QR Code Verification Mechanism

What the QR code does

Think of the QR code like a barcode on a product in a store. A barcode doesn’t contain the product’s entire manufacturing history; it points to a record. The QR code on an eSerbisyo document works the same way. It encodes a unique web address that links back to a single record in the barangay’s database.

When someone scans the code (with a phone camera, a QR reader app, or even by typing the URL into a browser), the system looks up that record and displays the document’s details: what type of document it is, who it was issued to, when it was generated, and whether it is still valid. The PDF itself is not the proof of authenticity; the database is.

How verification works step by step

The verification flow is deliberately simple so that anyone (a school registrar, an HR officer, a government clerk) can do it without training:

1. Scan the QR. Open any camera or QR reader and point it at the code on the document. A link appears.
2. The system looks up the record. The link opens a verification page that queries the barangay’s database for the request ID encoded in the QR.
3. Document details are displayed. The page shows the document type, the resident’s name (last four characters redacted for privacy), the date it was generated, and the barangay that issued it.
4. Authenticity is confirmed. If the details match the paper in hand, the document is genuine. If the record doesn’t exist or the details don’t match, the page says so clearly.

Why this prevents tampering

The QR verification mechanism addresses the three main ways a paper document can be faked or altered:

• Copies are caught. Someone can photocopy a real document, but the QR code still points to the original record. Scanning the copy shows the same details as the original, and the verifier can compare the copy’s contents against what the database says. Any alteration to the photocopy (changed name, different date) is immediately obvious.
• Revocations are honoured. If a document is revoked (because it was issued in error, superseded by a newer version, or flagged for any reason), the database record is updated. Scanning the QR now shows “revoked ” or “invalid” instead of confirming authenticity. The old paper becomes a dead end.
• No manual call-around needed. Without QR verification, a verifier would have to phone the barangay hall, describe the document, and ask staff to check their records. That process is slow, doesn’t scale, and depends on staff availability. The QR code automates it; verification is instant, 24/7, and requires zero human intervention on the barangay side.

Verification in practice

QR verification is designed for the people who receive documents and need to decide whether to trust them:

• Employers verifying a Barangay Clearance as part of a job application. A quick scan confirms the clearance is real and was issued to the applicant.
• Schools and universities checking a Certificate of Residency or Indigency submitted by a student. Scanning confirms the document was genuinely issued by the barangay.
• Government agencies processing permits, licenses, or other filings that require supporting barangay documents. Staff scan the QR to verify without calling the hall.

Verification is available in two ways. The verifier can scan the QR code with any smartphone camera or QR reader, which opens the verification page directly. Alternatively, they can type the URL printed beneath the QR code into any web browser. Either way, the same verification page loads and shows the document’s status.

What the verifier sees is simple and unambiguous: the document type, the recipient’s partial name, the issuance date, and a clear status indicator: verified, revoked, or not found.

An honest limit

QR verification is powerful but not magical. It has one clear boundary that is worth stating plainly:

The system cannot prevent someone from creating a brand-new fake document from scratch, complete with a fabricated QR code that points to a made-up URL or to a page they control. What itdoes make trivially easy is catching that fake. A verifier who scans the QR will either land on a legitimate verification page (in which case the details on the page won’t match the fake document) or land on a page that clearly isn’t the barangay’s system.

In other words, QR verification doesn’t make forgery impossible; it makes forgery hard to pass off andeasy to detect. A tampered copy is caught immediately. A completely fabricated document requires fabricating the QR verification endpoint too, which is significantly harder and still fails under scrutiny.

How the QR is generated

Under the hood, the QR code generation is straightforward:

1. A unique request ID is assigned when a resident submits a document request. This ID is the primary key for the entire request lifecycle.
2. The ID is encoded as a URL, a web address that points to the barangay’s verification endpoint, with the request ID embedded as a path parameter.
3. The URL is rendered as a QR image using a server-side QR library. The image is embedded directly into the PDF during template generation.
4. The same URL is printed as text beneath the QR code as a fallback for verifiers who prefer to type manually or whose device cannot scan.

Because the request ID is generated server-side and is sequential or UUID-based, it cannot be guessed or predicted by an end user. The QR code is a convenience layer on top of a database lookup; the security comes from the database record, not from the code itself.