Print a QR code on a flyer and it's public by definition: anyone who sees it can scan it, photograph it, or forward it. That's fine for a menu. It's less fine for paid course materials, a first-100-customers promo, or a download that should have died with last quarter's campaign. You can't secure the printed square — but you can secure the link behind it.
Security lives in the link, not the square
A static QR code encodes its destination directly into the pattern. Whoever has the image has the destination, forever, and there is nothing to revoke. A dynamic code encodes a short redirect link instead — on QRMapper it looks like qrmap.cc/?q=ab12cd — while the actual destination lives in a database. Every scan passes through that redirect, which means there's a moment between scan and destination where rules can be applied.
That moment is where all four controls in this article live:
- Password — who can open this?
- Scan limit — how many times can it be opened?
- Expiration date — until when does it work?
- Instant disable — can I stop it right now?
None of these are possible with a static code, because a static code has no server in the middle. If you're not sure which kind you're printing, read Dynamic vs. Static QR Codes first — it decides whether anything else here applies to you.
Passwords: control who gets in
A password-protected QR code asks the visitor for a password before the redirect happens. Only people you've given it to reach the destination.
Where this fits:
- Paid materials. Workshop slides or conference resources — the code goes on every seat, the password goes only to registered attendees.
- Internal content. An onboarding checklist or process doc posted on the office wall — scannable by staff, not by visitors.
- Embargoed content. A press kit distributed early; share the password when the embargo lifts.
- Client-specific files. One printed code on a proposal, password shared in the email thread.
One honest caveat: a password is a gate, not a vault. Anyone who has it can share it, and the content behind the link is only as private as the page hosting it. For genuinely sensitive material, put the destination behind real authentication and let the QR code be nothing more than a pointer. For "keep out passers-by," a password is exactly the right amount of friction — and you can change it any time without touching the print.
Scan limits: control how many
A scan limit caps the total number of times a code resolves to its destination. Once the cap is reached, scans stop reaching the offer.
This is the tool for scarcity that's real rather than rhetorical:
- "First 200 scans get the discount" — and the two-hundred-and-first actually doesn't.
- Sampling campaigns with fixed inventory: no point routing people to a claim form after stock runs out.
- Giveaways where a hard number keeps the budget predictable.
Two practical notes. First, watch the pace, not just the total: analytics that separate unique from repeat visitors tell you whether the cap was consumed by that many people or by fewer people checking twice — see what scan data actually tells you. Second, a limit set from a dashboard is a limit you can change. If the campaign outperforms and you want to extend it, raise the cap mid-flight; the printed codes never know the difference.
Expiration dates: control how long
Start with the misconception, because it's common: QR codes do not expire on their own. The printed pattern is ink; on QRMapper, a code's short link stays valid for the life of the service. QR code expiration is something you deliberately set — a date after which the code stops sending visitors to the destination — and something you can just as deliberately remove.
Use it when the offer itself has a deadline:
- A promo "valid through March 31" that should genuinely stop working on April 1.
- Seasonal campaigns where last winter's landing page shouldn't greet summer customers.
- Registration links that must close when the event fills or the date passes.
- Dated documents — a price list, a terms version — that should go dark once replaced.
A static code printed with a deadline becomes trash the day after. A dynamic code becomes inventory for the next campaign.
That's the part worth internalizing: expiry doesn't kill the print. When the promo ends, remove the expiration date and point the same code at the next offer — the flyers, table tents, and stickers keep working. The mechanics of that swap are covered in fixing a printed QR code without reprinting.
The kill switch, and choosing the right control
The fourth tool is the bluntest: one click, and the code stops resolving. You want this when something goes wrong faster than any schedule anticipated — the wrong file got uploaded, the destination page was compromised, legal pulled the campaign. Because every printed copy follows the same database record, disabling the link disables every poster, flyer, and sticker at once. Fix the problem, click again, and everything is back.
Here's the whole toolkit in one view:
| You need to limit… | Use | Typical scenario |
|---|---|---|
| Who opens the link | Password | Paid materials, internal docs, embargoes |
| How many times | Scan limit | First-N promos, fixed inventory |
| How long it works | Expiration date | Deadline offers, seasonal campaigns |
| Right now | Instant disable | Mistakes, leaks, pulled campaigns |
The controls combine. A launch promo might carry both a scan cap and an expiration date — "500 redemptions or end of month, whichever comes first." An embargoed press kit might use a password until launch day and an expiration a month after. A secure QR code isn't one feature; it's the right combination for the scenario.
On QRMapper, all four controls live in each code's settings and are available on the Pro plan and above; every paid plan starts with a 14-day trial, which is enough to run them against a real campaign. If you'd rather look around first, a free account needs no card and lets you set up your first dynamic codes before deciding.
The pattern you print is public and permanent — that part never changes. What you control is the link behind it: who gets through, how many times, until when, and whether it works at all. Decide which of those questions your campaign needs answered, set the control before the print run, and the code stays exactly as open — or as closed — as you need.
Print once. Point anywhere.
Create a dynamic QR code you can re-point anytime — free, no credit card.
Get started free