By the VixQR team · published on · 2 min read
Why Do Passkeys Use a QR Code?
You open a site on a computer and choose to use a passkey. A QR code appears. Your phone scans it, you confirm with a fingerprint, face or screen lock,…
You open a site on a computer and choose to use a passkey. A QR code appears. Your phone scans it, you confirm with a fingerprint, face or screen lock, and the computer signs you in. Does the QR code contain your password? No.
This is cross-device authentication defined by the FIDO ecosystem. It lets a passkey on a phone authenticate a session on another device.
What the QR code actually does
The QR code carries information used to begin a session between the devices. It does not reveal the passkey’s private key. That key remains protected by the phone or its passkey provider.
After the scan, the protocol establishes protected communication and verifies that the devices are nearby. The user approves the action on the phone. The site then receives a cryptographic proof bound to its own domain, not a reusable secret like a password.
Why is Bluetooth involved?
FIDO’s hybrid flow uses Bluetooth Low Energy to check physical proximity. According to FIDO, security does not rely only on ordinary Bluetooth protections; the protocol adds its own cryptographic layer.
The proximity check limits remote attacks. A distant attacker should not be able to finish sign-in with a photograph of the QR code alone because they lack proximity and approval on the device holding the passkey.
Passkey QR versus ordinary QR sign-in
Not every “sign in with a QR code” screen uses the same technology. Some services display a proprietary session token. Others use FIDO Cross-Device Authentication. The visual pattern does not reveal the protocol.
In every case:
- verify the site shown on the computer;
- read the phone’s confirmation screen;
- never approve an unexpected request;
- do not scan a code sent by a stranger claiming to fix an account problem.
Is it safer than a password?
A passkey is bound to the service for which it was created. Domain binding strongly reduces conventional phishing: a fake site cannot obtain a proof valid for the genuine domain. Biometrics stay on the device; the service receives only the required confirmation.
No system removes every risk. A compromised device, weak account recovery or careless approval can still cause harm. Passkeys do remove the shared secret that people had to remember, type and often reuse.
Can a general generator create this QR code?
No. The browser or platform creates the passkey session code as part of the protocol. Copying its content into a general generator does not create secure authentication and may expose temporary session data.
VixQR is appropriate for URLs, contact details, Wi-Fi and static content. For passkeys, let the browser and FIDO APIs generate the session code.