Make a password-protected QR code

What the person scanning sees

A plain page asking for the password, on your own domain if you use one, saying nothing about where the link goes. No hint in the address, no preview, no title of the document behind it. Someone who photographs your poster and scans it later learns only that the code is locked.

Enter the right password and the destination opens. That phone stays unlocked for that one code for an hour, so a person reading a noticeboard does not re-enter it every time, and the same person scanning a different protected code is asked again. Eight wrong attempts in a minute and the page pauses that phone for a minute.

What a password-protected QR code protects, and what it does not

The password guards the redirect. That is the honest shape of it, and it is worth understanding before you rely on it. Someone who unlocks the code and copies the final web address can send that address to anyone, and it will open without a password, because the lock was on the route and not on the room.

For a staff rota or a trade price list that is exactly enough: it stops the passing customer, and that is who you were worried about. For anything genuinely confidential, put a login on the destination page too and let the code password be the outer door.

Why a password-protected code has to be dynamic

A static QR code holds the destination inside the black and white pattern. A scanner reads it straight off the paper and goes, and there is no moment in between where anything could ask a question. No generator can password-protect a static code, whatever the marketing says, and anyone claiming otherwise is describing a different thing.

A dynamic code carries a short link instead. Every scan passes through QRFLOW, which is the gap where the unlock page lives. The same property is what lets you re-point a printed code, count scans and set an end date.

The difference in full: static vs dynamic QR codes.

Where a secure QR code earns its keep

Staff documents on a wall

A rota, a safety sheet or a price list taped up where customers also stand. The code is in public; the document is not.

A private event page

Printed on the invitation. Guests get the password with the invitation, and a photograph of the card on social media opens nothing.

Trade and wholesale pricing

The same printed catalog goes to everyone, and only the accounts you gave the password to see the trade list behind it.

A document you need to retire

Change the password and every phone that had unlocked it is asked again. Remove it, or point the code somewhere else, and the old sheet is gone without collecting the paper.

Changing it later, without reprinting

Type a new password and save, and every phone that had unlocked the code is asked again on its next scan. Remove the password and the code goes back to opening straight away. Both take effect immediately, on every copy already printed, posted or stuck to a window. The pattern on the paper never changes, so nothing has to be reprinted and nothing has to be collected back in.

Step by step, with the screens: how to password-protect a QR code.

Questions people ask

How can I create a password-protected QR code?

Make a dynamic code, open it in your dashboard, then open its Security tab and set a password. It applies the moment you save, so printed copies already out in the world start asking for it on the next scan. Password protection is part of Premium, $4 a month.

Can a static QR code be password protected?

No, and no tool can do it. A static code carries the destination inside the pattern itself, so a scanner reads the link straight off the paper without asking anyone's permission. Protection needs a dynamic code, because the scan passes through a redirect that can stop and ask first.

Can you get a password from a QR code?

Not from a protected one. The unlock page holds a hash, never the password itself, so there is nothing in the page or the code for a scanner to read back. A QR code that stores a Wi-Fi password is the opposite case: that one does carry the password in the pattern, and anyone who scans it gets the network.

How do I make a QR code for my password?

If you mean a code that hands someone your Wi-Fi, that is a Wi-Fi code and it is free to make. A guest points a camera at the card and joins without anyone reading the password aloud. If you mean a code that asks for a password before it opens, that is this page.

What happens if I forget the password?

Set a new one on the Security tab. It cannot be read back to you because it is stored hashed, which is the same reason nobody else can read it either. Setting a new one takes a second and everyone is asked for the new password on their next scan.

Is a password-protected QR code actually secure?

It is a front door, and worth having. It stops the casual scan, it is per phone and per code, and it survives reprinting. What it does not do is protect the destination: anyone who has already unlocked it can copy the final link and pass it on. For anything confidential, protect the destination page as well and use the code password as the outer layer.

Can I generate a permanent QR code?

Yes. A static code never expires, because nothing has to stay online for it to scan. A dynamic code keeps working for as long as the account does, and you can set a deliberate end date on it if you want one. Password protection and expiry are separate switches, so a code can ask for a password and never expire.