Our work / Open source
Verifiable transcripts, for Moodle
A student issues a transcript of the courses they completed, with final grades and dates. It comes as a PDF with a code and a QR code. An employer or another school checks that code on your Moodle, without an account, and sees exactly what was issued and whether it is still valid. It is free and open source.
- 4.5 to 5.3 Moodle versions, on PHP 8.1 to 8.4
- GPL v3 free to use and change
- Alpha try it on a test site first
Why doesn't Moodle have verifiable transcripts already?
Moodle core has badges and course completion, and certificate plugins cover one course at a time. Core has no document that lists a student's whole record and that a third party can check. So schools export grades to a spreadsheet and email a PDF that anyone could edit, and employers ring the registry to ask if it is real. This plugin keeps the issued record on your Moodle, signs it, and gives the reader a page to check it on.
How does a student issue a transcript?
- Set it up. Install the plugin and type your institution's name. Choose whether a transcript lists completed courses only, or graded courses too, and whether it shows grades.
- Issue. A student opens Transcripts on their profile, checks the preview and issues one. Registry staff can issue for any student.
- Hand it over. The student downloads a PDF with the course table, a code like K7QM-4XRT-9HCP and a QR code, and sends it to an employer or another school.
- Check. The reader scans the QR code or types the code on your site's verify page. No account, no login. They see Valid and the issued record, or Revoked, Altered or Not found.
- Revoke if needed. Staff can revoke a transcript with a reason. Anyone who checks it later sees that it was revoked.
What does the verify page tell the reader?
One of four answers. The signature is HMAC-SHA256 over the code, the student, the issue time and the stored record, with a secret only your site knows.
| Status | Meaning |
|---|---|
| Valid | The record exists, its signature matches, and it was not revoked. The page shows what was issued. |
| Revoked | The school withdrew it. The page says so with the date, and still shows what was issued. |
| Altered | The stored copy no longer matches its signature, so someone changed it. Nothing is shown. |
| Not found | No transcript has this code. Usually a typo. |
- Frozen copy. Grades that change later never change a transcript that was already issued.
- Codes people can read. 12 characters without 0, O, 1 or I, and far too many to guess.
- No login for readers. The verify page sets no session cookie, so it works on sites that force login.
- On the record. Issuing and revoking are Moodle log events, and the privacy tools export and delete transcripts.
How is it tested?
PHPUnit covers which courses go on a transcript, plain-text names, issuing, the frozen copy, a record edited in the database, a changed secret, revoking, unknown codes and the privacy provider. Behat walks a student through issuing, a logged out visitor through checking, and a manager through revoking, in a real browser with Moodle's accessibility checks on. CI runs on Moodle 4.5 to 5.3, on PostgreSQL and MariaDB.
Questions people ask
How do I give students a verifiable transcript in Moodle?
Install local_transcript, set your institution name in its settings, and students get a Transcripts link on their profile. They issue a transcript of their completed courses with final grades and dates, download it as a PDF with a code and a QR code, and anyone can check that code on your site's public verify page.
How does the verify page know a transcript was not edited?
When a transcript is issued the plugin stores a frozen copy of the record and signs it with HMAC-SHA256, using a secret created on install that never leaves your site. The verify page recomputes the signature. If anyone changes a grade in the stored copy, the page shows Altered instead of the record.
What if a grade changes after the transcript was issued?
The issued transcript does not change. It records the courses, grades and dates as they were when it was issued. The student issues a new one to show the new grade, and staff can revoke the old one.
Is this the same as a course certificate?
No. A certificate covers one course. A transcript lists every completed course with its grade and date in one document. They work side by side.
Does the person checking need a Moodle account?
No. The verify page works without logging in and does not set a session cookie, even on sites that force login.
Which Moodle versions does it support?
Moodle 4.5 to 5.3, on PHP 8.1 to 8.4, with PostgreSQL or MariaDB/MySQL.
Is it free?
Yes, open source under the GNU GPL v3. If you need your logo and signatures on the PDF, credits and GPA, programme grouping or a feed from your student records system, we build that at a fixed price.
Need your logo, credits or GPA on it?
Your crest and a registrar's signature on the PDF, credits and GPA, courses grouped by programme, or a feed from your student records system. We build that on top of this plugin at a fixed price.
Get a fixed priceBacked by Ta9in.