How QR Code Login Works: From Token Authentication to Secure Mobile‑PC Sign‑In

Introduction

QR codes appear everywhere—from checkout counters to public transport—yet many users wonder how a QR code can be used safely for login without exposing personal data. Understanding the underlying technology helps developers choose the right solution and helps non‑technical users recognize trustworthy QR codes.

QR Code Basics

A QR code stores a string of data, which can be a simple numeric identifier (like a barcode) or any arbitrary text, URL, or token. Online generators (e.g., Grass QR) convert input strings into visual codes, and scanners can decode them back into the original content.

Token‑Based Authentication Overview

Modern mobile apps avoid storing passwords after the first login. Instead, they use a token that binds an account ID, device ID, and device type. The token is generated by the server after a successful password login and is sent with each subsequent API request.

const token = {
  accountId: '账号ID',
  deviceId: '登录的设备ID',
  deviceType: '设备类型，如 iOS, Android, PC...'
};

The server validates the token by matching the embedded device information with the stored record; if they match, the request is authorized.

How QR Code Login Works

QR code login is essentially a two‑step authentication process:

Tell the system who I am.

Prove to the system that I am that user.

When a user scans a QR code, the mobile app (already logged in) confirms the scan, and the server links the mobile account to the PC session via a temporary token.

Step‑by‑Step Flow

PC displays a QR code containing a unique QR‑ID and polls the server for status changes.

Mobile app scans the QR code, extracts the QR‑ID, and sends the user’s identity plus the QR‑ID to the server.

The server binds the identity to the QR‑ID, creates a temporary one‑time token, and returns it to the mobile app.

The mobile app prompts the user to confirm login; upon confirmation it sends the temporary token back to the server.

The server generates a permanent login token for the PC, returns it to the PC via the polling response, and the PC session becomes authenticated.

During this process the password never travels to the PC, and the temporary token can be used only once, preventing replay attacks.

Key Diagrams

Summary

The QR‑code login mechanism combines a unique QR‑ID, token‑based authentication, and a short‑lived temporary token to securely transfer the user’s identity from a trusted mobile device to a PC or web client without exposing passwords. The process is applicable to native PC, web, and mobile clients, and can be extended to third‑party login scenarios (e.g., WeChat, QQ) with similar principles.