The private key never leaves the browser
Signing keys are generated on the device of whoever issues the codes. The private key — the one that signs — is never sent to the server.
✅ Verification guide
What a signed QR code is and how to check it
A signed QR code is a code whose link carries a cryptographic signature from whoever issued it. Nothing changes in how the square looks: what changes is that anyone can now check, before opening the link, which organization created it. Here we explain exactly what it proves, what it does not, and how to verify it in three steps.
● Verification in the browser, no app● No account● Open public key
How to verify it
Three steps, from your browser
1
Open the verifier
Go to the public verifier. It opens like any website, with no app to install and no account to create.
2
Paste the URL or point at the code
You can paste the QR code link or point your camera at the code. The whole check happens on your own device.
3
Read the report
It shows you the real destination domain, any redirects and, if the code carries a signature, which organization issued it and whether the signature is valid.
How it works under the hood
Private key, public key and open verification
The public key is published
The public part is published in an open, standard format (JWKS), so anyone — not just Qmarque — can check the signatures. GS1 recommends precisely that trust should rest on the brand domain; this is its cryptographic piece.
The check is local
The verifier compares the code's signature against the issuer's public key. If they match, the code is authentic; if not, it gives itself away as an imitation.
Standard reference: GS1 Digital Link ↗. Trust comes from the brand domain behind the code.
Honesty
What it proves and what it does not
✅ What it does
Issuer authenticity: which organization issued the code. Destination integrity: that the link lives on the organization's domain and will not lapse into third-party hands. And, for serialized codes, whether the same code had already been seen before.
❌ What it does not
It does not prove that the physical object it is printed on is the original — that is physical anti-counterfeiting, a different field. And it does not stop a third party from printing their own fake QR code: the signature does not stop the attack, it stops them impersonating you in front of whoever verifies.
Frequently asked questions
Common questions
What is a signed QR code?
It is a QR code whose link carries a cryptographic signature generated with the private key of whoever issued it. Anyone can check that signature with the matching public key and confirm which organization issued the code.
How do I verify a signed QR code?
With a public web verifier: you paste the URL or point your camera at the code, and the check runs in your own browser. It tells you the real destination domain and, if the code carries a signature, which organization issued it.
Do I need to install an app to verify it?
No. The verifier opens in the browser and the check runs on your own device, with nothing to install and no account to create.
What does a signed QR code NOT prove?
It does not prove that the physical object it is printed on is the original, nor does it stop a third party from printing their own fake QR code. It proves the authenticity of the issuer and that the destination lives on the organization's domain: it assures you who made it, not that nobody else can forge a new one.
Keep reading
QR security cluster
All the context on quishing and how to respond.
Sign your codes and make them verifiable
The signed QR code is included with Studio and above. Give your customers and citizens a way to check that your codes are yours, with no overpromising.