A QR code is public by design. Anyone who can see the printed square can scan it, and normally that scan opens the destination immediately. Sometimes that is exactly wrong: the code is on a flyer, in a shop window, or forwarded in a photo, but the page behind it is meant for members, buyers, or a launch that has not happened yet. A password-protected code keeps the square public and puts a gate on what it opens.
What does it mean to password-protect a QR code?
Password-protecting a QR code means a scan lands on a password prompt first, and only a correct password forwards the visitor to the real destination. The printed image is unchanged and still scannable by anyone. What changes is what a scan reaches: instead of the target page, it reaches a gate. Because a dynamic code already routes every scan through a redirect layer you control, adding a prompt at that layer does not touch the printed dots at all. You can turn protection on, change the password, or turn it off, and the next scan follows the new rule, no reprint.
How does redireo’s password prompt work?
redireo’s password prompt sits on the redirect for a dynamic code, checks the password against a stored Argon2 hash, and forwards the visitor only on a match. The password is never stored in plain text. It is run through Argon2, a password-hashing function built to be slow and memory-hard, and only the hash is kept — so the stored value cannot be read back into the original password. When someone enters the password, the entry is hashed and compared to the stored hash. The password is also editable: rotate it from the console whenever you need to, and old copies of the code keep working against the new password because the code itself never encoded the password in the first place.
What are password-protected QR codes good for?
They are good for anywhere the code has to be public but the content should not be. A few concrete cases:
- Gated downloads. A code on packaging or a flyer that opens a manual, a warranty document, or a resource only after the buyer enters a code printed inside the box.
- Member or subscriber offers. A printed code that leads to a discount or a page meant for members, where the password is shared only with that audience.
- Staged launches. A code that ships on physical goods weeks before a launch. Print it now, keep it behind a password, and remove the password on launch day — the same square goes live without a reprint.
In each case the value is that the printed artifact can go out early and wide while the destination stays closed until you decide otherwise.
What password protection does not do
Password protection gates the destination; it is not digital rights management and it does not stop copying. This is the honest scope, and it matters. Once a visitor passes the gate, they can screenshot the page, copy a download link, or share the password with anyone. The prompt controls who reaches the destination, not what they do once they are there. It also does not encrypt the printed code or stop someone from scanning the square — the square is public and always will be. And like every redirect-layer control, it protects the codes that route through your system; it cannot do anything about a fake sticker pasted over your code, because that scan never reaches your redirect at all. Use a password to control access to a page, not to protect a file from being redistributed once someone is in.
Does password-protecting a code affect scanning or analytics?
No — the code scans exactly as before, and scans are still recorded, because the gate lives on the redirect rather than in the printed image. A visitor scans the same square, sees the prompt, and either passes it or does not. Because everything still routes through the redirect layer, you keep the scan record, and with redireo that history does not roll off — the analytics never expire. The password adds a step for the visitor; it removes nothing from your view of how the code is used.
Set an Argon2-hashed, editable password on any dynamic code, and see exactly how the gate behaves, on the password protection feature page.