Authenticity infrastructure for mahjong

Every tile set,
provably authentic.

Mahj Credential lets mahjong brands issue a cryptographically secure credential for every set they sell. Customers scan the card in the box and see, in seconds, that they bought the real thing from the brand that made it, and not a copy.

Credential your sets → Verify a set
A unique credential for every set Verified in one scan Built by a security veteran
Certificate of Authenticity

The Jade Garden Set

Handcrafted by Your Brand · Edition 07
MJC-7Q4K-X9TR-2LWD
Scan to verify at mahjcredential.com
The knockoff problem

Your design is on Alibaba. At a tenth of the price.

Mahjong is having a moment, and the counterfeiters have noticed. Brands spend months designing tiles, racks and cases. Within weeks, near-identical copies show up on marketplaces, often listed with the brand's own product photos. Buyers can't tell them apart until the set arrives, and sometimes not even then.

1/10

The price of a fake

Knockoffs sell for a fraction of the original, so every copy pulls a sale and a customer away from the brand that did the design work.

0

Ways for a buyer to check

Before now, nobody could confirm a set was genuine. Stolen photos, copied packaging and lookalike tiles make the fakes very convincing.

∞

Damage to your name

When a cheap copy chips, fades or arrives missing tiles, the buyer blames the brand they thought they bought. Your reputation pays for someone else's shortcuts.

Without Mahj Credential

  • Buyers have to trust the seller and hope
  • Resale and gifted sets can't be checked
  • Copied packaging looks the same as yours
  • You can't see where fakes are turning up

With Mahj Credential

  • Every set carries its own signed credential
  • Anyone can verify in one scan, with no app to install
  • Your brand name confirms the result
  • Duplicated or suspicious credentials get flagged
Authenticity is the luxury

"Nobody buys a Louis Vuitton bag just for the leather. They buy the certainty that it's real."

The great luxury houses figured this out long ago. A designer handbag, a fine watch or a limited sneaker comes with proof of where it came from. Premium mahjong sets are heirlooms that get passed down, gifted at weddings and collected, and they deserve the same treatment.

壹

An unboxing worth remembering

A heavy, foil-stamped certificate card sitting in the case tells the owner this set was made to be kept.

貳

Pricing that holds

Once buyers can prove a set is genuine, they'll pay for it. Verified sets justify premium prices and keep their value on resale.

參

Provenance for collectors

Limited editions and numbered runs get a record that follows the set to every future owner.

How it works

From the factory floor to the customer's phone in five steps

Each credential is built with the same cryptography that protects banking and government systems, and presented with the polish of a luxury certificate.

01

The brand gets credentialed

Mahjong brands sign up with Mahj Credential and go through verification. Only a vetted brand can issue credentials under its own name, so the name a customer sees on a valid scan has been checked.

✓ Business verified✓ Domain confirmed✓ Signing key issued
02

A secure token for every set

For each set produced, Mahj Credential generates a unique, high-entropy token and signs it with the brand's key. Tokens aren't sequential and can't be guessed, and forging one would mean breaking modern cryptography.

# one credential per set token = random(128 bits) serial = MJC-7Q4K-X9TR-2LWD sig = Ed25519(brand_key, token‖set) qr_url = mahjcredential.com/v/…
03

Printed as a premium card

Each token goes into its own QR code and a human-readable serial. Brands print these on a foil-stamped certificate card or a tamper-evident sticker placed inside the case, so it feels like part of the product.

Foil-stamped cardTamper-evident stickerCase-lid insertPrint-ready PDF export
04

The customer scans

The owner points a phone camera at the QR code. There's nothing to download or sign up for. If the card is lost or the QR is damaged, the serial can be typed in at mahjcredential.com.

Point your camera…
05

"Valid," with the brand's name

The customer lands on a Mahj Credential page showing Valid, the name of the brand that issued the credential, and the set's details. If a credential has been copied and is scanned in suspicious ways, it's flagged straight away.

✓
AuthenticIssued by Your BrandThe Jade Garden Set · Ed. 07
Verify a set

Holding a set? Check it now.

Enter the serial printed on your certificate card or sticker, or just scan its QR code with your phone's camera.

Want to see it work? from the card above.

Under the hood

Security-grade, not marketing-grade

Most "authenticity" stickers are a hologram and a promise. Mahj Credential was designed by a security engineer, starting from the question of how a counterfeiter would try to beat it.

Unguessable tokens

Every token carries 128 bits of randomness from a cryptographically secure generator. Guessing a valid one is not realistically possible.

Digital signatures

Credentials are signed with per-brand keys. Nobody else, including a factory that has seen your cards, can produce a valid one.

Clone detection

Scan patterns are tracked. When one credential is scanned in two cities, or more often than a real set would be, it's flagged as a likely copy.

Ownership claim

The first owner can register their set. Every scan after that shows the set has been claimed, so a photocopied card can't pass as new.

Revocation

If a batch of cards is stolen or leaks from a supplier, the brand can revoke those credentials immediately.

Counterfeit intelligence

Brands get a dashboard showing where their sets are verified and where suspected fakes are appearing.

AB
Abhay BhargavFounder, Mahj Credential
Built by a security expert

Two decades of protecting what matters, now applied to mahjong

Mahj Credential was created by Abhay Bhargav, an information security expert with more than 18 years of work protecting systems for Fortune 100 enterprises, the U.S. Department of Defense, and organizations around the world. He started his career breaking applications as a penetration tester and red-teamer, and has spent the years since building the tools and methods companies use to defend themselves.

He founded the application security firm we45 and the training platform AppSecEngineer, which has trained security teams at large enterprises. He also co-founded SecurityReview.ai, which uses AI to automate security design reviews. When he saw how easily counterfeiters were copying the mahjong sets people care about, he applied the same approach he'd use for any security problem: assume a capable adversary, and build something they can't beat.

18+years in information security
F100enterprise & defense clients
2published security books
  • Trainer and speaker at Black Hat, DEF CON, RSA Conference, OWASP AppSec and HITB
  • Author of Secure Java: For Web Application Development and PCI Compliance: The Definitive Guide
  • Created ThreatPlaybook, an early threat-modeling framework built for Agile and DevSecOps teams
  • Architect of Orchestron, a vulnerability management and correlation platform
For mahjong brands

Give every set the proof it deserves.

We're onboarding a small group of founding brands. Tell us about your sets and production volumes, and we'll help you design a credential that fits your packaging.

Request brand access → See how it works