How verification works
Written for someone deciding how much weight to put on a certificate from this site. It includes the parts that are currently weak.
Checking a certificate
Every certificate carries an ID in the form AICERT-YYYY-XXXX-XXXX. Enter it at neurolearnai.uk/verify, or scan the QR code printed on the certificate, which resolves to the same page. The page reports one of four states:
- Verified — a record exists and its details match the ID.
- Sample — a demonstration record. No such learner exists.
- Not found — no record, or the ID was mistyped or invented.
- Integrity check failed — the details do not match the ID.
What we can honestly claim today
A certificate ID carries a short derived signature over the course and score it encodes. That is enough to reject an invented ID: typing a plausible-looking AICERT-2026-AAAA-BBBB into the verifier returns “not found”, not a certificate. Registered certificates are stored server-side, so a certificate earned on one device verifies from any other.
The current limitation, stated plainly
Assessments are graded in your browser, and the key used to derive certificate IDs is present in the JavaScript this site sends you. Someone willing to read that code can construct a certificate ID without taking an assessment. We are not going to pretend otherwise while it is true.
What that means for you
- As an employer: treat a verified certificate as evidence that a record exists in our register, not as proof that a specific person did the work. If the credential matters to your decision, ask the candidate about the material.
- As a learner: your certificate is genuine and verifiable. The weakness is that we cannot currently prove that a forged one is forged.
What we are building, and what unlocks each claim
These are not aspirations we are quietly counting as done. Each becomes claimable only alongside the code that makes it true:
- Accounts — so a certificate belongs to a verified email address rather than to whatever name was typed into a box.
- Server-side grading — so the answer key stops being sent to the browser and a score cannot be asserted by the candidate.
- Ed25519 signing with a published public key — so anyone can verify a certificate’s signature independently, offline, without trusting this site’s API.
- Revocation — so a certificate issued in error or obtained dishonestly can be withdrawn, with the verification page showing that.
Until server-side issuance ships, this site will not use the words “cryptographically signed”, “HMAC-SHA256” or “tamper-proof” about its certificates. It used all three; none were true.
The strongest true claim we will be able to make
Once the work above lands: a person with a verified email address, gated by recorded course progress, passed a timed assessment under a server-enforced clock with attempt limits and a cooldown, and the result is signed by an issuer key you can check yourself. Even then it will not prove that the person holding the profile is the person who sat the assessment, and we will say so here.
Reporting a problem
Security issues: security@neurolearnai.uk. See our disclosure policy. Suspected credential fraud: credentials@neurolearnai.uk.