Security
How 123QR handles redirects, accounts and scan data
Every redirect is resolved server-side, every account only sees its own codes and scans, and IP addresses are hashed before storage. We don't hold any third-party security certification, and we won't claim one we don't have.
How redirects resolve
A scanned code opens a short URL such as https://123qr.net/r/abc123. Our server looks up the current destination for that short code and returns an HTTP redirect before any page content loads. The destination is never embedded in the printed pattern, so changing it doesn't touch anything already printed.
The lookup happens on our server, not in the QR image or in client-side code, which is what lets a destination be updated instantly for every existing printed copy.
Account isolation
Each account can only see and manage the codes and scan records it created. Codes, destinations and analytics are scoped to the owning account on every request; one account has no path to another account's data.
Password handling
Authentication, including password storage, is handled by our auth provider rather than custom code we've written ourselves. We don't store plaintext passwords, and password handling follows the provider's standard practices for hashing and storage.
Scan data and hashed IPs
Scan records store a timestamp, coarse location, device type, browser, operating system and referrer. IP addresses are hashed on arrival and only the hash is kept, used to deduplicate scans and derive a coarse location. The original IP address is not stored.
This is deliberately minimal: enough to make analytics useful, not enough to identify who scanned a code.
Pausing and deleting codes
Pausing a code stops it from redirecting to its destination; scanners see a neutral page instead of an error, and the code's scan history is preserved. This is the safer option when you're unsure whether you'll need the code again.
Deleting a code removes it and its scan history permanently, and any printed material carrying that code will stop working. There's no undo for a deleted code.
Reporting a security issue
If you find a security issue, email hello@123qr.net with details and, where possible, steps to reproduce it. We'll acknowledge reports and work on a fix; we don't currently run a paid bug bounty program.
Common questions
- Can one account see another account's QR codes or scans?
- No. Every code and scan record is scoped to the account that created it, and requests are checked against that scope on every access.
- Does 123QR store raw IP addresses?
- No. IP addresses are hashed before storage and the original value is never kept, only the hash used for deduplication and coarse location.
- Is 123QR SOC 2 or ISO certified?
- No. We don't hold any third-party security certification today, and we won't claim one we don't have.
- What happens if I delete a QR code by mistake?
- Deleting a code and its scan history is permanent and any printed material using it stops working. If you're unsure, pause the code instead, which keeps its history and can be resumed later.
- How do I report a security vulnerability?
- Email hello@123qr.net with the details. We review and respond to genuine reports.
Keep reading
Print once. Change the destination anytime.
Create a free account, generate your code and edit where it points whenever you need to.