Software companies use QR codes to move a person from one device to another: from a desktop site or printed material to a phone for an app download, from a laptop screen to an authenticator app for two-factor setup, or from a booth banner to documentation. The codes that earn their place hand a user off between screens; codes that merely link to a homepage do not.
This guide covers app downloads, two-factor enrollment, device pairing, documentation and events, and the security rules that matter when a code carries a secret.
Where do QR codes make sense in a software product?
- App download: one code that opens the App Store on iPhones and Google Play on Android. See the app download QR code guide and the dynamic app store QR code.
- Two-factor setup: an
otpauth://code that an authenticator app scans to start generating codes. Our 2FA QR code generator builds the URI. - Device login and pairing: a short-lived code on a desktop screen that a signed-in phone approves. Messaging web clients popularized this pattern.
- Documentation and support: a code on a device, quick-start card or error screen that opens the exact help article.
- Events and trade shows: a banner code to a demo sign-up, a trial, or a vCard for the sales rep. See the trade show signage guide.
- Developers: a code on a conference slide that opens a repository, a slide deck or a sample project.
How does a 2FA QR code work, and what must you protect?
A two-factor QR code encodes a URI in the otpauth://totp/ format defined in Google's Key URI Format documentation. It carries the account label, the issuer, and a shared secret, plus optional algorithm, digit and period settings. The authenticator app stores the secret and then computes a six-digit time-based code using the TOTP algorithm in RFC 6238, which is built on the HMAC one-time password method in RFC 4226.
The critical point: the QR code is the secret. Anyone who photographs or screenshots it can generate valid codes for that account.
- Show the code once, over HTTPS, inside the authenticated session where the user is enrolling.
- Never email it, put it in a ticket, or print it on shared material.
- Offer a manual entry key for people who cannot scan, and provide recovery codes.
- Do not cache the enrollment page, and avoid third-party QR image services, which would see the secret.
Generate this kind of code in the browser only. Our generator builds the pattern locally, so the secret is not sent to a server.
What about app store links on a QR code?
| Approach | Works for | Trade-off |
|---|---|---|
| Direct store link | An iOS-only or Android-only app | Wrong store for the other platform. |
| Dynamic smart redirect | Both platforms, one printed code | Depends on the redirect service staying up. |
| Landing page with both badges | Mixed audiences, desktop visitors | One extra tap. |
If the same code is printed in packaging or manuals, choose a redirect on a domain you own, so a future store URL change does not strand the printed codes. A code on a desktop browser should not open a store page that cannot install; show the badges instead.
Should documentation links be static or dynamic?
Documentation URLs change on restructures. For a code etched onto a device or printed in a manual, route it through a path you control, such as docs.example.com/q/setup, and keep that redirect alive. For a slide at a conference, a static link to the current page is fine, because the slide is temporary.
Security rules for software teams
- Treat login codes as short-lived: expire pairing tokens in a minute or two, bind them to one session, and invalidate them after use.
- Show the target before acting: a phone approving a pairing should display which device and where, so users do not approve a code an attacker displayed to them.
- Do not trust a scanned value: validate the URI, strip unexpected schemes, and warn on unexpected domains in your own scanner.
- Pin the domain you print: sign documentation and download pages with HTTPS and HSTS so a scan lands on a verified page.
The QR code safety guide covers quishing, and the QR security scanner checks where a code leads before you open it.
Frequently asked questions
Can I use one QR code for both App Store and Google Play?
Yes, with a dynamic redirect that checks the device type, or with a landing page that shows both store badges.
Is it safe to show a 2FA QR code on screen?
Yes, once, to the person enrolling, in a secured session. Never store, log or send it elsewhere, since it contains the secret.
Do QR codes work for desktop apps?
Yes, for handoff to a phone. For installing the desktop app itself, a normal download link is more reliable than a QR code scanned from the same computer.