Digitally Signed QR Codes: How a Code Proves It Wasn't Faked

What it is

A digitally signed QR code carries the usual data — a name, a date, a serial number, a set of claims — plus a cryptographic signature made with the issuer's private key. Scan it with the right app, and it can confirm two things: who created the code, and that nothing in it has changed since it was signed.

An ordinary QR code doesn't offer that. It's just data anyone can generate, including a fake sticker slapped over a real code on a parking meter or menu. A signature closes that gap.

How it actually works

Signing: data plus a private key. An issuing authority — a government agency, a health system, a manufacturer — encodes the relevant fields into the code, then signs that data with a private key only it holds. ISO 22376 standardizes this pattern as a Visible Digital Seal (VDS): a data format for carrying signed, verifiable information in a 2D barcode on any document or object, built to complement — not replace — ICAO's own VDS-NC specification for travel and health documents.

Verifying: a public key, no live connection needed. No calling the issuer back required. A reader app holds — or has already downloaded — the issuer's public key, and uses it to check the signature locally. Because the math only works one way, a valid signature could only have come from the matching private key. Change even one character of the encoded data and it invalidates instantly. That's what makes silent tampering detectable: edit a date or a name on a signed code, and the check fails the moment someone scans it.

A real, deployed example. The EU Digital COVID Certificate works this way. Its data is converted to CBOR, signed with ECDSA under the COSE framework, compressed, encoded to Base45, and rendered as a QR code. Verifier apps check it entirely offline, matching the signature against a public key each issuing country distributed in advance through a shared gateway — no network call at scan time.

Where you'll actually see this

Signed codes show up wherever a scan needs to double as proof, not just a link. Travel and health documents under ICAO's VDS-NC standard were the first major deployment. Mobile driver's licenses use a related model, letting a phone's QR code stand in for a physical ID a scanner can trust without calling a DMV database. ISO 22376 extends the same idea to product authentication and supply-chain labels, so expect it to spread further over the next few years.

This is worth separating from the QR code problems most people actually run into. Quishing — a fake code that redirects to a phishing site — exploits trust in an unsigned URL. A signed code carries structured data checked against a signature, usually with no clickable link at all. Different attack, different fix.

Tips, gotchas, and a quick how-to with QRDock

A signature proves origin and integrity, not that the underlying claim is true. That distinction matters. Fraud investigations tied to COVID-19 certificates in Italy, France, and Greece found cases where the cryptography held up perfectly, but the certificate itself was false — in France via healthcare workers with legitimate database access, in Greece via a physician issuing certificates for vaccinations that never happened. A verifier app would have said "this signature checks out," because it did. The fraud happened at issuance, not in the crypto.

For most everyday scans, VDS-style signing isn't what you'll run into — you're far more likely to hit an ordinary code that's been swapped or pointed somewhere it shouldn't. QRDock's scanner flags suspicious destinations and lets you inspect a code's raw payload before you trust it, which catches the tampering people actually deal with day to day.

Frequently Asked Questions

Is a digitally signed QR code encrypted?

No. Signing and encrypting are different things. A signed code's data is usually still readable by anyone who scans it — the signature only proves who signed it and that it hasn't been changed, not that it's secret.

Can someone copy a digitally signed QR code?

They can copy the image, but not forge a new one. Copying a legitimate code just reproduces the same valid signature for the same data — it doesn't let anyone change a name, date, or amount and still pass verification.

Do I need an internet connection to verify a signed QR code?

No. Verification apps carry or fetch the issuer's public key ahead of time, so checking a signature is a local, offline calculation — that's the whole point of the design.

Does a digital signature stop all QR code fraud?

No. It stops tampering after the code is issued, but it can't catch a legitimate issuer signing false data by mistake or through insider abuse — real fraud cases have exploited that gap, not the cryptography itself.

Conclusion

A digitally signed QR code proves two specific things: who issued it, and that nothing has changed since. That proof comes from a private-key signature any verifier can check offline against the issuer's public key — no server call needed. As ICAO's VDS-NC and the newer ISO 22376 standard spread into IDs, product labels, and certificates, it's a meaningfully different guarantee than the QR codes most of us scan every day.