# SQRC

> SQRC is a Denso Wave QR variant with two data regions — a public part that any scanner reads normally, and a private part that only readers configured with the matching cryptographic key can extract. It looks identical to a standard QR code and is used for tickets, ID cards and vouchers.

Source: https://useqr.app/glossary/sqrc · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## The two-layer model

An SQRC (Security QR Code) looks exactly like a normal [QR code](/glossary/qr-code) and
scans like one: a phone camera sees only the **public** [payload](/glossary/payload). The
**private** portion is scrambled with a key and skipped by ordinary decoders; a reader
loaded with the matching key — Denso Wave-licensed hardware or SDK — recovers it. Typical
uses pair a human-visible reference number (public) with an anti-forgery token or personal
record (private) on tickets, membership cards and vouchers.

## What it is and is not

It is **access control for the reader**, not encryption of what you can see. Two honest
caveats follow. First, the public part earns no extra trust from being an SQRC — a scanner
cannot even tell the private layer exists, so the format does nothing against
[quishing](/glossary/quishing)-style substitution of the whole label. Second, the security
of the private part rests on keeping reader keys inside licensed devices; it is a
closed-ecosystem design, not a published, independently analysed cryptographic scheme.

For open alternatives: if you need verifiable authenticity with standard codes, a signed
payload — a URL carrying an HMAC or signature the *server* verifies — achieves a similar
goal while remaining scannable by every phone.

## FAQ

### Can a normal phone read an SQRC?
Partially, and that is by design. Any scanner reads the public data; the private region is ignored entirely. Extracting it requires a Denso Wave-licensed reader configured with the matching key.

### Is SQRC encrypted?
The private region is scrambled under a reader key, but the public region is plain — and the format's security model depends on licensed hardware keeping keys secret rather than on an openly specified encryption scheme.

## Try it

- https://useqr.app/url
- https://useqr.app/validate