CryptoQR - Cryptographic Submission Verification

Unforgeable QR codes that cryptographically prove when student work was created—making honest effort verifiable in an AI-saturated world using Ed25519 signatures and SHA-256 hashing.

Comment

Inspiration

In 2025, AI can generate polished projects in minutes. As a high school researcher competing in science fairs and hackathons, I witnessed firsthand the authenticity crisis: How do you prove when work was actually created? Traditional verification relies on trust. I wanted to build something that relies on cryptography instead.

What it does

CryptoQR generates unforgeable, tamper-evident QR codes that cryptographically bind documents to specific timestamps. Students upload their project files, receive a QR code containing SHA-256 content hashes, Ed25519 digital signatures, ISO 8601 timestamps, and competition bindings. Judges can instantly verify: Is this the original work? Was it submitted on time? Has it been modified? ## How we built it

*Phase 1: Research * I started by researching cryptographic libraries and best practices for digital signatures. After comparing RSA, ECDSA, and Ed25519, I chose Ed25519 for its speed and security.

*Phase 2: Backend Development * Built the FastAPI server with cryptographic endpoints:

  • File hashing using SHA-256
  • Ed25519 signature generation with the cryptography library
  • QR code generation embedding signature, timestamp, and metadata
  • Email delivery system using SendGrid API

*Phase 3: Frontend * Created a clean, accessible UI with vanilla JavaScript:

  • Drag-and-drop file upload
  • Real-time form validation
  • QR code display and download
  • Multiple verification methods (paste JSON, upload QR image, upload JSON file, scan certificate)

*Phase 4: Deployment & Testing *

  • Deployed backend to Render (serverless)
  • Frontend to Vercel with custom domain
  • Tested with various file types and sizes
  • Implemented CORS and rate limiting
  • Added dark mode and accessibility features

Architecture: Serverless backend (zero cost at scale) + static frontend = production-ready system that can handle 10 or 10,000 submissions with same infrastructure.

Challenges we ran into

  1. CORS Configuration: Getting the frontend and backend to communicate across different domains required careful CORS setup
  2. Ed25519 Implementation: Ensuring cryptographic signatures were properly formatted and verifiable took multiple iterations
  3. QR Code Encoding: Fitting all metadata (hash, signature, timestamp, competition ID) into scannable QR codes while maintaining readability
  4. Free Tier Cold Starts: Render's free tier puts the backend to sleep, causing 30-second wake-up times on first request
  5. Email Delivery: Configuring SMTP for certificate delivery without authentication issues

Accomplishments that we're proud of

✅ Real-world adoption: 179 developers, 399 deployments - Not hypothetical impact—students and competition organizers are using cryptographic verification right now.

✅** Solving the AI authenticity crisis**: In 2025, AI can generate projects in minutes. CryptoQR gives students cryptographic proof of when work was created.

✅ *Production-ready system in 10 days *: Built and deployed complete full-stack application during AlamedaHacks 2026.

✅ Zero-cost infrastructure that scales infinitely: Serverless architecture handles 10 or 10,000 submissions with same performance.

✅ *Military-grade cryptography * : Ed25519 digital signatures (2^128 security) + SHA-256 content hashing, not toy implementations.

✅ *Four verification methods *: QR scan, JSON upload, PDF certificate, or manual paste—maximum accessibility for all users.

✅ Instant email delivery with zero signup: Submit work, receive cryptographic proof in seconds—no accounts, no friction.

✅ Open source under MIT license: Contributing infrastructure to education community, not building proprietary walls.

✅ Solo development by 16-year-old : Entire system (cryptography, backend, frontend, deployment, documentation) built by one high school student.

✅ Beautiful, accessible UX : Dark mode, keyboard navigation, screen reader support, and intuitive interface tested with real users.

✅** Professional PDF certificates ** :Printable proofs with embedded cryptographic data for official submission records.

✅ Live production system :Currently running at cryptoqr-pi.vercel.app with zero downtime since launch.

✅ *Sustained organic growth * :0 to 178 users in 10 days without paid marketing—proof of product-market fit.

✅ Clean, documented codebase :Ready for community contributions with comprehensive README and inline documentation.

✅ Addresses urgent global problem :Every student competing in AI-saturated world needs cryptographic proof-of-work.

What we learned

  • Applied Cryptography: Implementing Ed25519 signatures and SHA-256 hashing in production
  • API Design: Building RESTful endpoints with FastAPI and proper error handling
  • Frontend Integration: Handling file uploads and Base64 encoding in vanilla JavaScript
  • Deployment: Configuring serverless deployments with environment variables and CORS
  • Security Thinking: Designing systems resistant to tampering, replay attacks, and timestamp manipulation

What's next for CryptoQR - Cryptographic Submission Verification

Immediate Priority (Post-Hackathon):

Based on early adoption (178 developers in 10 days), the community has validated that cryptographic submission verification solves a real problem. My immediate focus is: User feedback integration - Reaching out to early adopters for feature requests and pain points.

Science fair partnerships - Discussions with competition organizers about official integration.

*Performance optimization *- Handling increased traffic while maintaining zero-cost infrastructure.

Documentation expansion - Creating video tutorials and integration guides for competition organizers

Version 1.1 (Q1 2026)

Batch submission support for multiple files.

Mobile app (iOS/Android) for on-the-go verification.

Advanced analytics dashboard for competition organizers.

Multi-language support (Spanish,Hindi).

Version 2.0 (Future)

Blockchain integration:Permanent audit trails on Ethereum/Polygon.

Post-quantum cryptography: Quantum-resistant signatures (CRYSTALS-Dilithium).

Decentralized verification: IPFS + smart contracts for trustless verification.

AI content detection: Integration with AI detection APIs.

Enterprise features: SSO/SAML support for institutions.

Impact Metrics

Adoption During Hackathon Period (Jan 1-11, 2026): 179 unique developers deployed CryptoQR.

399 total repository clones.

237 documentation views - Developers reading implementation details.

Live production system processing real submissions at cryptoqr-pi.vercel.app

Built With

Share this project:

Updates