How a QR code that changes every 30 seconds stops pass sharing
A paper pass, a plastic card or a fixed QR code can be lent, photographed or forwarded. Here is what a rotating code changes at the door, and what it doesn't.
Every venue that sells passes has the same quiet problem: a pass proves that someone paid, not that the person at the desk is that someone.
How a pass gets shared
- The card is lent. A friend borrows a plastic card or a paper pass for an evening, and nobody at the desk can tell.
- The punch card is "at home". "I forgot it, mark me next time." Next time rarely comes.
- A fixed QR code is forwarded. Many systems put a QR code in an email or on a card. It's the same code every day, so a photo of it works as well as the original, for anyone, for as long as the pass lasts.
- The front desk knows everyone, until it doesn't. In a small studio the receptionist knows the regulars. Add a new receptionist or a busy Monday evening, and that knowledge is gone.
None of these needs a dishonest member, only a convenient one. That's why they're so common.
What a rotating code does differently
In Abonatus, the member's QR code isn't printed or emailed. Their phone generates it, and it changes every 30 seconds.
When a member signs in, their phone receives a secret that only that phone and our server know. From that secret and the current time, the phone works out the code for the current 30 seconds. The receptionist's phone scans it, and the server does the same calculation and compares the two. If they match, the code is genuine and fresh.
Three things follow from that.
A screenshot goes stale within a minute or two. A code is accepted for a short while, to allow for a slow scan or a phone clock that runs a little fast, and after that it's simply wrong. A photo sent to a friend is useless by the time they reach the door.
A code works once. Once a code has let someone in, the same code shown again is refused as reused, so two people can't walk in one after the other with the same screen. A member who steps out and comes back the same day is still let in: they're already in today, their photo is on the receptionist's screen, and it doesn't count as a second visit.
One phone per account. If a member signs in on a second phone, the first one stops producing valid codes. Sharing a login means one of the two phones stops working at the door.
And because the code is worked out on the member's phone, it works without signal. A basement changing room with no reception is no problem. Only the receptionist's phone needs the internet, to check the code.
The photo is the part people forget
A rotating code proves that the phone is the member's phone. It can't prove that the person holding it is the member, because anyone can hand over an unlocked phone.
That's what the photo is for. Every scan shows the receptionist a full-screen green or red verdict with the member's name and photo, and a glance is enough. The front desk takes the photo once, with their own phone, and only the venue's signed-in team can see it.
What it doesn't stop
It's worth being honest about the limits.
- Someone who never comes to the desk. If the door is open and nobody is at reception, no code helps. What Abonatus does is record every entry, who let the person in, and whether it was scanned or entered by hand. It can't count the people who walked past the desk, but it settles every argument about the people who didn't.
- A receptionist doing a friend a favour. A member who forgot their phone can be let in by name, but the same rules apply as for a scan, so the pass has to be valid. The entry is marked as manual, and the owner sees manual entries separately.
The point isn't catching people
Most members never try anything. The point is to make the honest way the easy one: open the app, show the phone, walk in. When that takes two seconds, nobody needs a story about a forgotten card, and the person at the desk doesn't have to be the one who doubts them.