Blockchain Certificate Verification with MySQL
A degree verifier where the answer comes from the chain, not from a status column anyone can edit.
One-time purchase — source code, database, the written report and everything below, all in a single ZIP.
No account needed — pay & download instantly
Look inside the report
Showing the first 12 pages of 62. Tap any page to read it full size — this is the actual Word file you get, not a mock-up.
Screenshots
Tap any screenshot to open it full size. These are from the project actually running — not mockups.
About this project
A certificate verification system built on a blockchain written from scratch in Python - blocks, SHA-256 hashing, a Merkle tree, proof of work and multi-node consensus, none of it borrowed from a library. A university issues degrees, a student keeps them in a wallet, and a company verifies them in three ways: by certificate ID, by scanning the QR code on the PDF, or by uploading the PDF file itself.
The decision that makes this a major project rather than a CRUD app is where the verdict comes from. It is not read out of a status column. When you verify a certificate, the hash of its 10 protected fields is rebuilt from the database row as it stands at that moment and compared with the hash written on the chain. Edit a CGPA straight in phpMyAdmin and the page turns red and names the field that changed. Set the status column back to 'issued' on a revoked degree and it still reports REVOKED, because the revocation is a transaction on the chain. Both of those have automated tests, because a design like this is only worth anything if it cannot be quietly undone by a later edit.
The project also says out loud where the guarantee stops, and this is the part examiners remember. A tamper lab lets you change any column and watch the result. The protected fields are caught immediately. The remarks column is not - it was never inside the hash, so the chain has nothing to say about it. The research module measures this and puts a number on it: 8 of the 13 columns tested are detected, and the 5 that are not were all outside the hash. A blockchain does not protect a database. It protects exactly what was hashed, and nothing more.
Three measurements are produced by running code, not written into the report by hand. Tamper detection across every column. Merkle proof cost against reading a whole block, where a verifier needs 13 hashes (416 bytes) instead of 8,192 (262 KB) - about 485 times less work. And proof of work against difficulty, where each extra leading zero multiplies the effort by roughly 16, measured at 14.3x across five levels. Re-run the study and the numbers update themselves.
MySQL is used properly throughout. Every table is InnoDB with real foreign keys, blocks and transactions are separate tables so the chain can be read in two queries instead of N+1, and the audit log is hash-chained too - delete a line from the middle and the system tells you which entry the break starts at.
Features
- ✓A blockchain written from scratch - blocks, SHA-256, Merkle tree, proof of work, consensus
- ✓The verdict comes from the chain, never from a status column
- ✓The record hash is rebuilt on every check, so edits made in phpMyAdmin are caught
- ✓A tampered certificate names the exact field that was changed, with old and new values
- ✓A revoked degree stays revoked even if the status column is flipped back - there is a test for it
- ✓Tamper lab: change any column and watch what the system says - and when it says nothing
- ✓Honest about its limits: a field outside the hash is not protected, and the study measures it
- ✓Merkle inclusion proof - prove a certificate is in a block without sending the block
- ✓Live benchmark: proof of work cost by difficulty, and Merkle proof against a full scan
- ✓Multi-node consensus where the most-work valid chain wins, so a longer fake chain loses
- ✓Verify three ways - certificate ID, QR scan, or by uploading the PDF file
- ✓PDF verification hashes the file's bytes, catching a PDF edited outside the database
- ✓Certificate PDFs generated with an embedded QR code and the record hash printed on them
- ✓Four roles - university, student, verifier and admin - each with its own dashboard
- ✓A student wallet with expiring, view-limited share links that can be switched off
- ✓Bulk issue from CSV where one bad row does not stop the other three hundred
- ✓An institution cannot issue anything until an administrator approves it
- ✓Hash-chained audit log that reports the exact entry where a break begins
- ✓Public chain explorer - every block, nonce, Merkle root and transaction, no login needed
- ✓REST API with X-API-Key, including batch verification and a downloadable Merkle proof
- ✓Certificate IDs carry 8 random hex characters, so they cannot be walked in sequence
- ✓MySQL with InnoDB, real foreign keys and ON DELETE CASCADE throughout
- ✓Database and tables are created automatically - no .sql file to import
- ✓PBKDF2-SHA256 password hashing with a per-user salt
- ✓Every query parameterised; a SQL injection attempt is part of the test suite
- ✓47 automated self-tests you can run in front of the examiner
- ✓No CDN anywhere - the whole UI works with the internet switched off
Modules
Tools
- • Python 3.8+
- • Flask (web framework)
- • MySQL / MariaDB (XAMPP works out of the box)
- • PyMySQL (database driver)
- • ReportLab (certificate PDF generation)
- • qrcode (QR codes on the certificate)
- • VS Code (or any editor)
- • Any web browser
Requirements
Python 3.8 or newer, and MySQL. XAMPP is the easiest way to get MySQL - install it, open the Control Panel and press Start next to MySQL. Then one command installs the libraries: pip install -r requirements.txt (Flask, PyMySQL, ReportLab and qrcode, about 20 MB). The database and all its tables are created automatically on first run - there is no .sql file to import. Works on Windows, Linux and Mac.
How to run
1. Extract the ZIP.
2. Start MySQL - open the XAMPP Control Panel and press Start next to MySQL.
3. Open CMD and go to the folder: cd path\to\blockchain-certificate-verification
4. Install the libraries: pip install -r requirements.txt
5. Check everything is ready: python check_setup.py
6. Load the demo data: python demo.py
7. Start the app: python app.py
8. Open http://127.0.0.1:5000 in your browser.
9. Login: registrar / registrar123 (university) | student / student123 | verifier / verifier123 | admin / admin123
If MySQL uses a password on your machine, set it once before step 5:
set BCV_DB_PASSWORD=yourpassword
Before a viva, also run 'python selftest.py' - 47 checks pass in front of the examiner. To regenerate the research numbers used in the report, run 'python -m research.study'.The same steps are in README.md inside the ZIP, along with a troubleshooting table.
What you get in the ZIP
- 📁 Full source code — commented throughout, so you can explain it in the viva
- 🗄️ Database — the schema builds itself on first run, with sample data
- 📖 README.md — step-by-step run instructions, database design and troubleshooting
- 📄 Full project report (Word) — Written out and formatted for AKTU — not an outline you have to fill in
- 📊 Presentation (PPT) — Ready for the final viva presentation
- 📝 Synopsis (Word) — The short write-up your guide asks for before approval
- ❓ Viva questions with answers — The questions examiners actually ask about this project
- 📐 12 ready-made diagrams — DFD, ER, use case, sequence and architecture, as images you can paste straight into the report