Skip to content
QR Code Tools logo
QR Code Tools
Sign in
Security Tool

QR Payload Hash Verifier

Hash a QR payload with real SHA-256 / SHA-384 / SHA-512 / SHA-1 in your browser via Web Crypto, then compare it against an expected hash to prove the code is unchanged.

1. Enter the payload and expected hash

Result

SHA-256 of the payload above

Computing…

Enter an expected hash to compare against.

Comparison ignores spaces and letter case in the expected hash, so pasted hashes with line breaks still compare correctly.

Proving a QR Code Has Not Changed

A printed QR code cannot be edited, but its payload can be copied, re-printed, or swapped. A hash is a fingerprint of the payload: change even one character and the fingerprint changes completely. If you recorded the hash when the code was created, comparing a fresh hash of the payload against that record proves whether the code in front of you is the one you issued.

How to use the hash in practice

When you generate a code, record its payload and its SHA-256 hash in the job file. Later, scan the printed code, paste the decoded payload here, and paste the recorded hash as the expected value. A match means the payload is byte-for-byte the one you recorded. A mismatch means something changed — a retyped URL, a different code, or a substituted print — and the code should not be trusted until the difference is explained.

Which algorithm to pick

SHA-256 is the sensible default for verification records: widely supported, fast, and collision-resistant for this use. SHA-384 and SHA-512 give longer fingerprints; SHA-1 is shown for compatibility with older records but should not be used for new ones, because it is no longer considered collision-resistant.

  • Hash the exact payload, including every character — trailing spaces and line breaks count.
  • Store the expected hash with the job file, not on the printed poster.
  • A match proves the payload is unchanged; it does not prove the destination page is safe.
  • If the destination is a dynamic link, the payload can match while the page it points to has changed.

Frequently Asked Questions

What does a mismatch mean?

The payload differs from the recorded one in at least one byte — a character, a space, or a line break. Treat the code as untrusted until the difference is explained.

Does a match prove the destination is safe?

No. It proves the payload is unchanged. A dynamic link can still point to a changed page, so check the destination separately.

Why SHA-1 and SHA-256 give different hashes?

They are different algorithms with different digest lengths. Always compare hashes made with the same algorithm.

Where does the hashing happen?

In your browser with the Web Crypto API. The payload is never sent anywhere.