A certificate anyone can check in ten seconds.
A digital certificate is the same award your institution prints today, issued as a signed data file with a printable design attached. The graduate shares one link. An employer, a ministry or a university abroad opens it and sees who issued it, when, for what — and whether it is still valid. No account. No phone call to your office.
Built on Open Badges 3.0, the 1EdTech standard used by universities and training bodies worldwide. Verification is free — to anyone, permanently.
- Signature valid — Pass
- Issuer verified — Pass
- Not revoked — Pass
- Within validity period — Pass
What a digital certificate actually is — and is not.
The word gets used for anything from a PDF attachment to a picture on LinkedIn. Here is the version that holds up when a verifier asks hard questions.
A signed record with a design attached
- A small data file that names the issuer, the recipient, the achievement, the criteria and the date
- Signed by your institution’s key, so any change breaks the signature
- Carries a status — valid, suspended or revoked — that verifiers read live
- Rendered into the printable certificate and the badge image you already know
A prettier PDF, or a picture
- A PDF can be edited in five minutes and nobody can tell
- A badge image on a profile proves only that someone has the image
- A link to a page on our site proves only that we say so — which is why the signature and the issuer’s public key are what a verifier checks, not our word
- It does not replace the paper your graduates need for legalisation abroad. It travels alongside it
Three people, one record
- The issuer — a university, a training provider, a professional body — defines the award and signs it
- The recipient keeps it in a wallet, prints it, shares a link, adds it to LinkedIn
- The verifier — an employer, a ministry, another university — opens the link and reads the verdict. No account with anyone
Where the time goes today, and where it stops going.
Every figure below is dated and sourced in our records.
| Situation | Today, at most institutions | With a verifiable credential |
|---|---|---|
| A graduate loses the scroll | 21 dayscounter form · police report · memo · post. Fee RM 100 | 3 daysonline request · register match · fee · reprint with Reprint overstamp · courier. Same fee, shorter queue |
| An employer wants to confirm a degree | Email or phone to the registrar. Office hours. Days. Often nobody replies | Opens the link on the CV. Valid · signature verified, in seconds, at 2 a.m. in Riyadh |
| Convocation, 5,000 graduates | 300 rowsis the Bulk Create ceiling in the design tool most offices use — so it is seventeen exports, or a mail-merge someone maintains | 1 batchone spreadsheet, pre-flight before anything is signed, the failed row retries alone while the other 4,999 stay issued |
| HRD Corp-claimable training | 2.8 million training placesapproved training places in 2025, most closed with a PDF nobody can check later | Each completion is a signed record the employer’s HR system, an auditor or the next employer can verify without asking the provider |
| A credential is withdrawn | The PDF is already in circulation. There is no way to tell the people holding it | The status list flips. Every verifier from that moment sees Revoked, with the date |
| Your Moodle already knows who passed | 526registered Moodle sites in Malaysia, and the pass list is typed out again into something else | The roster comes across. Nothing is typed twice. Designed, not released |
Six places a verifiable credential does work in Malaysia.
Not every award needs one. These are the ones where somebody downstream has to check it — and today cannot.
Convocation scrolls and replacements
Every graduate gets the printed scroll and a verifiable record with the same serial. A replacement years later is a workflow, not a re-export.
Recipient prints, shares a link, adds to LinkedIn · Verifier an employer or an overseas admissions office
Skills training and HRD Corp courses
Completion becomes a record the sponsoring employer can file and a future employer can check — instead of a PDF that proves nothing after the trainer’s website changes.
Recipient keeps it across jobs · Verifier HR, an auditor, a levy claim
Micro-credentials and short courses
Stackable awards with explicit criteria and, where you set one, an expiry. Aligned with how MQA describes micro-credentials: small, assessed, and recorded.
Recipient builds a stack toward a larger award · Verifier the next programme’s admissions
Professional bodies and CPD
Membership standing and continuing-education hours as credentials that expire and renew, so a lapsed member is visibly lapsed.
Recipient shows current standing · Verifier a client, a regulator, a tender committee
Internal corporate certification
Product, safety and compliance training with a record that outlives the LMS licence. Bilingual templates, one issuing key per legal entity.
Recipient carries it between subsidiaries · Verifier the site supervisor, the group auditor
Events, workshops and exhibitions
Participation and role — speaker, judge, exhibiting artist — as a record that stays checkable after the event page is gone.
Recipient a portfolio line that verifies · Verifier a gallery, a scholarship panel
Six steps. Two of them are yours.
Most of the work is checking before signing, because a signed credential and a printed sheet cannot be recalled.
Define
Name the award, its criteria and, if any, its expiry. Once, per programme.
YouDesign
Bilingual BM/EN templates, your seal, your fonts. The same design prints at 300 dpi and renders on screen.
YouPre-flight
The spreadsheet is checked row by row. A missing value is an error, not a blank line on a certificate.
CertLinkSign
Each credential is signed with your institution’s key and given a serial. The failed row waits; the rest do not.
CertLinkDeliver
Email with a claim link, wallet access, PDF and PNG, and the print run for the ceremony.
CertLinkVerify
Anyone opens the link or scans the QR. Valid, expired or revoked — as text, never colour alone.
Anyone
What is signed, and what deliberately is not.
An abbreviated look at the record behind the certificate. This is what a verifier’s software reads.
{
"type": ["VerifiableCredential", "OpenBadgeCredential"],
"issuer": { "id": "did:web:id.certlink.io:org:stti",
"name": "Sabah Teacher Training Institute (sample)" },
"validFrom": "2026-10-12T01:00:00Z",
"credentialSubject": {
"identifier": [{ "identityHash": "sha256$…", // not the email
"salt": "…" }],
"achievement": {
"name": "Digital Pedagogy Practitioner · Level 1",
"criteria": { "narrative": "…" },
"inLanguage": "en" }
},
"credentialStatus": [
{ "statusPurpose": "revocation", "statusListIndex": "…" },
{ "statusPurpose": "suspension", "statusListIndex": "…" }
],
// signed as a compact JWS · kid → published JWKS
}- The issuer is a resolvable identity.A did:web and a published key set. Old keys are never removed, so a 2026 credential still verifies in 2036.
- The recipient’s email is not in it.A signed record cannot be edited later, so anything personal inside it would be permanent. Only a salted hash goes in; the wallet does the matching.
- Name, criteria and description are mandatory.Not because we say so — dropping them is among the top reasons credentials fail 1EdTech review.
- Two status lists, not one.Revocation and suspension are separate. One shared list would mean lifting a suspension also lifts a revocation.
- Validated against what the specification shipped.The official JSON Schema and JSON-LD contexts, as a merge-blocking check on every change to our code.
The graduate gets a link. The employer gets an answer.
Neither of them needs an account with us. That is the point of the standard, and it is also how verification stays free.
Jovita, your certificate for Digital Pedagogy Practitioner · Level 1 has been issued by the Sabah Teacher Training Institute (sample).
Open your certificate →Bahasa Melayu · English · 中文 · 日本語 · 한국어 — the notice and the wallet follow the recipient’s language. The award itself follows the programme’s.
- Recipient
- J****a G******d (masked on the public page)
- Award
- Digital Pedagogy Practitioner · Level 1 · 40 learning hours
- Issuer
- Sabah Teacher Training Institute (sample) · key published (did:web)
- Issued
- 12 October 2026, MYT · valid until 12 October 2029
- Status
- not revoked · not suspended
- Profile
- Open Badges 3.0 · Verifiable Credentials 2.0
Every state is written out. Hold a certificate? Check it here
A verifier should not have to trust us.
Open Badges 3.0 over W3C Verifiable Credentials, for one practical reason: anyone can check a credential without an account with us, and keep checking it after our contract with the issuer ends.
- The signature is the proof. Not our database, not a chain. Anyone with the issuer’s published key can verify the record with standard tooling.
- What it depends on, said out loud. The issuer’s key address, the status lists and the context files must stay online. So they are frozen — they do not move for a redesign, a rebrand or a change of vendor.
- Verification is free, permanently. Public universities here already verify graduates for free. A paywall would simply not be used.
- There are zero 1EdTech-certified Open Badges organisations in Malaysia or ASEAN today. We are not certified yet either. We will name the date when we hold the certificate, and not before.
If the contract ends
When a contract ends, the verification path for credentials already issued keeps working. The retention period and conditions are set in the individual agreement.
On request we export the minimum verification dataset — the credential itself, the public key document and the status lists. That data belongs to the issuing institution.
If an institution’s contract is suspended or terminated, we do not block verification of credentials recipients already hold.
- 1EdTech Open Badges certified organisations in Malaysia or ASEAN: zero · Source · Checked 2026-08-24
Paper, PDF, or a verifiable credential.
You will keep issuing the first one. The question is what travels with it.
| Question a verifier asks | Printed certificate | PDF by email | Open Badges 3.0 credential |
|---|---|---|---|
| Is it genuine? | Seal and paper stock — checkable by an expert, not by HR | No way to tell. Edited in minutes | Signature verifies or it does not |
| Who issued it? | A name on the sheet | A name on the sheet | A resolvable identity with a published key |
| Is it still valid? | Unknown after the day it was printed | Unknown | Live status: valid · suspended · revoked |
| What exactly was assessed? | A title | A title | Title, description and criteria, machine-readable |
| Can it be checked without contacting the issuer? | No | No | Yes — by anyone, free, without an account |
| Does it survive the vendor? | Yes | Yes, as a file | Yes, as long as the issuer’s key and status addresses stay published — which is why they are frozen |
| Does it survive a consular queue? | Yes — that is its job | Not accepted | Not by itself. The printed sheet carries the QR |
| Can the recipient add it to LinkedIn? | A photo | An attachment | A verification link in Licenses & Certifications |
Built for the 5,000-row batch, the bilingual print run and the verifier abroad.
One spreadsheet. Pre-flight names the rows that will fail and why. The rest are issued; the failed row is fixed and retried alone.
Bilingual templates, your seal and fonts, QR placed for you. The console preview, the issued PDF and the verification page come from the same engine, so they cannot drift.
A4 at 300 dpi with the verification QR, for the ceremony and for the legalisation chain that still wants ink on paper.
English, Bahasa Melayu, 简体中文, 日本語, 한국어 — console, wallet, notices and the public verification page. The language etched into a credential is pinned at issue time.
A mistake is corrected by revoking and re-issuing, never by editing — the signed record and the printed sheet are already in the recipient’s hands. Every step is in the audit ledger.
Badge Connect with nothing installed, our own plugin, or LTI 1.3 for any LMS. Dates belong in the conversation, not on this page.
Per institution, per year. Verification is never billed.
Plans are structured by issuing volume and seats. Figures are quoted per institution, in RM, SST stated, with an invoice your finance office can file.
Institution
One issuing organisation, bilingual templates, bulk issuance, wallet, print output, five languages.
Quoted per year · RM · SST stated
Group
Several faculties, campuses or subsidiaries under one account, each with its own issuing key and templates.
Quoted per year
Public sector & agencies
Data-processing agreement, SLA, on-shore hosting discussion and a procurement pack.
By conversation
What is never charged: viewing, downloading or verifying a credential — by the recipient or by anyone else, for as long as it exists.
Still got questions? Pick your seat.
Issuing institution
Why can’t we edit a certificate after it is issued?
Because it is signed, and the signed file and the printed sheet are already with the graduate. Editing would mean two versions in the world. A mistake is corrected by revoking the wrong one — visibly, with a date — and issuing the right one. Pre-flight exists so this rarely happens.
Do we have to stop printing paper?
No. Malaysia is not an Apostille country; a degree used abroad still passes through physical legalisation. The printed sheet stays and carries the verification QR.
What happens to our credentials if we leave CertLink?
They keep verifying. Your issuing key, status lists and context files are at fixed public addresses that we commit to keeping online, and you receive a full export in standard format.
Where is the data hosted, and who is the processor?
Ask us the long version with your data protection officer present. The short version: recipient email never enters the signed record, and a data-processing agreement is part of every institutional plan.
Recipient
Do I need an account to see my certificate?
No. The link in your email opens it. An account — the wallet — is optional and lets you collect credentials from several issuers in one place.
Can I print it, or add it to LinkedIn?
Both. You get a PDF and PNG at print quality, and a verification link that goes into LinkedIn’s Licenses & Certifications section.
Is my email or IC number visible to people who check it?
No. The public verification page shows your name masked unless the issuer’s disclosure setting or you choose otherwise. Your email is not in the credential at all.
Employer or verifier
How do I check a certificate someone sent me?
Open the link or scan the QR on the printed copy. You will see who issued it, when, for what, and whether it is valid, expired or revoked. If the code will not scan, type the serial at certlink.io/verify.
Does it cost anything, or need a login?
No, and no. Not now, not later, not for volume.
Why should I trust your page?
You do not have to. The credential is signed with the issuer’s key and follows an open standard; any Open Badges 3.0 verifier can check it independently of us.
Bring us your worst batch.
A convocation list with duplicate names, missing emails and three date formats. Thirty minutes, your data shape, no slides. Or start smaller: open a sample credential and try to break it.
Replies from a person, in English or Bahasa Melayu.