Security

Here is exactly how we protect your account and your codes.

Payments

Payments are handled by Stripe, which is certified PCI DSS Level 1, the highest level for card security. You type your card on Stripe's checkout page. FutureQR never sees or stores your card number.

Your account

• Every page is served over HTTPS.
• Passwords are never stored. We store a salted, slow hash (PBKDF2-SHA256) mixed with a secret key kept outside the database, so a stolen database alone cannot be used to guess passwords.
• Two-factor sign-in with an authenticator app, plus 10 one-time recovery codes. Turn it on from Your codes.
• Sign-in cookies are HttpOnly and Secure, and expire after 30 days. A password reset signs you out everywhere.
• Repeated wrong two-factor codes lock the attempt.

Your codes

• Short links run on Cloudflare's global network.
• Redirects happen first. Counting a scan never slows or blocks a printed code.
• Only you can see your codes, destinations and scan details.

Report a problem

Found a security issue, or a FutureQR code pointing somewhere harmful? Email hello@futureqr.app. We read every report.