Issue once. Verify anywhere.
Short answer: the university signs each credential with a key held in a hardware security module and records a SHA-256 commitment on the Polygon blockchain. A verifier recomputes that fingerprint and checks the signature, the on-chain record and the credential’s current status — eight checks in total — without needing an account.
The three steps
- STEP 01
Issue
The university imports students and results, designs a bilingual template and sends a batch for approval. A second officer approves it (maker–checker), and only then is anything issued.
- STEP 02
Sign & anchor
Each certificate is rendered to PDF, signed as a W3C Verifiable Credential with the university’s HSM-protected key, and a SHA-256 commitment is anchored on the blockchain — individually or in a Merkle batch.
- STEP 03
Verify anywhere
Students share a link or QR code from their wallet. Employers and admissions offices verify for free — no account — and see eight independent checks with a plain-language result.
What exactly goes on the blockchain?
Only a commitment: a domain-separated SHA-256 hash of the credential ID, its version, the PDF’s fingerprint and the signed credential’s fingerprint. It reveals nothing about the student, but any change to the document or the credential produces a different value.
Credentials can be anchored one by one, or many at once under a single Merkle root; each credential then keeps a short Merkle proof linking it to that root, which keeps transaction fees low for large convocations.
A certificate is shown as issued only after the transaction is confirmed. Corrections, suspensions, reinstatements and revocations are recorded on the same smart contract, so the on-chain history always matches what verifiers see.
Key facts
- Product: VachakCred — blockchain-anchored academic credential issuance and verification.
- Primary users: Indian universities and colleges (issuers), students (holders), employers and admissions offices (verifiers).
- Verification: free, no account; by credential ID, link, QR code or PDF upload; eight independent checks.
- Standards: W3C Verifiable Credentials 2.0, Data Integrity (eddsa-jcs-2022, ecdsa-jcs-2019), did:web, SHA-256, Merkle batching.
- Blockchain: EVM smart contract on Polygon (Amoy for pilots, mainnet for production); only hash commitments on-chain.
- Security: HSM-backed signing keys (Cloud KMS), row-level tenant isolation, maker–checker approvals, MFA, append-only audit log.
- Languages: English and Hindi (Devanagari) interface and certificate templates.
- Lifecycle: corrections replace a credential on-chain; suspension, reinstatement and revocation are recorded on-chain.
The eight verification checks
- 01
Existence
The credential ID resolves to a record issued through VachakCred.
- 02
Issuer authenticity
The issuing university is active, and its DID matches the on-chain issuer registry.
- 03
Digital signature
The W3C Verifiable Credential’s Data Integrity proof is checked against the university’s published key.
- 04
Document integrity
An uploaded PDF is hashed (SHA-256) and compared byte for byte with the document the university issued.
- 05
Blockchain anchor
The credential commitment is read back from the smart contract, directly or through a Merkle proof.
- 06
Current status
The database and the chain must agree on whether the credential is active or suspended.
- 07
Revocation
Revoked credentials fail verification, with the reason the university recorded.
- 08
Latest version
If a corrected credential replaced this one, the verifier is told and pointed to it.
Security and privacy by design
- No personal data on-chain
- Only a domain-separated SHA-256 commitment is anchored. Names, marks and photos never leave the university’s private storage.
- Keys in hardware
- University signing keys and the blockchain relayer key live in a cloud HSM (Cloud KMS). Private keys are never exported.
- Tenant isolation
- Each university’s data is isolated by PostgreSQL row-level security, enforced by the database itself.
- Open standards
- W3C Verifiable Credentials 2.0, Data Integrity (eddsa-jcs-2022 / ecdsa-jcs-2019), did:web and an EVM smart contract (Polygon).
- Signed PDFs
- Every PDF carries a detached digital signature over its SHA-256 digest, so a single changed byte is detected.
- Accountable operations
- Two-person approval for issuance and revocation, MFA for administrators, and an append-only audit log.