A QR code is a broadcast.
That's the first thing to understand. Anyone who points a camera at a QR code reads the same thing. There's no "to" field. There's no access control. The code on the poster, the card, the package, the screen is a public object, and the message inside it is public too.
Most of the time that's fine. A WiFi password, a URL, a contact, an event. You want anyone who scans to read it.
Sometimes you don't. Sometimes the code carries something only one person should see. A password. A key. A private note. A one-time login. A medical instruction. A financial detail. For those, a plain QR code is the wrong tool, and an encrypted QR code is the right one.
What an Encrypted QR Code Is
An encrypted QR code is a QR code whose payload is ciphertext, not plaintext. The scanner reads the code, but what it sees is gibberish until a password is supplied. The password decrypts the payload into the real message.
The flow: you type a message and a password into a generator. The generator encrypts the message with the password (using a real cipher, AES, not a toy obfuscation) and encodes the ciphertext as a QR code. You give the code to the recipient through any channel, print, email, photo. They scan it, the scanner asks for the password, they type it, the message appears.
The code can be intercepted, photographed, forwarded. None of that matters. Without the password, the ciphertext is unreadable. The security is in the password, not the channel.
Why This Matters: The Channel Problem
The reason to encrypt a QR code is that the channel you'd use to send the message is not trustworthy, but the channel you'd use to send the code is.
Consider: you need to give a contractor the gate code to a client's building. You could text it. The text lives on your phone, their phone, your carrier's logs, their carrier's logs, indefinitely. You could email it. Same problem, worse, because email is stored forever and searchable.
You could print an encrypted QR code and hand it to them. The paper has the ciphertext. The password you tell them in person, or over a call, or through a separate channel. The paper can be lost, photographed, left in a truck. None of it leaks the gate code, because the code on the paper is useless without the password.
This is called channel separation. You send the ciphertext through one channel and the password through another. An attacker who compromises one channel gets nothing. They need both.
The Cipher Matters
Here's the part most "encrypted QR code" tools get wrong. They use weak ciphers, or no cipher at all.
Some tools "encrypt" by base64-encoding the message and calling it encrypted. That's not encryption; it's encoding. Anyone can decode base64 in a browser tab in two seconds. The ciphertext looks opaque to a human, which is why the trick works on the demo, and it's worthless against anyone who knows what base64 is.
Some tools use old ciphers, or ciphers with hardcoded keys, or ciphers with no key at all (a fixed obfuscation). All of these fail the basic test: if you know the tool, can you read the message without the password? If yes, it's not encryption.
The right answer is AES, the same standard used for files and disks, with a key derived from the user's password through a key derivation function (PBKDF2 or Argon2) so a weak password can't simply be brute-forced. The encryption should happen in the browser, client-side, so the password never leaves your device. Our QR code generator does exactly this: AES in your browser, password never transmitted, ciphertext in the code.
If you're evaluating any encrypted-QR tool, ask three questions. Is it AES (or an equivalent modern cipher)? Is the key derived from a user password with a real KDF? Does the encryption happen client-side? Three yeses and you're good. Anything else and you're carrying a secret in a paper bag.
When to Use an Encrypted QR Code
A few real situations where this is the right tool.
Sharing a password or key in person. You're at a conference, you need to give a colleague the WiFi password for the office. You encrypt it as a QR code, show them the code, tell them the password separately. The code on your screen is meaningless to anyone who photographs it over your shoulder.
A one-time login credential. You're onboarding a new employee and need to give them an initial password. Encrypt it, put the code in their welcome packet, give them the decryption password over a phone call. The welcome packet can sit on a desk for a week without leaking the credential.
A private instruction on a public object. A doctor's office puts a QR code on a leaflet about a sensitive medication. The public code goes to a general info page. A second, encrypted code on the same leaflet, with the password given only to the patient, opens the actual dosing instructions. The leaflet is public; the dosing is not.
A dead drop. You leave a code in a place for a specific person to find. The code is encrypted. Only they have the password. Anyone else who finds it sees noise.
When Not to Use One
Encrypted QR codes are not a substitute for end-to-end encrypted messaging. If you and the recipient both have Signal, use Signal. It's faster, it has forward secrecy, it doesn't require you to deliver a password out of band. The encrypted QR code is for the cases where you don't have a shared secure channel, or where the medium is physical and the message must travel with it.
They're also not for large messages. A QR code holds a few hundred characters of ciphertext comfortably, more with density and size, but you can't put a document in one. For larger secrets, encrypt a file and share it through a link; see our guide to sending confidential files securely.
The Password Is the Whole Game
With a strong cipher, the security reduces to the password. A four-digit PIN gives you about 10,000 possibilities, broken instantly. A six-character password gives you a few billion, broken in minutes on a laptop. A 16-character passphrase gives you more possibilities than atoms in a teaspoon, not broken by anything on Earth.
Use a real passphrase. "purple-mango-window-49" is a real passphrase. "1234" is not. The cipher protects you against everything except a weak password, and nothing protects you against a weak password.
The Short Version
Encrypt the message with AES, in the browser, with a key derived from a passphrase. Encode the ciphertext as a QR code. Send the code through one channel and the passphrase through another. The code is public; the message is not.
That's an encrypted QR code. A code only the right person can read.
