Trust, but Verify

How Do You Verify a Digital Product Passport?

Verification runs in three layers. Resolve: scan the QR data carrier and confirm it opens a live, structured passport tied to a persistent unique product identifier (ESPR Article 10). Check: match the identifiers — product, operator, facility — and, for customs, the registration identifier the registry stores under Articles 13 and 15. Prove: confirm the data itself is authentic and unaltered, which is where version history, cryptographic hashes and signed credentials separate real passports from decorated PDFs.

Written by Nazrul Islam, Founder, DPPLive · Last updated: 16 July 2026

Layer 1

Resolve the carrier

A compliant passport is “connected through a data carrier to a persistent unique product identifier” (Article 10) and built on open, machine-readable standards. If the QR opens a static brochure or a PDF, it is not a DPP — the first and fastest filter any buyer can apply.

ESPR Art. 10

Layer 2

Check the identifiers

Product, operator and facility identifiers (Annex III) should be present and consistent; for goods entering the EU, Article 15 makes the unique registration identifier a customs checkpoint from the moment the registry operates. The registry — which “stores in a secure manner at least the unique identifiers” (Article 13) — is the official lookup.

Arts 13 & 15

Layer 3

Prove the data

Article 11 guarantees access for customers, repairers, recyclers, market surveillance and customs — verification is a designed-in audience, not an afterthought. Integrity mechanics carry the weight: published-version hashes, timestamps and digitally signed credentials that any party can validate independently.

ESPR Art. 11

This is where implementation quality becomes visible. DPPLive publishes every passport version with a SHA-256 hash and issues W3C Verifiable Credentials, so a buyer, auditor or recycler can confirm — independently, cryptographically — that what they scan today is what was published, unaltered. Ask any provider the same question: how would a stranger prove this record hasn't changed?

Verification FAQ

Quick Answers

How will customs check a Digital Product Passport?

Through the registry: under ESPR Article 15, once the registry is operational, the unique registration identifier must be provided to customs when a covered product is declared for release for free circulation — letting authorities match the declaration against a registered passport.

Can a buyer verify a supplier's DPP before ordering?

Yes — scan the data carrier and check three things: the QR resolves to a live, structured passport (not a PDF); the identifiers are consistent (GTIN, operator, facility); and the data is complete for the claims being made. A serious passport also exposes verifiable evidence for certifications rather than logos.

Can a DPP QR code be faked?

A QR is just a pointer — anyone can print one. Verification is about what it resolves to: registered identifiers, consistent data, and integrity protections such as cryptographic hashes or verifiable credentials that make silent tampering detectable.

What makes a passport tamper-evident?

Good practice layers three mechanisms: version history with timestamps, a cryptographic hash of each published version, and digitally signed credentials (for example W3C Verifiable Credentials) so any verifier can confirm the record hasn't been altered since publication.

Keep Reading

Go Deeper

Where Is DPP Data Stored? →

The decentralised architecture verification runs on.

The EU DPP Registry →

The official identifier lookup, live from 19 July 2026.

Customs Enforcement →

Will borders actually check passports? The mechanics.

Live DPP Demo →

Scan a real passport and try the layers yourself.

Sources & official references

Regulation (EU) 2024/1781 (ESPR) — full text on EUR-Lex — Article 10 (essential requirements), Article 11 (access rights), Article 13 (registry), Article 15 (customs controls)
W3C — Verifiable Credentials Data Model 2.0

DPPLive’s Take

A Passport Is Only Worth Its Proof

Anyone can put data behind a QR code. The passports that survive audits, borders and buyer scrutiny are the ones a stranger can verify without trusting the publisher. That standard — hashed, signed, independently checkable — is how DPPLive builds every record.

How Do You Verify a Digital Product Passport?

Quick Answers

Go Deeper

A Passport Is Only Worth Its Proof

Get in Touch.We Respond Within 24 Hours.

Get in Touch.
We Respond Within 24 Hours.