If you are choosing between a QR code and a VCode, the decision comes down to one design choice made decades apart. A QR code carries its information. A VCode refers to it. Everything else follows from that.
The short answer. A QR code is a container: the data is inside the image, readable by anyone with a camera, fixed at the moment it is printed. A VCode is a reference: the image holds no usable payload, and what it means is decided by the platform at the moment of the scan, against rules the issuer controls.
Use a QR code when you want to hand someone a link. Use a VCode when you need to know that a specific thing is genuine, and to stay in control of it after it has left your hands.
The difference in one table
| QR code | VCode | |
|---|---|---|
| Where the data lives | Inside the image | On the platform, referenced by the image |
| Readable by any camera app | Yes, completely | No usable payload to read |
| Changeable after printing | No, unless it points at a redirect you own | Yes, including what it resolves to |
| Can be withdrawn | No | Yes, instantly |
| Conditional on who, where, when | No | Yes, evaluated at every scan |
| Issuer sees each use | No | Yes, including refusals |
| Anyone can generate one | Yes, in seconds, free | No, generation is closed-loop |
| Open standard | Yes (ISO/IEC 18004) | No, proprietary |
What a QR code actually is
A QR code is a two-dimensional barcode, published as an open standard, that encodes characters directly into a pattern of modules. Scan one and your phone reads the characters out of the picture. There is no lookup and no permission step, because there is nothing to look up: the payload was in your hand the moment the camera resolved the image.
That design is why QR codes succeeded. They are free, open, universally supported, work offline, and any camera can read one. For handing a stranger a menu, a Wi-Fi password or a link to an app store, a QR code is the right tool and a VCode would be overkill.
The same design is also the ceiling. Because the payload is in the image:
- a photograph of the code is functionally the code, forever, for anyone;
- the content is fixed at print, so a mistake is a reprint;
- the issuer learns nothing when it is used, because it was never asked;
- and anyone can produce a valid one, including someone impersonating you.
But what about dynamic QR codes?
This is the fair objection, and it deserves a straight answer rather than a dodge.
A dynamic QR code encodes a short URL you control, so you can change where that URL redirects after the code is printed, and you can log the redirect. That genuinely solves two of the four problems above: content becomes editable, and you get analytics.
What it does not change is the nature of the thing in the image. The code still contains a working destination, so:
- a photograph still resolves, from anywhere, for anyone who holds it;
- copying the code is trivial, and every copy is as good as the original;
- the redirect can be switched on or off, but it cannot generally decide who is scanning, where they are, or whether this is the fourth time, unless you build that system yourself; and
- anyone can still generate a code that looks exactly as legitimate as yours.
A dynamic QR code is a redirect with a picture in front of it. A VCode is an identifier with a decision behind it. If a redirect is all you need, use a dynamic QR code and save yourself the integration.
Where the difference actually shows
1. Someone photographs the code
This happens constantly and innocently: the person using the code, the person behind them in the queue, anyone it is forwarded to. With a data-carrying code, the photograph hands over whatever was encoded, permanently, including anything personal the issuer put in it. With a VCode there is nothing in the picture to extract, and resolving the reference still has to satisfy the rules attached to it. You can decode both side by side on the home page.
2. Someone sticks their own code on top
This attack has a name, attagging, from attack and tagging. A criminal covers a genuine code with a sticker carrying their own, and everyone who scans it reaches a destination the attacker picked. It is crude and it works, because a QR code carries its own destination and the phone has no way to tell a substitute from the original.
It is not hypothetical. The US Federal Trade Commission has warned of reports of scammers “covering up QR codes on parking meters with a QR code of their own”. In the UK, BBC News reported that Action Fraud received 1,386 reports of QR code scams in 2024 against 100 in 2019, with organised crime groups behind the rise. The National Cyber Security Centre notes that most QR fraud happens in open spaces such as stations and car parks, though it is careful to add that the codes in your local pub are probably fine and that QR fraud remains small next to other cyber fraud.
A VCode removes the mechanism the attack depends on. There is no destination in the symbol to rewrite, a valid code cannot be manufactured outside the platform, and resolution happens server-side on every scan. To be precise about the limit: someone can still physically cover a code with a sticker, and no technology prevents that. What they cannot do is make the substitute resolve to a destination of their choosing. The scan fails instead of quietly misleading someone.
3. The information changes after printing
Labels outlive their facts. Recalls happen, batches get reclassified, ownership transfers, prices change, documents are superseded. With a printed data-carrying code the answer is a reprint. With a VCode the symbol stays exactly as printed and the record behind it changes.
4. You need to withdraw a code
A VCode can be revoked. The printed symbol still exists, and stops resolving. There is no equivalent for a code whose payload is the payload.
5. You need to know it was used
Every VCode scan is recorded, including the ones that are refused, with the platform seeing what was scanned and under what conditions. A refused scan is often the more interesting event, because it is the one that tells you something is wrong in the field.
The rules an issuer can attach
This is the part with no QR equivalent. A VCode is evaluated against rules at the moment of the scan, and a rule can refuse the scan or return a different response. The platform supports rules covering:
- Location, by radius or polygon, so a code only works on site;
- Date and time, including hours within the day, for windows that open and close;
- Platform, so iOS and Android can each get their own response;
- Single scan, once only, or once per user, per device, per day, week, month or year;
- Named users or email domains, restricting a code to specific people or one organisation;
- Invalidation for particular users who have already scanned; and
- Values supplied with the scan, so an integration can branch on something only it knows.
Separately, a code can carry a scan budget. Set a number of scans and the code either expires at that point or switches to a different response, which is how a “golden ticket” mechanic works: the first several thousand scans return one thing and a later scan returns another, from the same printed symbol. There are working illustrations of this on the technology page.
Scale and physical constraints
Capacity is not a fixed ceiling. Codes are issued within namespaces, each carrying 72 quadrillion possibilities, and namespaces are added as demand requires, so the system scales rather than running out. The space presently spans approximately 2.2 quintillion identifiers. That is enough to give an individual identifier to individual items at global scale rather than to product lines. A VCode remains reliably readable down to about 5 mm, which matters when the thing being identified is a component, a vial or a small item of packaging.
What QR codes are still better at
A comparison that only flatters one side is not worth reading, so plainly:
- Ubiquity. Every phone camera reads a QR code with no app. A VCode is resolved by the VCode app or an approved SDK, which is the same property that makes it controllable, but it is a real adoption cost.
- Cost and speed. A QR code is free and instant. VCode involves licensing and integration.
- Offline operation. A QR code works with no network at all. A VCode is resolved server-side by design, so connectivity matters.
- Openness. QR is an ISO standard anyone can implement. VCode is proprietary.
If your use case is “send this person to that page”, those advantages win and you should use a QR code.
How to choose
A rough decision rule:
- Is the code just a shortcut to public information? QR code.
- Does it need to prove something is genuine, or entitle someone to something? VCode.
- Would a photograph of it, in someone else’s hands, cause a problem? VCode.
- Do you need to withdraw it, change it, or restrict it after printing? VCode.
- Do you need evidence of every use, including attempted misuse? VCode.
The common thread is control after issue. A QR code is finished the moment it is printed. A VCode is not.
Frequently asked questions
Is a VCode just a QR code with extra steps?
No. A QR code contains its payload, so scanning it is a decoding operation. A VCode contains no usable payload, so scanning it is a request to the platform, which then applies the issuer’s rules and returns a decision. They are different categories of thing that happen to share a rectangle.
Can a VCode be copied?
The image can be photographed or reprinted like any image. The copy resolves against the same rules as the original, so if the code is bound to a holder, a location, a time window or a single use, the copy is refused and the attempt is recorded.
Can I make my own VCode?
No. Generation is closed-loop: valid codes are produced by the platform. A symbol produced by anyone else is not a VCode and resolves to nothing, which is what stops counterfeit codes being manufactured.
What is attagging?
Attagging, from attack and tagging, is placing a sticker carrying a malicious code over a legitimate one so that people scanning the genuine-looking code are sent somewhere the attacker controls. It is most often reported on parking machines and other payment points.
What is quishing?
Quishing is phishing that uses a QR code to carry the malicious link, either on a sticker in a public place or inside an email, where an image can slip past filters that would have caught the same link as text.
Does a VCode work without an internet connection?
No, and that is deliberate. The decision is made by the platform at the moment of the scan, which is what makes the code revocable, conditional and auditable. A code that can answer offline is a code whose answer cannot be changed or withheld.
How many VCodes can exist?
Capacity is namespaced and scales on demand: each namespace carries 72 quadrillion possibilities and namespaces are added as required, presently spanning approximately 2.2 quintillion identifiers. Codes do not exist until they are minted.
Where to go next
The technology page covers what happens during a scan, closed-loop generation and the rules engine in more depth, with interactive illustrations. Applications covers where it has been deployed, and licensing and partnerships covers how to get access.