Using checksums to prove a printed QR code was not altered
A printed QR code has a simple vulnerability: anyone who can reprint it can change it. A checksum closes that gap for the recipient. The sender hashes the exact payload with SHA-256 and shares the checksum through a separate channel — a letter, an email, a second label. The recipient decodes the printed code, hashes what they decoded, and compares. If the two checksums match, the payload is byte-for-byte identical to what the sender hashed. If a single character differs — a swapped digit, a changed letter, an extra space — the checksum changes completely, and the mismatch is obvious.
The separate channel is the whole point, and it is where checksum schemes usually fail. A checksum printed on the same label as the code, or embedded inside the payload itself, proves nothing: an attacker who replaces the code can replace the checksum alongside it. The checksum must travel independently of the code it protects. For a mailed ticket, the checksum goes in the letter while the code goes on the ticket. For a posted notice, the checksum lives on a page the owner controls while the code hangs on the wall. Two channels, one comparison.
Exactness matters. A hash is computed over bytes, not over the general idea of the text. Trailing spaces, line breaks, capitalisation, and non-ASCII characters all change the result. That is why verification notes should reproduce the payload exactly, and why the recipient should hash the decoded text rather than retyping it from memory. Retyping invites transcription errors that produce a mismatch on a genuine code — and a verification system that cries wolf will soon be ignored.
Know what a checksum does not prove. It proves integrity, not authorship. A matching checksum says the payload was not altered since it was hashed; it says nothing about who hashed it. If you need to prove who created the payload, you need a digital signature, where a private key signs the hash and anyone can verify it with the public key. Checksums answer "was this changed?"; signatures answer "who wrote this?". Use the tool that matches the question.
In practice, checksums shine in low-volume, high-trust workflows: tickets, certificates, inspection labels, and handover documents where a recipient has reason to check. Keep the workflow light — full checksum in the accompanying note, short checksum in print where space is tight, and a verification step that takes seconds. A check nobody performs is decoration; a check that takes seconds gets done.