Can a QR code be password protected

What a QR password actually protects

A QR code is text drawn as squares. Scanning it reveals that text to the phone, and nothing in the specification can hide it. So there are only two kinds of code, and they answer this question differently:

• A static code encodes the destination itself. The URL is in the pattern, the phone opens it directly, and no server is in the path to ask for anything. Nobody can password protect it · not the generator that made it, not us, not anyone.
• A dynamic code encodes a short address on a host the owner controls, and the destination lives behind that address. A password gate is a form served at that address: enter the right password and the redirect happens; enter the wrong one and the form comes back. The pattern is unchanged either way, which is why a gate can be added to a code that is already printed.

That is the whole trick, and it is worth seeing what it does not do. The password protects the address. The destination behind it is an ordinary web page with an ordinary URL, and anyone who has been let through can copy that URL out of their browser and send it to someone who was not. A gate keeps the casual scanner out; it does not keep a secret.

How the gate behaves

What a person holding the code experiences, in the order the edge actually checks things:

• The form. The scan lands on a plain page headed "This link is protected" with one password field. The right password redirects to the destination; the wrong one returns the form with a note that it was wrong.
• The throttle. Wrong attempts are counted per address and per code, and past a small budget the address is refused for a while. Correct entries are never counted, so one password can be shared with a room without locking the room out, and a script guessing short passwords gets nowhere at edge latency.
• Where the password lives. It is hashed in the owner's browser before it is saved, so the plain text never reaches our servers. That is a privacy property for the owner, not a security promise to the scanner: the gate is still checked on the redirect path and is still a gate.
• What survives the form. Any tracking parameters on the scanned address are carried through the form to the redirect, so a gated code in a campaign still reports which print run it came from.

The sibling question: a code that expires on a date

The same mechanism answers "can I make a QR code expire". A printed pattern has no clock, so QR codes do not expire on their own and a static one cannot be made to. A dynamic code can carry an expiry gate: after the date you set, the short address stops redirecting and shows a notice that the link expired, or sends people to a fallback address you chose instead · next season's page, a generic landing page, anywhere useful for a code found in a drawer a year later.

Expiry runs before every other gate. An expired code never shows its password form, never renders its hosted page, never reaches its routing. If a gate you set seems to have stopped appearing, check the expiry date before anything else.

There is a second way to retire a code that is not a gate at all: routing on a date. The real-estate page demonstrates it with the real evaluator · a board's code sends people to the listing until completion day and to the agent's page after it. The difference from expiry is that nothing closes; the code changes its answer and keeps working.

The other sibling: a code that closes after N scans

A scan cap closes the address once a set number of scans has gone through. Past it, the scanner sees a "Link closed" notice with a line saying the owner can reopen it, which they can, at any time, by raising or clearing the cap. The temporary print page is where this earns its keep: a limited offer, a promotion with a fixed budget, a code that should stop being useful after the doors close.

The honest limit: the counter is approximate when many scans arrive in the same instant. It is right to within a few scans for a limited redemption, and it is the wrong tool for admission. A single shared code with a cap of one is not a ticket, because two people scanning at the same moment can both be let through. If exactly one person may enter, give each person their own code and check it on your side.

What no product can do

• Password protect a static code. There is no server in the path to ask. A tool that offers it is offering to convert the code to a dynamic one, which means a new pattern and a reprint.
• Hide what a code contains. Every camera reads the pattern. A gated dynamic code still reveals its short address to anyone who scans it; what it hides is where that address leads.
• Stop a destination being shared. Once someone is through, they hold the destination URL. If the destination itself has to be private, protect it at the destination · a login, a signed link that expires · and treat the QR gate as the first door rather than the only one.

What it costs, and where taproute comes in

In taproute all four gates · password, expiry, scan cap and a country filter · live on the code rather than on its routing, so they apply whatever the code would otherwise do, and they can be added to or lifted from a code that is already in the world. Each gate is a rule change at 5 credits, every change · add, edit or remove · a save that changes nothing is free. Scans through a gated code bill the ordinary 1 credit. A notice served in place of a destination is not billed, because nothing you authored was delivered; a fallback address you chose is a real scan and bills like one. The click-by-click walk, the exact order the gates run in and the four things that surprise people are in lock a code.

The failure mode you should know before printing: a gated code on a wallet that has run out of credits serves a paused notice instead of the form, after a grace period of 14 days or 5 percent of the last top-up in scans, whichever ends first. Topping up restores it on the same printed code.

Questions

Can a QR code be password protected?

The pattern itself cannot: whatever it encodes, any camera reads. What can be protected is where a dynamic code sends people. The code encodes a short address, and that address shows a password form before it redirects. A static code, which encodes the destination directly, cannot be password protected by anyone.

Is a password-protected QR code secure?

It is a gate, not encryption. It stops a casual scanner reaching the destination, and a per-address throttle makes guessing impractical. But the destination behind it is an ordinary URL, and anyone who has been let through can copy and share it. Do not rely on the gate alone for anything genuinely confidential.

Can a QR code expire on a date?

A dynamic one can. An expiry gate closes the short address at the date you set: scanners see a notice saying the link expired, or are sent to a fallback address you chose instead. The printed pattern has no clock, so a static code cannot be made to expire by anyone, and neither can the pattern of a dynamic one · only what it points at.

Can I limit how many times a QR code is scanned?

Yes, on a dynamic code, with a scan cap. Past the cap the address shows a closed notice until the owner raises or clears it. The counter is approximate under many simultaneous scans, so it is right for a limited offer and wrong for anything that has to admit exactly one person.

Can I make a one-time QR code?

A scan cap of one is possible, but it is not a ticket. The count is approximate under concurrency, so two people scanning in the same instant can both get through. For admission, issue one code per person and check each one on your side; a cap on a single shared code is the wrong tool.

What does a password or expiry on a QR code cost here?

Each gate is a rule change at 5 credits, every change · add, edit or remove · a save that changes nothing is free. Scans through a gated code still bill 1 credit each. A notice served instead of a destination is not billed; a fallback address you chose is, because something you authored was delivered.