# SQRC: the QR code with a private compartment

> SQRC is a Denso Wave format that splits a code into public data any scanner can read and a private part readable only by readers holding a matching key. The symbol looks like an ordinary QR code. It suits access control with dedicated hardware; it is not encryption for public campaigns.

Source: https://useqr.app/docs/basics/sqrc-secure-qr · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## The two-compartment design

SQRC (Security QR Code) is a proprietary [Denso Wave](/glossary/denso-wave) variant with
one distinctive property: its payload is split in two.

- **The public part** is ordinary QR data. Any phone or scanner reads it and sees a normal
  result: a message, a URL, an ID number.
- **The private part** is scrambled with a key. Only readers configured with the matching
  key (Denso Wave hardware and SDK-based scanners) recover it. Every other scanner
  reads the public part and reports success, never revealing that hidden data exists.

That silence is the clever bit. A tampered or counterfeit symbol fails the keyed read even
though it scans "fine" on a phone, so the checking station catches what the public never
notices.

## What SQRC is not

The name invites more than the design delivers, so the boundaries matter:

- **It is not encryption of what you see.** The public part is plain, ordinary QR data.
  Only the hidden compartment is protected.
- **It is not open cryptography.** The scheme is proprietary; keys are provisioned into
  Denso-compatible readers. You are trusting a vendor mechanism, not a published,
  publicly audited algorithm.
- **It is not for the public.** A phone cannot read the private part, ever, by design.
  Any use case where consumers must access the protected data is disqualified before it
  starts.
- **It does not make QR "safe".** The scanning-safety questions people usually mean:
  [malicious links, quishing](/docs/security/are-qr-codes-safe), are unrelated to SQRC.

## Where it genuinely fits

SQRC's habitat is the closed loop: employee and student ID cards checked at gates,
event and transit tickets validated by controlled scanners, internal logistics tags
carrying data that casual scanning should not expose, and anti-counterfeit marks where a
keyed reader at the checkpoint separates genuine from copied labels. In each case one
organisation issues the codes, owns the readers and manages the keys, the three
conditions that make the model work.

Note the honest caveat even there: anyone who obtains a configured reader can read every
private part it holds keys for, so SQRC's security is only as good as the physical and
organisational control of the reader fleet.

## The open alternatives

Most problems that sound like SQRC problems have open-standard solutions readable
everywhere:

- **Authenticity** (is this code genuinely from us?) →
  [signed QR payloads](/docs/security/signed-qr-codes-and-authenticity): sign the data,
  verify the signature in your app or server. Open crypto, auditable, no special readers.
- **Confidentiality** (secret data) → do not put the secret in the code at all. Encode a
  reference and let an authenticated server release the data: the pattern behind
  tickets, [2FA enrolment](/docs/security/qr-codes-for-2fa-security-model) and most
  serious systems.
- **Tamper evidence on labels** → [physical tamper-evident measures](/docs/security/tamper-evident-qr-labels)
  complement anything digital.

Choose SQRC when you are already committed to Denso reading hardware and want the split
payload specifically. Choose the open patterns for everything else.

## FAQ

### What is an SQRC code?
SQRC is a proprietary Denso Wave QR variant whose payload has a public part any scanner can read and a private part recoverable only by readers holding the matching key. Visually and to a phone it behaves like a normal QR code.

### Is SQRC the same as an encrypted QR code?
Not in the usual sense. The visible payload is unencrypted, and the private compartment uses a proprietary vendor scheme rather than open cryptography. For verifiable authenticity with standard tools, signed payloads are the open alternative.

### Can a phone read the hidden data in an SQRC?
No. The private part requires a reader provisioned with the key, which means Denso Wave-compatible hardware or SDKs. A phone sees only the public portion and gives no indication anything more exists.

### What is SQRC used for?
Closed-loop systems: ID cards, controlled-access tickets, internal logistics and anti-counterfeit labels where the issuing organisation also owns the scanners and manages the keys.

## Try it

- https://useqr.app/text
- https://useqr.app/url
- https://useqr.app/validate