SQRC

The two-layer model

An SQRC (Security QR Code) looks exactly like a normal QR code and scans like one: a phone camera sees only the public payload. The private portion is scrambled with a key and skipped by ordinary decoders; a reader loaded with the matching key (Denso Wave-licensed hardware or SDK) recovers it. Typical uses pair a human-visible reference number (public) with an anti-forgery token or personal record (private) on tickets, membership cards and vouchers.

What it is and is not

It is access control for the reader, not encryption of what you can see. Two honest caveats follow. First, the public part earns no extra trust from being an SQRC, a scanner cannot even tell the private layer exists, so the format does nothing against quishing-style substitution of the whole label. Second, the security of the private part rests on keeping reader keys inside licensed devices; it is a closed-ecosystem design, not a published, independently analysed cryptographic scheme.

For open alternatives: if you need verifiable authenticity with standard codes, a signed payload (a URL carrying an HMAC or signature the server verifies) achieves a similar goal while remaining scannable by every phone.

FAQ

Can a normal phone read an SQRC?

Partially, and that is by design. Any scanner reads the public data; the private region is ignored entirely. Extracting it requires a Denso Wave-licensed reader configured with the matching key.

Is SQRC encrypted?

The private region is scrambled under a reader key, but the public region is plain, and the format's security model depends on licensed hardware keeping keys secret rather than on an openly specified encryption scheme.