Password protected QR code: how it works and when to use one

A wholesaler of professional kitchen equipment prints 2,000 trade catalogues a year. On the last page sits a QR code labelled "Dealer prices". Restaurants and hotels get the same catalogue as dealers, but only dealers should see the price list. The answer the marketing team found was a password in front of the destination. Here is how that works, and where its limits are.

How a password protected QR code works

A QR code is a pattern that stores text. In a dynamic code that text is a short web address. Nothing in the pattern can ask a question or check an answer. So the password never lives in the code. It lives on the server that the code points to.

When someone scans, the phone opens the short address. The server sees that the link is protected and shows a page with a password field. Only after the right password does it send the visitor on to the real destination. Uniqode describes the same mechanism in its article on QR codes with a password (updated 19 June 2026): the access gate is "enforced at the server level and not within the QR module itself". Scanova's help article on password protection (checked 21 October 2026) says the code "will prompt users to enter the password before revealing its content".

One consequence follows directly. A static QR code cannot have a password. It contains the destination itself, and the phone goes there without asking any server. If you need a gate, you need a redirect in between.

What a password does protect

A password is a good filter for people who were never meant to see the page. Think of the restaurant owner who scans the dealer code out of curiosity. Think of a photo of the catalogue page that ends up on social media, or a competitor who picks up a catalogue at a trade fair. They all meet the password page and stop there.

It also keeps link previews and crawlers out. A bot that follows the short address sees the password page, not the price list. And the gate gives you a moment of control: you can change the password, and from then on old copies of it stop working.

What a password does not protect

It helps to be precise here, because a password page can feel stronger than it is.

• People who share the password. A dealer who forwards the password to a customer opens the door for that customer. The gate cannot tell the difference.
• The destination itself. If the price list sits at a public web address, anyone who knows that address can skip the gate. Protect sensitive files at the source too.
• The content. Uniqode states plainly that password protection "doesn't encrypt the QR Code or secure the underlying file".
• Fake codes. A sticker with a different code over yours bypasses everything. Our guide to QR code phishing covers that risk.

So treat a password protected QR code as a curtain, not a safe. For confidential data, such as personal records or contracts, use a proper login on the destination.

Use cases for a password protected QR code

The gate fits material that is not secret but should not be public either. Typical examples:

• A dealer price list in a catalogue that also reaches end customers.
• Staff information on a poster in a shop or warehouse, such as shift rules or safety instructions.
• The programme or venue details of a private event printed on an invitation.
• A menu preview for invited guests before a restaurant opens.
• A press kit under embargo, shared on a printed note at a launch.
• Training material for volunteers at a festival or sports club.

In each case the audience is known and limited, the harm of a leak is small, and convenience matters more than strong security.

How to share the password

The weakest password is the one printed next to the code. If you write "Password: dealer2026" under the code, you have a public page with an extra click. Share the password through a different channel than the code.

For the wholesaler, the password goes into the dealer newsletter and onto the dealer invoice. For a staff poster, the manager mentions it in the team briefing. Scanova's help article recommends a secure channel such as email. A few habits make the gate more useful:

• Use a short phrase, not "1234" or the company name.
• Use one password per audience, so you can change one without bothering the others.
• Change it after an event, or when staff with access leave.
• Tell people where the code leads, so the password page does not look suspicious.

How EUQR does it: passwords on links and PDF pages

In EUQR the password sits on the link or on the page, and your QR code points there. Two places offer it today.

The first is the EUQR link shortener. Any short link on qreu.eu can carry a password, an expiry date or a click limit, and you can change these at any time. Create the protected short link, then make a QR code for it. The dynamic QR code or the plain code that encodes the qreu.eu address stays the same, while the password and destination stay editable on the link.

The second is the PDF page, available on Pro and up. You upload a file, add an optional password and an optional download button, and replace the file whenever it changes. The file is stored privately on EU infrastructure and is not indexed as a public download.

Some other providers put the password directly on the dynamic code. Scanova lists password protection on its Lite plan and higher. With EUQR you get the same effect through the link or page, plus the same short link works in emails and chats.

Before you print: test the gate

A password page is one more step between the scan and the content, so test it like any other part of the journey. Ten minutes before a print run can save a reprint later.

1. Scan the code with two different phones and confirm that the password page appears.
2. Enter a wrong password and check that nothing behind the gate shows.
3. Enter the right password on mobile data, not only on the office network.
4. Open the final destination address in a private browser window. If it loads without a password, the file or page is public and needs its own protection.
5. Read the label next to the code aloud. It should say what the scanner will get and where the password comes from.
6. Send the password to one colleague through the planned channel and ask them to find it.

The fourth step catches the most common mistake. Teams protect the short link but leave the price list in an open cloud folder, and someone forwards that folder link instead. On an EUQR PDF page the file is only reachable through the page itself, which closes that gap.

A worked example: the dealer price list

The kitchen equipment wholesaler set it up like this. The price list is a PDF, so it went onto an EUQR PDF page with a password. The catalogue code points to that page through a short link with a readable slug, qreu.eu/dealer-prices. Our article on branded short links explains how to pick slugs like that.

Every quarter the team uploads the new price list. The 2,000 printed catalogues keep working. Every January the password changes and goes out in the dealer newsletter. The scan count per month, without cookies or personal data, shows whether dealers use the list at all. If they stop, the team knows before the next print run.

Short links with a password are available from Starter at €0.99 per month. PDF pages come with Pro at €9 per month. See all plans and prices.