What “signed” means
- Who issued it. The verification page shows the account that signed the code. An organization that verified its website domain with a DNS record gets a blue check and its domain next to the name. Without it, the page marks the name as not verified.
- What’s covered. The destination, the label and the dates sit under an Ed25519 signature. Change any of them and the signature check fails.
- Expiry and revocation. Set an end date, or revoke a code whenever you want. After that, the next scan says the code expired or was withdrawn.
- Link checks. The destination is checked when the code is created and each time it’s scanned. The checks use public lists of known phishing and malware sites where available, plus simple rules such as shortened links, unusual domain extensions and look-alikes of well-known brands. A brand-new phishing page may not be listed yet.
From dashboard to scan
- Create and sign. Enter the destination, a type (menu, parking, payment and so on), an optional printed label such as “Meter 0423” and an optional end date. QRalo signs them with your organization’s private key.
- Print with the label. Download the code as a PNG and print it on your sticker, plate or table tent, with the same label next to it.
- Scan. The code holds a
qralo.com/verifylink, so any phone camera opens the verification page first. No app needed. - Check. The page checks the signature and the status, then shows the issuer, the full destination and the printed label before anyone continues.
Roughly what a code contains before it’s encoded, with comments added for reading:
{
"v": 1,
"id": "3f6c…", // unique code ID
"url": "https://example.com/pay", // destination
"context": "PARKING", // type of code
"org": "…", // issuing organization
"loc": "Meter 0423", // printed label (optional)
"iat": 1793577600, // issued at
"exp": 1825113600, // expires at (optional)
"sig": "…" // Ed25519 signature of all of the above
}A regular QR code next to a signed one
| Question | Regular QR code | QRalo signed code |
|---|---|---|
| Who issued it? | Unknown | The issuing account, and whether its domain is verified |
| Was it changed? | No way to tell | Any change breaks the signature |
| Where does it lead? | Depends on the camera app | Full destination shown before opening |
| Can it be switched off after printing? | Only dynamic (redirect) codes | Yes, by revoking it or with an end date |
| Can the destination be edited after printing? | Only dynamic (redirect) codes | No. The destination is part of the signature. Create a new code and reprint. |
Stickers on top of your code
A fake sticker over your code never opens qralo.com. Someone who scans it with a normal camera goes straight to the fake page.
Your real codes always open a page on qralo.com with your name and your label. Print a line like “Scanning opens qralo.com first” next to them, and a code that skips the page stands out. Our security page covers how verification works and what data we collect.
Where it’s used
- Parking and payment meters. Drivers check the operator and the meter number before they pay.
- EV charging. The charger and connector reference show on the verification page.
- Restaurants and hospitality. Menu and pay-at-table codes you can revoke if a table tent is tampered with.
Plans
- Free, €0. 3 active signed codes, 100 scans per code, revocation and end dates, domain verification.
- Business, €9.99 a month. Unlimited codes (fair use), unlimited scans, your logo in the middle of the code, advanced analytics with a map, CSV and JSON export.
- Operators and public sector. A guided pilot, on quote. Plan a pilot.
Everything else is on the pricing page.