QR Codes on Corporate ID Cards: Access Credentials and Employee Verification

1. What to Encode

Encode an opaque token that maps to the employee record in your identity system. Never encode personal data, home address, or salary information in a printed QR.

2. Rotating vs Static

For building access, a static token is acceptable if the reader verifies against the current access control list on each scan. For high-security zones, use a time-based rotating token (TOTP) similar to an authenticator app.

3. Revocation

When an employee leaves, disable the token in the identity system. All gate readers check the token status on each scan, so access is revoked immediately on termination.

4. Multipurpose Use

The same QR can serve multiple systems: building access, cafeteria cashless payment, event check-in, and IT asset sign-out. Each system checks the token independently, reducing the number of cards issued.

5. Card Durability

Corporate ID cards are PVC or polycarbonate. Print the QR code in the card substrate layer or laminate, not on an adhesive label that can be peeled and swapped.