Why Offline Badge Baking is the Gold Standard for Digital Credentials

Direct Answer: What is Badge Baking?

Badge Baking is the process of embedding structured, cryptographically signed credential metadata (assertions) directly into the binary container of an image file (typically PNG or SVG). The resulting image is self-contained: it functions both as a human-readable visual badge and as a machine-readable, offline-verifiable cryptographic proof.

The Fundamental Flaws of PDF Certificates

For two decades, organizations relied on PDF certificates sent as email attachments. In modern digital workflows, PDF certificates suffer from critical vulnerabilities:

1. Trivial Tampering: Anyone with a basic PDF editor can modify the recipient's name, issue date, or issuing organization in seconds.
2. Link Rot & Server Dependency: Most PDF certificates rely on a printed URL or QR code linking to a private server. If the issuer closes down or reconfigures their website, the certificate becomes unverifiable.
3. No Standardized Machine Schema: PDFs lack structured semantic data, making it impossible for automated hiring platforms or digital wallets to parse competency records.

How PNG iTXt Chunk Injection Works

The Portable Network Graphics (PNG) standard (ISO/IEC 15948:2004) defines extensible binary data segments known as chunks. Credinberg embeds credential data inside international text chunks:

• `iTXt:openbadgecredential` Chunk: Contains the full W3C Verifiable Credential JSON-LD payload.
• `iTXt:openbadges` Chunk: Contains backward-compatible Open Badges 2.0 assertion metadata.
• CRC32 Cyclic Redundancy Check: Every PNG chunk possesses a 4-byte CRC checksum. If an attacker tampers with the metadata or image bytes, the CRC check fails instantly.

Vector Preservation: Baking into SVG

For scalable vector artwork, SVG baking embeds the credential schema directly into the standard vector metadata container without altering the visual artwork. This ensures organizations can deliver high-resolution, responsive vector badges that scale seamlessly from mobile screens to 4K displays while maintaining full cryptographic proof and offline verifiability everywhere they are shared.

Verifying Baked Badges Offline

When a user uploads a baked PNG badge to a compliance validator:

1. The parser extracts the iTXt chunk bytes without executing any remote server call.
2. The JSON payload is validated against the W3C Open Badges schema.
3. The cryptographic signature is evaluated against the issuer's public key.
4. The user receives a green verification seal confirming issuer identity, recipient verification, and badge authenticity.