How a verification note makes a QR code checkable
A QR code asks for blind trust: the recipient cannot read it, so they trust the context around it. A verification note replaces blind trust with a check anyone can perform. The note carries three things: the exact payload, its checksum, and the steps to compare them. The recipient decodes the code without opening the link, compares the decoded text against the note, hashes it, and compares the checksum. Two matches mean the code is identical to what the issuer produced. Any mismatch means stop.
The independent channel is the part that makes the scheme work. A note printed on the same label as the code, or handed over in the same envelope with no other connection to the issuer, proves nothing — an attacker who replaces the code can replace the note. The note must arrive through a route the attacker does not control: a letter from an address the recipient knows, an email from a familiar sender, a page on the issuer's own site. The check compares two independent sources, and independence is what gives the comparison its power.
Precision matters as much as independence. A hash is computed over bytes, so the payload in the note must match the payload in the code exactly — same capitalisation, same punctuation, no trailing space, no line-break difference. That is why this tool computes the checksum from the payload you type, rather than letting you type a checksum from memory. When the recipient checks, they should hash the decoded text directly, not retype it: retyping introduces errors that produce false mismatches, and a verification system that cries wolf will soon be ignored.
Be clear about what the note does not prove. A checksum proves integrity — the payload was not altered since it was hashed. It does not prove authorship. If the recipient needs to know who issued the code, the issuer must sign the checksum with a private key, and the note must say which public key verifies the signature. Many workflows do not need that: a ticket, a certificate, or a handover document where the recipient already knows the issuer only needs integrity. Use signatures when authorship is the question, and say so in the note.
Keep the recipient's side of the workflow light. Four steps, plain language, no jargon, and a clear instruction for the mismatch case: stop, and contact the issuer through a trusted channel. A verification note that takes a minute to follow will be followed. One that reads like a security manual will be skipped — and a skipped check protects nobody.