CPR BDDU (University of Dhaka)
Institutional web portal for the Center for Policy Research on Business and Development at the University of Dhaka. Includes a public HMAC-based certificate verification engine, academic research repository, and bulk-issuance admin workflow that replaced a multi-day manual process.
- Client
- Department of International Business, University of Dhaka
- Role
- Lead Full-Stack Developer & UI Architect
- Timeline
- 2025 – 2026
- Stack
- 9 technologies
A closer look
- HMAC-SHA256 certificate verification: codes derived from certificate number + recipient name + program name, making forgery computationally infeasible without the server secret
- QR codes on physical certificates link to the public verification page — employers scan and see verified details in under 100ms
- Timing-safe comparison for verification code checks, preventing side-channel timing attacks
- Bulk certificate issuance: import CSV of cohort participants, generate and queue all verification codes in one action
- Academic research repository with structured metadata, full-text search, and embedded PDF viewing
- Faculty directory with academic profiles and publication history
Need a similar delivery process for your product? I can help shape the scope and ship the implementation end to end.
Start a projectCPRBD issues professional certificates to mid-career government officials and business professionals completing executive education cohorts. These certificates carry real weight in career advancement — used for government postings, international roles, and senior appointments. But there was no way for an employer to verify that a certificate was genuine.
The administrative burden was also significant. Managing 60 participants through a form-based interface one at a time, generating individual certificate records, and distributing credentials took days of coordinator time per cohort.
The verification system uses HMAC-SHA256 rather than a blockchain or sequential ID. The trust anchor is CPRBD's public website. The verification code for each certificate is computed from the certificate number, the recipient's full name as it appears on the certificate, and the program name — signed with a secret key held only by the server. An employer submits the code and certificate number; the server recomputes the expected hash, runs a timing-safe comparison, and returns the verified recipient details.
Timing-safe comparison prevents an attacker from using response time to infer valid hash characters one at a time. The crypto.timingSafeEqual function takes the same time regardless of where two strings diverge.
The admin workflow was designed for bulk operations. Coordinators import a spreadsheet of cohort participants, review the list, and issue all certificates in a single action — generating verification codes, storing records, and outputting a print-ready PDF with embedded QR codes for each participant.
The public portal presents CPRBD's research publications, program information, faculty profiles, and policy dialogues in a clean institutional design matching University of Dhaka branding. The certificate verification page is publicly accessible with no login required, resolving any valid certificate in under 100ms.
The research repository made CPRBD's publication catalog discoverable for the first time. Previously, research papers lived in a static Word document on the university website. The structured repository supports search by author, year, topic, and program type.
Employers can verify CPRBD credentials in seconds by scanning the QR code on a physical certificate. The verification endpoint processes lookups without false positives or false negatives.
The bulk certificate issuance workflow reduced coordinator time per cohort from multiple days to under an hour. The research repository surfaced CPRBD's intellectual output to a broader audience of policy practitioners and government stakeholders who previously had no way to find it.