How to put a hidden message in a QR code

A QR code is not mysterious. Anyone with a phone can scan it. That's the design: open, instant, universal. Which makes it a strange choice for a secret.

But that's also the point.

Most people don't realize a QR doesn't have to carry just one thing. It holds a URL, and any scanner reads that URL and opens it. That URL can point somewhere completely ordinary. And separately, inside the same code, there can be a message that only opens if you have the right app and the right key.

The gap between "anyone can scan this" and "only one person can read it" is where GhostCode's Decoy Link feature lives.

How it works at the surface

When you create a QR in GhostCode with Decoy Link turned on, you give it two things: a public URL and a hidden message. A standard QR scanner reads the public URL and opens it. That works for anyone, no app required.

The hidden message sits in a different part of the QR's encoded URL, the part that standard scanners don't act on. The GhostCode app reads it, but only if you enter the correct Key. Without the Key, the app can tell there's something there but can't open it.

So the QR functions as a normal QR. It also, simultaneously, carries something private.

QR versus a hidden photo

GhostCode's Pixel Ghosting mode hides a message inside an image that looks like an ordinary photo. It fits anywhere a photo fits: a chat, a printed card, a shared album. A QR is more visible as a QR. People see it and expect to scan it.

But a QR has something a photo doesn't: the Decoy Link. The public URL can point to real content that anyone might want. The QR earns its place for everyone who scans it, and also does a second, private job for one person.

A scavenger hunt is the obvious case. Every participant scans the code and gets the next clue. One participant scans it inside GhostCode, enters their Key, and gets a private message that changes what they're looking for. Nobody else knows the second layer is there.

Or consider a card. A QR on the back of a thank-you note opens the sender's website for most people. For one person, it opens something you wrote just for them. The card looks identical to everyone.

The key travels separately

The Key is never inside the QR. You share it with the recipient the same way you'd share a password: in person, over the phone, or in a separate message. The QR itself goes wherever it goes. The Key goes only to them.

The recipient needs GhostCode installed. When they scan the QR with a standard camera, they land on the public URL. When they scan it inside GhostCode and enter the Key, the message opens. That two-step is intentional. The QR looks ordinary; the access is narrow.

Self-destruct is available on the hidden layer. Set a timer and the message expires at a time you choose. The public URL keeps working after that. Only the private message goes dark.

There's also Failsafe. If you'd rather not explain why a QR has a hidden layer, you can set a second key that reveals harmless content instead. Hand over that key and whoever asked sees something ordinary. The real message stays closed. It's a niche feature, but it's there for the situations that call for it.

What this doesn't guarantee

A screenshot taken while a message is open is outside anyone's control. GhostCode controls when the app will re-open a message after a self-destruct timer expires. It can't undo a screenshot that already happened. Self-destruct stops re-opening, not captures already taken.

The recipient also has to have the app. A Decoy Link QR works fine for everyone without it; the hidden message doesn't. That's the design, not something to apologize for. The point is exactly that only one specific person can read it.

For more on hiding messages inside photos instead, How to hide a secret message inside a photo covers Pixel Ghosting in detail. And if the broader concept of hiding information in plain sight is new to you, What steganography actually is has the history and context behind it.