Fake certificates end with one scan
Every verifiable Sanmaan certificate carries a short Certificate ID and a QR code. Anyone — a recruiter, a parent, an auditor — can scan it with a phone camera and see in seconds whether it's genuine, altered or revoked.
The problem
A PDF is easy to edit. A printed certificate is easy to copy.
Edited names and grades
“Participant” becomes “Winner”, a name is swapped, a date moved. On a PDF that takes a minute.
Checking means phone calls
Recruiters and admissions teams email the issuer and wait. Many never ask — and the fake gets through.
Genuine holders lose out
When certificates can't be checked, real ones are worth less too.
How it works
Short ID, small QR, signed by you
You turn on verification
In the app, tick QR verification and type your organisation's name. Your browser creates a signing key that stays on your computer.
Each certificate gets an ID
A short Certificate ID like
7KQ2M-9XAPZ, a short link and a small, easy-to-scan QR are printed on it.A signed record is saved
Only the verification record — name, what it's for, date, organisation, ID — signed with your key, is stored so it can be looked up.
Anyone checks it
Scan the QR, open the link, or type the ID at sanmaan.pages.dev/v/. The signature is checked and the result shown.
Four possible answers
- ✓ Genuine
Signed by the issuer and unchanged.
- ✕ Altered
Something doesn't match the signature.
- ⦸ Revoked
The issuer cancelled it.
- ? Not found
No certificate with that ID.
Try it
See a real check — and a tampered one
This sample certificate was signed with a throwaway demo key. Open it to see Genuine; then open the edited copy, where one detail was changed after signing, and watch the check fail.
Genuine
- Awarded to
- श्रीकृष्ण त्रिपाठी
- For
- Spoken English Workshop
- Date
- 12 November 2026
- Issued by
- Sanmaan Demo Academy
- Key fingerprint
- CCCA-7127-0BA7-CCC3
A demo certificate in the earlier long-link format, which keeps working.
For issuers
Publish your fingerprint so people know it's you
A signature proves a record hasn't changed and which key signed it. Your key fingerprint — four short groups like CCCA-7127-0BA7-CCC3, shown in the app — tells people the key is yours. Put it where they already trust you:
- On your website's certificates or about page
- In the email that sends the certificates
- On the notice board or in the prospectus
“Certificates issued by Kadak Tech Academy can be checked at sanmaan.pages.dev/v/. Our issuer key fingerprint is XXXX-XXXX-XXXX-XXXX.”
Back up your issuer key (one button in the app) and use the same key on every computer that issues certificates. If the key is lost, new certificates will carry a new fingerprint — publish both.
Privacy
Only what's printed, only if you switch it on
Sanmaan makes certificates in your browser and never uploads your recipient list, designs, logos or signatures. When you turn on QR verification, the one thing stored on our server (Cloudflare D1) is each certificate's verification record — recipient name, what it's for, date, organisation, certificate ID and signature — so it can be looked up. Records stay until you revoke the certificate or ask us to delete them. Certificates without verification store nothing. Read the privacy policy.
FAQ
Verification questions
What does the person checking need?
Just a phone camera or a browser. They scan the QR, open the short link, or type the certificate ID at sanmaan.pages.dev/v/ (which also has a “Scan QR with camera” button). No app, no login.
What does the check show?
Genuine, Altered, Revoked or Not found — together with the recipient, what the certificate is for, the date, the issuing organisation, the issue date and the issuer's key fingerprint.
Can Sanmaan change or fake a record?
No. Each record is digitally signed by the issuer's own key, which is created and kept in the issuer's browser. We never have it, so a record we (or anyone) changed would fail the check.
What is stored on Sanmaan's server?
Only for certificates with verification turned on: the verification record — recipient name, what it's for, date, organisation, certificate ID and signature. The recipient list, designs and everything else never leave the issuer's computer. Certificates without verification store nothing.
Can a certificate be cancelled?
Yes. The issuer can revoke a certificate — for example one issued by mistake — and from then on the check shows “Revoked”.
How long are records kept?
Until the issuer revokes the certificate or asks us to delete it. See the privacy policy.
What about certificates made before short IDs?
Their long /v/#… links keep working, and are checked the same way on the visitor's device.
Is QR verification free?
It's part of Pro — included in the Event Pass and Lifetime plans. Checking a certificate is always free for everyone.
More
Keep reading
Make certificates people can trust.
असली प्रमाण पत्र, एक स्कैन में।