Password-protected QR code
A password-protected QR code first shows a page that asks for the password, then redirects to the destination if it is correct. With Krealo QR (Pro plan) you set it on the short link: the printed pattern stays the same, and you can change or remove the password at any time.
Who it’s for
- A firm or business sharing a document or portal with its clients, not with passers-by.
- A school or course that reserves its resources for enrolled people.
- A private event whose photo gallery must not be public.
- A team that puts a code on equipment and limits access to employees.
How it works
- Open the link’s page, “Protection and rules” section.
- Enter a password of 4 to 128 characters and save.
- On the next scan, the page asks for the password before redirecting.
- Share the password through a channel other than the code itself.
What the person scanning sees
They land on a Krealo QR page with a password field. If the password is right, a signed cookie keeps access open for 12 hours on that device, then the page sends them on to the destination. During that time they do not have to re-enter it on every scan.
How the password is protected
The password is never stored in clear text: it is hashed with scrypt and a salt of its own for each link, in an area of the database nobody can read from outside. The form carries an anti-forgery token (CSRF), and tries are limited to 5 per IP address and per link every 15 minutes. Changing or removing the password immediately invalidates any access already open.
Are scans counted?
A scan is counted only once the right password is entered. Failed tries, and the bots that preview a link (messaging apps, antivirus), do not inflate your statistics.
Honest limits
This is an access barrier, not encryption: anyone who knows the destination address can open it directly, without going through the code. The password protects the path through Krealo QR, not the content itself. For a truly sensitive document, keep protection on the destination too.
- One password per link, shared by everyone who uses it: there are no individual accounts.
- There is no automatic recovery: someone who forgets it has to ask you again.
- A Wi-Fi code is static and does not go through a short link, so it cannot have a Krealo QR password.
Availability
This feature is part of the Pro plan, US$5.99 per month or US$39.99 per year, plus taxes. The 7-day Pro trial needs no credit card and is available once per account.
Frequently asked questions
Who can open a password-protected QR code?
Anyone who knows the password. Others see the password page after scanning but never reach the destination through the code.
Is the password stored in clear text?
No. It is hashed with scrypt and a salt, in an area of the database that the security rules make unreadable from outside. Krealo QR cannot show it to you in clear text.
How many tries are allowed?
5 tries per IP address and per link every 15 minutes. After that, the page asks to wait, even if the password is correct.
What happens if I change the password?
Access already open is invalidated: everyone has to enter the new password. If you remove it, the code redirects straight to the destination again.
Are scans on a protected link counted?
Yes, but only once the right password is entered. Failed tries and preview bots are not counted.
More features
Create your first QR code today
Free forever, no card. Try Pro for 7 days whenever you like: your account goes back to Free on its own.
Create my first QR