Useful materials
QR codes for biometric access — tighter control at the door
QR does not replace biometrics — it carries a short-lived access proof on the phone. Without MFA, short TTL, and HTTPS it is an easy target to copy.
The idea
Typical chain: the user passes a biometric check on a trusted device (Face ID, fingerprint, corporate scanner), the system issues a one-time or short-lived token, and a QR presents that token to a turnstile or camera.
The door reader checks the signature/session on the server — it does not “trust the picture”. The QR is only transport for a nonce or JWT with a short TTL.
That cuts permanent plastic badges and speeds revocation: change policy on the server; if the screen shows a dynamic code, you do not reprint stickers.
System architecture
- MFA + biometrics
- short TTL tokens
- HTTPS only
- rotation via dynamic QR
Minimum flow: (1) auth on phone/kiosk, (2) signed token with TTL in seconds/minutes, (3) QR display, (4) edge check with online validation, (5) audit logs.
For reception screens or apps, point payloads through a dynamic QR from QRcode Global: rotate the target or token parameter without rewriting printed “scan the code on screen” signs. Scan analytics surfaces anomalies; pause is a fast kill-switch for that channel.
Benefits and risks
Benefits: faster passage, less plastic, central revocation, session bound to device and time.
Risks: photo of a colleague’s on-screen QR, replay within TTL, fake-reader phishing, long-lived secrets baked into a static QR.
Controls: MFA required; short TTL; one-time jti where possible; HTTPS only; never print long-lived secrets into static QR; watch repeat scans.
Use cases
Office turnstiles and coworking, contractor day-passes, event halls with on-screen badges, labs with two-factor entry, hotel digital keys with a limited window.
In every case a forever sticker with a secret is a bad idea. A dynamic layer (screen + editable target) fits security policy better.
Platforms with dynamic QR, editable targets, analytics and export let you rotate access tokens without reprinting labels — that is how QRcode Global supports operational change.