How it works
Nobody has ever read a QR code.
That is not a figure of speech. A QR code is a dense binary encoding meant for a camera, and there is no version of a human glancing at one and knowing where it goes. Every single scan is an act of trust in whoever printed it.
Which is a problem, because anyone can print one.
QR codes have no issuer, no signature and no authority behind them. A sticker over the top of the one on a parking meter works exactly as well as the original. The scam even has a name now, quishing, and the reason it works is not that people are careless. It is that the format gives them nothing to be careful with.
Everyone in the industry responded by making codes prettier. Brand colours, a logo in the middle, a nice frame. All of which makes a code look more trustworthy without making it more trustworthy, which is precisely backwards.
So we stopped pretending the code is readable.
A QRPrompter code does not carry a link. It carries an encrypted payload, and the key lives on this server. Decode one with any scanner app and you get this:
There is nothing to read, nothing to copy and nothing to reuse. The code is a sealed envelope, and the only address on the envelope is ours. That is the difference between a redirect, which anyone who scans it can lift and use forever, and a seal, which cannot be opened away from the thing that sealed it.
The parts, plainly.
The encoding
The payload is compressed when compression helps, encrypted with AES-256-GCM, then written in uppercase base32. Base32 looks wasteful next to base64 and is not: QR has a dense alphanumeric mode that base64's lowercase letters would drop us out of, so base32 produces a code about eighteen percent smaller. It also means you can read a code off a sticker and type it.
The authentication
GCM means the code is signed as well as encrypted. Change one character of a sealed code and it does not decode into something else, it fails. You cannot edit somebody's sealed code into a different prompt.
The lock
A locked code derives its key from the passphrase using scrypt, mixed with the server key. Nothing anywhere stores a key that works without the passphrase, so there is no check to skip and no lock to pick. Lose the passphrase and the prompt is gone, which is the honest consequence of the guarantee.
The measurement
When an AI fetches the reference data for a code, that fetch is logged and separated from ordinary crawler traffic. Every code also carries a canary, a fact that exists in nowhere but its own payload, so if the canary turns up in the answer you know the fetch genuinely fed it. That is a stronger attribution signal than a scan count.
And the part we will not oversell.
Once the scanner taps through, their AI receives the prompt in plain text, because no AI can decrypt anything. A curious person can read it there. The seal protects the printed code, stops your prompt being lifted from a photograph, and makes the code useless to anyone who bypasses us. It does not keep a secret from the person holding the phone. If that matters for your use, lock the code so only people you gave the key to ever get that far.