What is a digital badge? Open Badges 3.0 and verifiable certificates

Short definition

A digital badge is a digital document that shows a programme has been completed or a competence achieved, carries the electronic signature of the issuing institution and can be verified online at any time. YÖK's Micro-credentials Procedures and Principles define it as "a digital certificate providing a verifiable, portable representation of micro-credentials that complies with international standards" (art. 4 (opens in a new tab)).

A badge has an image, but what makes it a badge is the signed data record behind the image. The record carries, in structured fields, who awarded what to whom, for which achievement, on which date and under which conditions.

How does a digital badge differ from a PDF or a printed certificate?

Adding a QR code to a PDF does not by itself make it verifiable; it must also be possible to check that the address behind the QR code really belongs to the issuer and that the certificate content matches the record. See The fake certificate problem.

What is Open Badges 3.0?

Open Badges is the digital badge standard of 1EdTech, the education technology standards body. With version 3.0 the badge moved onto the W3C Verifiable Credentials Data Model 2.0 (opens in a new tab). An Open Badges 3.0 badge is therefore also a verifiable credential.

The main parts of an Open Badges 3.0 badge are (1EdTech implementation guide (opens in a new tab)):

• issuer: The profile of the issuing institution: name, address and where its signature verification key can be found.
• credentialSubject: The holder and the achievement earned. Identity can be carried as a hash instead of in clear text.
• achievement: The definition of the achievement: name, description, criteria, credits and framework alignments (such as a TQF level).
• validFrom / validUntil: Start and, if any, end of validity.
• credentialStatus: The list that shows revocation or suspension.
• proof or signature: The cryptographic signature created with the institution's key.

The 11 Annex 1 fields of the YÖK rules map directly to this structure: programme name, learning outcomes, ECTS, TQF level, assessment method and success criteria sit in the achievement, the institution in the issuer and the holder in the credentialSubject.

How is a badge verified?

When verifier software receives a badge, it checks in turn:

1. Structure: Does the document follow the standard?
2. Issuer: Who signed it and how is that identity confirmed?
3. Signature: Does the content match the signature made with the institution's public key?
4. Time: Is the document within its validity period?
5. Status: Has the institution revoked or suspended it?

A common method for issuer identity is did:web (opens in a new tab): the institution's public key is published in a document under a web domain. Verification can therefore be done without contacting the platform that issued the badge.

Revocation uses the W3C Bitstring Status List (opens in a new tab). Each document is represented by a single bit; the list holds no personal data, and when an institution revokes a document every distributed copy shows as revoked at the next verification.

Can a badge file be verified on its own?

Yes. Open Badges allows the signed data record to be embedded in the badge image, which is called "baking". In PNG files the record is stored in the image metadata, in SVG files inside the document. A badge image forwarded by email can therefore still be uploaded to a verification page and checked. Methods are covered in How to verify a certificate.

Badges and privacy

A badge carries its information everywhere it is shared, so good practice puts only what is necessary into a widely shared badge:

• Identity: National ID numbers or email addresses are not written in clear text; a salted hash is carried instead, which a verifier can compare with information the person provides.
• Grades: Exam scores and detailed assessment results are not embedded; where needed they are kept at a separate, access-controlled evidence address.
• Visibility: The holder decides who sees the badge; verification result pages are kept out of search engines.

Equivalents in Europe and Turkey

• Europass Digital Credentials: The EU's digital credential infrastructure also uses the W3C verifiable credentials model (Europass (opens in a new tab)).
• CLR 2.0: 1EdTech's Comprehensive Learner Record (opens in a new tab) combines several badges into one signed learning record, useful for recognition applications.
• Ministry of Industry and Technology Digital Badge Platform: An institution-independent platform in Turkey for technology training.

DijiUni signs badges in the Open Badges 3.0 and W3C Verifiable Credentials 2.0 standards with each institution's own did:web identity and key, and publishes revocation and suspension through a Bitstring Status List. Holders keep their badges in a digital wallet.