A code from the school instead of an SMS: how a parent signs in to Nippur

The first question every school asks: “How does a parent register? With their phone number and a code sent by SMS, like other apps?” The answer is no, and deliberately so. This post explains why.

What an SMS proves

A code that arrives by SMS proves one thing: whoever typed it holds the SIM the code was sent to. It does not prove that the SIM’s owner is the child’s parent, or even that they know the child. In any system that relies on the phone number alone, whoever owns the number owns the account, and numbers are sold, reused and borrowed.

In many countries SMS delivery is unreliable, every message costs money, and the code may arrive an hour later or not at all.

What a school code proves

In Nippur, the school issues two codes per child, one for each of the two guardian slots. The code is handed over at reception, sent home on paper with the student, or read over the phone to someone the school knows. Whoever enters the code becomes this specific child’s guardian, because the school — not a telecoms company — vouched for it.

That is the only claim that matters when the data is a child’s attendance, grades, address and medical notes.

How the code is designed

• Five characters from an unambiguous alphabet. No I, O, l, zero or one, because the code is handwritten on paper and read aloud over the phone.
• Single use. The first person to enter it burns it. We tested twenty simultaneous attempts on one code; exactly one succeeded.
• It expires, and the school can revoke it and issue another at any time. Issuing a new code automatically revokes the old one.
• Scoped to the school, not globally unique, and entry attempts are rate-limited per school and per device, so a script cannot work through the possibilities.

Then what? The PIN

After entering the code, the parent chooses a four-digit PIN (biometrics optional). From then on they sign in with their phone number and PIN. The phone number here is just a username and a contact detail; it is never treated as proof of anything, because nobody verified it.

I lost my phone. What now?

You go back to the school, and it issues you a new code. Yes, that means a visit or a call with somebody who knows your family. We consider that a strength, not a gap: when access to a child’s data is being restored, having a person who knows the family in the loop is safer than an SMS that lands on whichever phone holds the SIM.

One child, one account for all the children

A parent with three children does not need three accounts. They enter the first child’s code and the account is created. They enter the second child’s code with the same number and the child is added to the account. And so on, even if the children are at different schools that use Nippur.

Two slots, not “father and mother”

Each child has two slots, but the relation is chosen at sign-in: father, mother, grandfather, grandmother, brother, sister, uncle, aunt, legal guardian. A grandmother raising her grandchild is common, and so is a widowed father. The system never tells anyone that the second code is “for the mother” when there is no mother.