Event Ticket QR Codes: Generation, Validation, and Security
QR codes on event tickets must balance ease of scanning with resistance to duplication and fraud. A well-designed ticket QR system validates entry in under one second while preventing unauthorized copies.
Key Takeaways
- Each ticket QR code encodes a unique identifier — typically a UUID or cryptographically signed token.
- Unique per ticket:** Never encode the same data in multiple QR codes
- Scanner reads QR → sends identifier to server → server checks validity and marks as used → returns allow/deny.
- The simplest fraud is screenshotting a QR code and sharing it.
- At events with 1,000+ attendees, scan speed determines entry throughput.
Event QR Generator
Generate calendar event data for QR codes in iCalendar format
Ticket QR Code Architecture
Each ticket QR code encodes a unique identifier — typically a UUID or cryptographically signed token. The identifier maps to a record in the event management database containing the ticket holder's information, ticket type, and validation status.
Generation Best Practices
- Unique per ticket: Never encode the same data in multiple QR codes
- Cryptographic signing: Embed a digital signature that the scanner verifies offline, preventing forged QR codes
- Error correction level H: Events involve physical handling (folding, pockets, rain) — maximum error correction prevents scan failures
- Minimum size: 3×3 cm for reliable scanning at arm's length under variable lighting conditions
Validation Workflow
Online Validation
Scanner reads QR → sends identifier to server → server checks validity and marks as used → returns allow/deny. Latency must be under 500ms to maintain entry throughput. Requires network connectivity at the venue.
Offline Validation
For venues without reliable connectivity, embed a cryptographic signature in the QR data itself. The scanner verifies the signature against a pre-shared public key without contacting the server. Trade-off: offline validation cannot detect duplicate use in real time.
Preventing Fraud
Screenshot Duplication
The simplest fraud is screenshotting a QR code and sharing it. Mitigate with first-scan-wins policy (the first person to scan enters, duplicates are rejected) and rotating QR codes that change every 30 seconds in the ticket app.
Counterfeit Tickets
Without cryptographic signing, anyone who knows the QR format can generate valid-looking codes. Always sign the ticket data so scanners can verify authenticity.
Scaling for Large Events
At events with 1,000+ attendees, scan speed determines entry throughput. Aim for sub-second validation per ticket. Pre-download the attendee database to scanner devices for offline capability. Deploy multiple scanning lanes with independent devices to avoid single points of failure.