Most identification technologies answer the question what is this? VCode answers a harder one: is this genuine, should this person have it, and is right now the right moment?
That is a difference in category, not in performance. A barcode is a data carrier. VCode is an identification system in which issuance authority, server-side resolution and policy enforcement are intrinsic rather than layered behind an openly generated carrier.
What actually makes it different
Identification, not redirection
A data-carrying code hands your device a destination. A VCode hands it an opaque reference with no destination and no readable business payload. The meaning is resolved by the platform at the moment of the scan.
Closed-loop issuance
Valid codes are produced by the platform. Anyone can generate a QR code that looks exactly as legitimate as yours in a few seconds, for nothing. A symbol produced outside the platform is not a VCode and resolves to nothing, which is what makes counterfeit codes a manufacturing problem rather than a printing one.
Server-side resolution
Every scan is a question put to the platform. That is the cost, because it requires connectivity, and it is also the entire benefit: a decision made at scan time is a decision you can still change.
Per-item identity
Capacity is not a fixed ceiling. Codes are issued within namespaces, each carrying 72 quadrillion possibilities, and namespaces are added as demand requires, so the system scales rather than running out. The space presently spans approximately 2.2 quintillion identifiers. That is enough to identify the individual item rather than the product line, and it stays readable down to about 5 mm.
A code does not exist until it is minted. Identifiers are not allocated from a pre-existing pool, they are brought into being at the moment of issue. That is why a symbol produced outside the platform is not an unauthorised code, it is not a code at all, and resolves to nothing rather than to something refused.
Context-aware rules
Each code carries conditions that are evaluated on every scan: permitted location by radius or polygon, date and time windows including hours of the day, the platform the scan came from, single use (once only, or once per user, device, day, week, month or year), named users or email domains, invalidation for specific people, and values supplied by the integration. A rule can refuse the scan, or return a different response instead.
Revocation and audit
A code can be withdrawn after it is printed, and the printed symbol simply stops resolving. Every scan is written to history, including the refusals, which are usually the more interesting events.
One symbol, different answers
The same printed code can return one thing to one person and something else to another, or something different on the hundredth scan than on the first, without the symbol changing at all.
Honest comparison
Every technology below is good at something VCode is not. A comparison that only flatters one side is marketing, and it is easy to take apart.
| Technology | How it is read | What the carrier holds | Where it genuinely wins |
|---|---|---|---|
| QR code ISO/IEC 18004 |
Any phone camera, no app | Its payload, readable by anyone | Ubiquity, zero cost, works offline, open standard. For handing someone a link or a menu it is the right answer. |
| Data Matrix ISO/IEC 16022 |
Camera or industrial scanner | Its payload, with strong error correction | Very small marking and regulated supply chains. GS1 DataMatrix is the mandated symbol on prescription medicine packs under the EU Falsified Medicines Directive. |
| NFC 13.56 MHz, ISO/IEC 14443 |
Tap, roughly 0 to 4 cm | A chip, which can hold keys and perform cryptographic authentication | Tap-to-authenticate, no line of sight, works in the dark or through packaging, and tamper-evident constructions. Genuinely strong for product authentication. |
| RAIN RFID UHF, 860 to 960 MHz |
Reader infrastructure, up to about 12 m | A chip, read without line of sight | Verifying physical presence in bulk. Around a thousand tags read at once, without line of sight, which is why it runs stock counts and warehouse logistics. |
| VCode | Phone camera, through the app or an approved SDK | An opaque reference. No destination, no business payload | Issuer control after issue: policy per scan, revocation, holder binding, different responses from one symbol, and a record of every attempt. |
Physical performance
Most of this page is about what happens after the scan. This section is about the scan itself, because the symbology was designed to be read in conditions where a data-carrying code struggles.
| QR code | VCode | |
|---|---|---|
| Minimum size, standard smartphone | About 1.2 cm | 5 mm |
| Minimum size, assisted scan | Not supported; data blocks bleed | 100 microns |
| Read distance | Roughly 10:1 distance to size | Over 100 m at appropriate scale |
| Read angle | About 40 degrees | Up to 170 degrees |
| Damage tolerance | Roughly 1 to 10 per cent | Around 30 per cent |
The read angle and damage tolerance are the two that matter most in the field. A code on a curved bottle, a creased label, a scuffed component or a machine panel scanned from the side is the normal case, not the exception, and it is where a marginal read becomes a support call.
The comparison in full
Thirteen dimensions, five technologies, and no attempt to win every row. Several cells depend on how a system is implemented rather than on the carrier itself, and they say so.
| Dimension | QR code | Data Matrix | NFC | RAIN RFID | VCode |
|---|---|---|---|---|---|
| Issuance | Open. Anyone can generate one free | Open. Anyone can generate one free | Chips bought from vendors; keys can be controlled | Tags bought from vendors; numbering controlled by the user | Closed-loop. Only the platform issues a valid code |
| What the carrier holds | Its payload, readable by anyone | Its payload, with strong error correction | Chip memory, which can hold keys | An identifier plus optional user memory | An opaque reference. No destination, no business payload |
| Smartphone accessibility | Any camera, no app | Most cameras, some need an app | Modern iOS and Android read tags natively | No. Needs a dedicated reader | The app or an approved SDK |
| Specialised hardware | None | None for print; industrial scanners for very small marks | A chip in or on every item | A tag per item and reader infrastructure | None beyond a phone |
| Item-level identity | Yes, if serialised | Yes, and standard in pharmaceutical serialisation | Yes, one chip per item | Yes, one tag per item | Yes, inherent to the design |
| Server-side policy at the moment of the scan | Only if the destination you control implements it | Only if the destination you control implements it | Possible with cryptographic authentication and a backend | Possible in the reader system you operate | Intrinsic. Rules are evaluated on every resolution |
| Revocation | Only by breaking the destination it points at | Only by breaking the destination it points at | Possible if your backend validates every tap | Depends entirely on your system | Intrinsic. The printed symbol stops resolving |
| Copy behaviour | A copy works exactly as well as the original | A copy works exactly as well as the original | Cloning is resisted by cryptographic authentication | Basic tags are cloneable; secure variants exist | A copy is judged by the rules; a counterfeit symbol resolves to nothing |
| Location and time rules | Only in your own application | Only in your own application | Only in your own application | Reader location is implicit | Intrinsic. Geofence, date range and hours of the day |
| Holder binding | Application level only | Application level only | Possible with an authenticated session | Not typically | Intrinsic. Named users or email domains |
| Audit history | Redirect hits, not scans | None inherently | Only what your backend records | Read events in your own system | Every resolution, including refusals |
| Deployment considerations | Free, instant, works offline | Cheap to print; regulated supply chains already use it | Unit cost, material interference, placement in the product | Reader estate and tag cost | Connectivity, app or SDK adoption, and licensing |
| Best fit | Handing someone a link at scale | Very small marking and regulated goods | Tap authentication, offline, through packaging | Confirming which items are physically there | When the identifier itself must take part in a trust decision |
The conclusion is not that VCode wins everything. It is narrower and more useful than that: choose VCode when the identifier itself needs to participate in a controlled trust decision. If the identifier only has to be read, something on this table is cheaper, more open and more widely supported, and you should use it.
Choosing honestly
- Need reach above all? QR code. Every camera on earth reads one.
- Marking something tiny, or shipping regulated medicines? Data Matrix.
- Need to confirm which items are physically present, without line of sight? RAIN RFID. That is verification, and a camera cannot do it.
- Need cryptographic authentication at the item, offline, through packaging? NFC, and the chip cost is worth it.
- Need to control what a code means after it is in the world? VCode.
These are not mutually exclusive. A product can carry a Data Matrix for the regulator, RFID for the warehouse and a VCode for the customer-facing interaction, each doing what it is best at.
Where VCode is the wrong choice
Stated plainly, because you will find this out anyway:
- No connectivity at the point of scan. Resolution is server-side by design. A code that can answer offline is a code whose answer cannot be changed or withheld.
- You need any camera app to work. Reading goes through the app or an approved SDK. That is the same property that makes the code controllable, but it is a real adoption cost.
- You want an open, royalty-free standard. VCode is proprietary. QR and Data Matrix are ISO standards anyone can implement.
- The code only needs to point at public information. Use a QR code and spend the integration effort elsewhere.
How it is deployed
Codes are generated and managed through the platform API, and reading is added to an existing application through the SDK. Rules, actions and packages are configured against each code, and scan history is available for evidence and analytics. The developer documentation covers the API surface, and licensing and partnerships covers access.
The argument is set out at length in VCode vs QR code: why a reference beats a payload, alongside the rest of Insights.