Understanding QR Code Login: Principles, Token Authentication, and Process Flow

QR codes are ubiquitous in daily life, from payments to app downloads, and understanding their underlying technology helps both developers and users assess security.

The article first introduces QR codes, comparing them to one‑dimensional barcodes and noting that they can encode any string, not just numbers. It mentions online tools for generating and decoding QR codes.

It then explains that QR code login is essentially a token‑based authentication method that performs two tasks: identifying the user ("telling the system who I am") and proving the identity ("proving who I am").

For the first task, the mobile app, already logged in, sends the user’s account information to the PC side via the QR code’s unique ID. For the second task, the mobile app confirms the login without transmitting a password; the confirmation itself serves as proof because the app is already authenticated.

The article outlines the complete workflow:

PC requests a QR code ID from the server, which binds the ID to the PC’s device information.

The server returns the ID; the PC generates a QR code containing the ID.

The mobile app scans the QR code, sending the scanned ID and the user’s identity to the server, which creates a temporary token.

The PC polls the server for QR‑code status; once the server records the scan, the PC updates the UI to “scanned, awaiting confirmation”.

The user confirms on the mobile device; the server then issues a permanent login token for the PC, which the PC uses for subsequent API calls.

A sample token structure used in the authentication process is shown below:

const token = {
  acountid: '账号ID',
  deviceid: '登录的设备ID',
  deviceType: '设备类型，如 iso,android,pc......'
};

The article also discusses security aspects: the token is bound to device information, making it useless if intercepted without the corresponding device, and the temporary token is single‑use to prevent replay attacks.

Finally, the article summarizes that QR code login combines QR‑code generation, token‑based authentication, and state transitions (waiting, scanned, confirmed) to provide a seamless and secure login experience across PC, web, and mobile platforms.