In short
- A genuine result means the named issuer issued this certificate to the named person, it hasn't changed since, and it's still current.
- It doesn't prove the person in front of you is that person, or that the issuer is accredited for what it certifies.
- Every organization is approved by a person at Nyvarra, and its name is checked against real organizations first.
- Withdrawn, replaced and expired certificates say so plainly. A check that can't finish never shows as a pass.
What a check proves
Every certificate issued on Nyvarra is a signed record kept in Nyvarra's registry. The paper or PDF is a copy of it. A check compares what you have with that record and tells you:
- Who issued it, and what Nyvarra has confirmed about them.
- Who it was issued to, and what for.
- That it hasn't changed since the issuer signed it.
- Whether it still stands: not withdrawn, replaced or expired.
- Issuer
- Example Medical College, organization domain verified Pass
- Signature
- Made with the issuer's registered key Pass
- Contents
- Unchanged since 14 September 2026 Pass
- Status
- Current. Not withdrawn or replaced Pass
What it doesn't prove
- That the person presenting it is the person named. Compare the name with their identity document, as you would with any certificate.
- That the issuer is accredited. Nyvarra confirms who an issuer is, not whether a regulator recognises its courses. If accreditation matters, check with the regulator.
- That the achievement happened as described. The issuer vouches for that. Nyvarra proves the issuer said it, and that nobody has altered what they said.
How a certificate is checked
The same steps run on the verify page, in the API and for the receipt, in this order. A certificate is genuine only if every step passes.
- Find the record
By the serial printed on the certificate, its QR code or link, or the PDF file itself.
- Check the signature
Each certificate is signed with an Ed25519 key when it's issued. The signature is checked against the key in Nyvarra's registry for that issuer, never against a key that came with the certificate, so a forger can't bring their own.
- Check the contents
The record must be exactly what was signed, and its SHA-256 fingerprint must match the one stored when it was issued. The issuer, recipient and certificate IDs inside the signature must match the record too.
- Check the key is still trusted
If the issuer's signing key has been withdrawn, the certificate can no longer be confirmed. Keys replaced in the normal way stay valid for what they signed.
- Check it still stands
Whether the issuer has withdrawn or replaced it, and whether its end date has passed.
What the results mean
Each outcome has its own result, so nobody has to interpret an ambiguous one.
| Result | What it means | What to do |
|---|---|---|
| Genuine | The issuer issued it to the person named, and nothing on it has changed since. | Check the name and details match the copy you were given. |
| Expired | It's genuine, but the issuer made it valid only until a date that has passed. | Accept it only as proof of what was true until then. |
| Replaced | The issuer issued a corrected version. The result links to it. | Ask for the new version, or open it from the result. |
| Withdrawn | The issuer withdrew it, with a reason where they gave one. | Don't accept it as a current certificate. |
| Doesn't match | The record has changed since the issuer signed it. | Don't accept it. The issuer can tell you what they actually issued. |
| Key withdrawn | The key that signed it is no longer trusted. | Don't rely on it until the issuer issues it again. |
| Not found | No certificate has that serial, or no certificate was issued as that exact file. | Check the serial was typed correctly. If it was, treat the document as unconfirmed. |
| Couldn't check | Nyvarra couldn't complete the check just then. | Try again shortly. Never treat this as a pass. |
A withdrawn or replaced certificate keeps its record, so the result can say what happened, but its PDF and other files are no longer served.
Who can issue
Nobody is approved automatically. Every organization that issues on Nyvarra is reviewed and approved by a person at Nyvarra. Before that, its name is checked against organizations already on Nyvarra and against real organizations that aren't, including names that only look similar.
An application that matches a real organization can't be approved until the reviewer has recorded whether the team is that organization, is part of it (a department, chapter or society), or is a different organization.
Once approved, an organization's name is locked. It changes only through a request that Nyvarra reviews and checks again. Certificates already issued keep the name they were issued under.
What the issuer line tells you
Under the issuer's name, every result says what Nyvarra has confirmed about them:
| The result says | Which means |
|---|---|
| Verified institution | The official account of the named organization, proved through the organization's own domain or by Nyvarra confirming it with the organization directly. |
| Verified organization affiliated with … | A department, chapter or society that a Nyvarra reviewer placed under the named institution. The institution itself hasn't confirmed the account. |
| Verified organization | A Nyvarra reviewer approved the organization's application. If it also controls a domain, the hover shows it. |
| Verified student society | A faculty advisor at the university confirmed the society. |
| Verified issuer | A person issuing in their own right, such as a trainer or tutor, who proved they control a website, GitHub account or YouTube channel. They can't use an organization's name. Nyvarra hasn't checked their employer or qualifications. |
| Identity not verified (no check mark) | The issuer has confirmed an email address but hasn't proved who they are. Judge the issuer by its name and what you know about them. |
When a team uses a real organization's name without being its official account, the result says the name was chosen by the issuer and not confirmed by that organization. Official accounts are checked live, so if one is revoked, it stops showing at once, on older certificates too.
Every approved issuer has a public profile in the issuer directory, with its certificates, how many certificates it has issued, and the fingerprints of the keys it signs with.
Checking a PDF file
You can drop a certificate's PDF on the verify page. Your browser works out the file's SHA-256 fingerprint and sends only that; the file itself never leaves your computer.
A match means the file is, byte for byte, the PDF that was issued. No match doesn't always mean a fake: a PDF that was re-saved, compressed, or printed and scanned has different bytes. Check those by the serial printed on them.
Withdrawals and corrections
Issuers can withdraw a certificate, with a reason, or correct a mistake by issuing a replacement. Either takes effect the moment they do it, everywhere: on the verify page, in the API, and for anyone opening an old link or QR code.
- The old certificate's record stays, so the result can say it was withdrawn or replaced, when, and why.
- The old certificate's result links to its replacement, so a checker holding the old version is sent to the new one.
- A correction keeps the original's end date. Fixing a typo doesn't extend validity.
Certificates moved to Nyvarra
Some organizations issued certificates on their own systems and later moved their records to Nyvarra. Those certificates keep the original issuer's signature and serial. Nyvarra adds its own signed statement of when it took custody, and checks both. The result says so, with the date Nyvarra took the record in.
Reporting a suspicious certificate
If someone has shown you a certificate that doesn't check out, or one that checks out but looks wrong, report it from the result page. No account is needed, and you can attach a copy of what you were given. Nyvarra looks at every report.
For how certificates and accounts are protected, see Security. To check certificates from your own software, see the Verification API.