Why Offline Badge Baking is the Gold Standard for Digital Credentials

Direct Answer: What is Badge Baking?

Badge Baking is the process of embedding structured, cryptographically signed credential metadata (assertions) directly into the binary container of an image file (typically PNG or SVG). The resulting image is self-contained: it functions both as a human-readable visual badge and as a machine-readable, offline-verifiable cryptographic proof.

The Fundamental Flaws of PDF Certificates

For two decades, organizations relied on PDF certificates sent as email attachments. In modern digital workflows, PDF certificates suffer from critical vulnerabilities:

1. Trivial Tampering: Anyone with a basic PDF editor can modify the recipient's name, issue date, or issuing organization in seconds.
2. Link Rot & Server Dependency: Most PDF certificates rely on a printed URL or QR code linking to a private server. If the issuer closes down or reconfigures their website, the certificate becomes unverifiable.
3. No Standardized Machine Schema: PDFs lack structured semantic data, making it impossible for automated hiring platforms or digital wallets to parse competency records.

How PNG iTXt Chunk Injection Works

The Portable Network Graphics (PNG) standard (ISO/IEC 15948:2004) defines extensible binary data segments known as chunks. Credinberg embeds credential data inside international text chunks:

• `iTXt:openbadgecredential` Chunk: Contains the full W3C Verifiable Credential JSON-LD payload.
• `iTXt:openbadges` Chunk: Contains backward-compatible Open Badges 2.0 assertion metadata.
• CRC32 Cyclic Redundancy Check: Every PNG chunk possesses a 4-byte CRC checksum. If an attacker tampers with the metadata or image bytes, the CRC check fails instantly.

Vector Preservation: Baking into SVG

For scalable vector artwork, SVG baking embeds the credential schema within standard XML tags:

<svg xmlns="http://www.w3.org/2000/svg" ...>
  <!-- Visual Vectors -->
  <metadata>
    <openbadges:assertion xmlns:openbadges="http://openbadges.org/ns#">
      { ... Signed JSON-LD Assertion ... }
    </openbadges:assertion>
  </metadata>
</svg>

This ensures designers can deliver high-resolution responsive vector artwork that scales from mobile screens to 4K displays without losing cryptographic fidelity.

Verifying Baked Badges Offline

When a user uploads a baked PNG badge to a compliance validator:

1. The parser extracts the iTXt chunk bytes without executing any remote server call.
2. The JSON payload is validated against the W3C Open Badges schema.
3. The cryptographic signature is evaluated against the issuer's public key.
4. The user receives a green verification seal confirming issuer identity, recipient verification, and badge authenticity.