syaifudin, Y. W., Prasetya, A. P., Djunaedi, R. H., Saputra, P. Y., Htet, H., Sunandar, A., Apriliyanto, S., Al Hadid Firdaus, V., & Maskur. (2025). Towards trustless academic records in higher education: Integrating blockchain and IPFS for verifiable student credentials. In International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies (3ICT) (pp. 1–8). https://doi.org/10.1109/3ict68299.2025.11442139