QR codes look interchangeable from the outside - a black-and-white square that a phone camera reads. What's encoded inside that square, though, varies enormously between systems, and it's the difference between a pass that's genuinely hard to abuse and one that only looks secure.

The weak design: predictable, embedded data

Some systems generate a QR code that directly encodes readable information - a lot number, a visitor's name, a date range. It's simple to build, but it means the QR code itself contains something a visitor (or anyone who gets a copy of it) could potentially reconstruct, guess a variant of, or reuse for a different visit than the one it was issued for. If the "security" of the pass depends entirely on nobody looking closely at the code, it isn't much of a barrier.

The stronger design: random, unguessable tokens

A secure QR pass instead encodes a random token with no relationship to the visitor's real information - just a long, unpredictable string that only means something because the system has a record of it. When a guard scans it, the system looks that token up and checks three things:

  • Is this a valid, currently-issued pass?
  • Is right now within the pass's allowed time window?
  • Has it already been used up or expired?

None of that logic lives in the QR code itself - it lives in the system checking it. That means a photo of the code, a guess at a similar-looking code, or an attempt to reuse an old one all fail the same way: the system simply doesn't recognize it as valid anymore.

Why the time window matters as much as the token

A random token alone isn't enough if it never expires. A pass that's valid forever is a pass a visitor could still use months after they should have lost access. Every pass needs an automatic expiry appropriate to what it's for - a single visit, a day, a week, or ongoing access with a renewal reminder before it lapses - so access never quietly outlives its purpose.

What to ask before switching systems

  • Does the QR code encode a random token, or does it embed readable visitor/lot data?
  • Is every scan logged with a timestamp and outcome, so there's a record of who tried to use what, and when?
  • Does every pass type have an automatic expiry, or does "ongoing access" mean permanently valid unless someone remembers to revoke it?
  • Can a specific visitor be blocked outright, with every future attempt at the gate caught automatically?

If a vendor can't answer these clearly, it's worth asking to see the actual pass format, not just a demo of the scan working.