QR Codes for Access Control: Visitor Management and Temporary Passes

1. The Core Pattern

The server issues a signed QR containing: visitor name (optional), allowed zones, valid-from and valid-until timestamps, and a random unique ID. The gate reader validates the signature and expiry offline or with a quick server ping.

2. One-Time vs Multi-Use

* One-time: invalidated after first use, ideal for single-visit guests. * Multi-use with expiry: valid for a contractor working for one week, checked each entry against the server.

3. Revocation

Server-side revocation works only when the reader has connectivity. For offline or low-connectivity gates, use short expiry windows so revoked passes expire quickly.

4. Display

Send the QR to the visitor by email before arrival. Display it on their phone or print it, and include name and date so security can cross-check visually.

5. Audit Log

Every scan event creates an immutable audit entry. This is valuable for investigating incidents or satisfying health-and-safety requirements.