Verifiable BJJ Belt Certificates: Proof of Rank That Can’t Be Faked

A BJJ belt represents years of work — yet proving it to a new gym or event organiser still relies on a photo, a handshake, or a faded paper certificate. Compteam generates a cryptographically signed PDF with a QR code anyone can verify in seconds.

The problem: a belt with no paper trail

Brazilian jiu-jitsu takes rank seriously. A black belt can represent a decade or more of training. Yet when an athlete moves city, changes gym, or registers for a competition, the proof of their rank is usually… a photo, a word-of-mouth introduction, or a faded certificate from a ceremony years ago.

None of those are verifiable. A screenshot can be edited in seconds. A paper certificate can be forged or simply lost. For a sport that places such weight on lineage and legitimacy, the supporting evidence is surprisingly easy to fake — and surprisingly hard to check.

Existing alternatives

Now there are solutions already of this you might think and you are right. Beltchecker for example, it allows the BJJ practicioner to record training hours, competition results and the current owned belt of course. One of the limitations though is that it relies on references. And while BJJ is generally an honorable sport it could lead to complication. What if you found enough people in your current circle who are friendly enough to recognise your brown belt and support your case in Beltchecker? What if you made enemies and none of your former friends want to vouch for you?

A new solution

A more reliable solution to the problem are using digital signatures I believe. Why should we rely on friends and references when a BJJ history can be proven using a continuous aggregation of events?

When I implemented Compteam the question arose how to handle practicioners changing gyms, being inscribed in multiple gyms at the same time, or leave the platform for good. Wouldn’t it be beneficial, taking into consideration the user’s data privacy rights, if the practitioners history is persisted on a user specific level and be shared if the user chooses to? Now with all gyms operating in the same platform the user would have no issue anymore being accredited once he moves.

The practicioner joins a new club and his history follows him

What if the BJJ practicioner roams outside of the Compteam platform?

While a shared history works when the users moves between Compteam powered gyms, what if he needs to move to a gym which uses a different gym management platform?

Any athlete with a Compteam profile can export a belt history certificate as a single PDF. It contains:

• Full name and date of birth — identifying the holder.
• Address — for formal records (can be excluded during the export)
• Current belt and stripe count.
• Complete promotion history — every belt and stripe, with the date awarded and the awarding ceremony.
• Total training hours — confirmed mat attendance plus any imported historical hours.
• Competition record — medals won (gold, silver, bronze) and overall win/loss tally, with a per-event breakdown.

It is a clean, presentable document an athlete can hand to a new instructor, attach to an event registration, or simply keep as a record of their journey.

A user export a snapshot as PDF in Compteam

The printable history certificate

Now the practicioner can walk into a gym and present his certificate to the new Sensei, who scans it on his phone and knows what he needs to know about his new student. Or he attends a sanctioned event where he needs to prove his belt and competition history before being able to complete the registration?

But hey, what if the user modifies the contents of the history certificate while leaving the QR code as-is?

How the QR verification works

When Compteam generates the PDF, it signs the document with a cryptographic signature tied to the athlete’s record. That signature is encoded into a QR code (and a link).

The verification checks against a stored, cryptographically signed snapshot, the data on screen reflects exactly what was printed — not the athlete’s current standing. If anyone alters the PDF and the QR scan no longer matches, the verification page shows a clear “Tampered / Invalid” warning.

Can a Compteam belt certificate be faked?

No. The QR code contains a JWT token which is cryptographically signed, and the QR code links to a verification page that retrieves the data from the stored snapshot. Any alteration to the document or the link causes verification to fail. Even altering the printed text while leaving the QR intact, or even forging a new QR code is caught — the scan validates the signature contained in the QR code to confirm that the JWT token is valid, and then retrieves the snapshot from the database.

But what if the database admin changed the snapshot data?

In an attack situation where the attacker changes the snapshot data and even the HMAC multiple levels of verification are required:

• Signature in JWT token transmitted in the QR Code
• Snapshot hash inside the JWT token
• HMAC on the snapshot — separately signs the content JSON stored in the DB
• Three-layer verification: token proves the QR code is authentic → snapshot HMAC proves the content hasn’t been tampered with in the DB. Snapshot hash proves that the snapshot and HMAC hasn’t been tampered with.

Thanks for your time reading about my solution. Feel free to reply if you have any feedback or suggestions?

Running a BJJ gym and want to try it for yourself?

*CompTeam handles memberships, belt promotions, competitions, SEPA billing, kids programmes, and AI-powered admin — in one platform.*