Uniqode is the only one of these six generators that passes all seven controls on this checklist. It is also the only one that lets a reviewer open the audit evidence without booking a call. Flowcode passes six, Bitly and Scanova pass five each, and QRCodeChimp and QR TIGER pass four. The gap is not in the marketing language, since every vendor gets that right. It is in what each one publishes about two-factor login, single sign-on, roles, password-protected codes, scan filtering, destination checks and audit reports.
That matters because a QR code is a link you cannot read with your eyes, printed somewhere you cannot take it back from. The security of the generator behind it decides who can change where 2,000 delivery labels point, and whether anyone would notice when it happened.
Every control below was checked against the vendors’ own pricing pages, security pages, trust portals and help articles on 21 October 2026. Prices are in USD, with Scanova’s currency selector switched from its default rupee display.
TL;DR
- Uniqode passes all 7 controls and publishes a trust portal listing 22 documents, including a SOC 2 Type 2 report dated 2026.
- Flowcode passes 6 of 7, Bitly and Scanova pass 5, QRCodeChimp and QR TIGER pass 4.
- Two-factor login on the cheapest tier costs $0 on QRCodeChimp and Bitly and $9 on Uniqode and Scanova, while Flowcode and QR TIGER name no tier at all.
- Only Uniqode publishes a malware and phishing check on scan destinations, and it ticks that row on every plan from $9 up.
- SAML single sign-on with a printed price exists at one vendor, Uniqode, as a $500 a year add-on to its $99 a month Plus plan.
How seven controls became a score
The checklist is deliberately narrow, and a control counts as passed only when the vendor’s own site says the feature exists. A control counts as passed on a particular tier only when a pricing table or a help article names that tier. A claim in a blog post counts for the feature and never for the price.
- Controls passed out of seven (35 points) is the headline number, one tick per control, and it goes to Uniqode with seven.
- Evidence a reviewer can download (25 points) rewards a portal that holds the SOC 2 report, the penetration test and the agreements, rather than a sentence saying the vendor is compliant.
- Controls on the cheapest paid tier (20 points) asks what a buyer gets for the smallest invoice. QRCodeChimp wins it outright, because its $6.99 Starter plan carries the same four security rows as its free plan.
- Code-level protections (20 points) covers what happens to the code itself: password gates, expiry rules, anomaly filtering and checks on the destination.
On those weights the totals come out at Uniqode 90, Flowcode 67, Bitly 61, Scanova 53, QRCodeChimp 51 and QR TIGER 40. Scanova and QRCodeChimp sit two points apart, and the order between them follows the controls count, five against four.
1. Uniqode: seven of seven, with the paperwork in public
Uniqode passes every control, and it is the only vendor here whose evidence sits on a public page rather than behind a sales conversation. Uniqode’s pricing table, read on 21 October 2026, ticks two-factor authentication on all four plans. They put SAML single sign-on on Plus as a $500 a year add-on and include it on the tier above Plus. Role-based access control starts on Plus at $99 a month.
The security page states the position in one line: “Enforce SSO with SAML and role-based permissions so the right people have the right access every time.” The same page describes ScanGuard as “our built-in anomaly detection feature” that filters “suspicious scans”, and the pricing table places ScanGuard on Plus and above. A Uniqode help article on password-protected codes puts that feature on “Pro/Core plan and above” and requires a password of at least six characters.
Most vendors fail the sixth control, a check on where the code sends people. Uniqode’s pricing table carries a row called “Malware & phishing URL detection” and ticks it on every tier, including the $9 Essential plan. Uniqode’s guide to safe QR codes explains the mechanism: “Every scan destination runs through malware and phishing detection before a user reaches it.” The same guide says an audit trail “logs every QR Code edit by user, timestamp”. That is the record a security analyst at a logistics company would want on the morning one of 2,000 driver labels started pointing somewhere new.
Control number seven is the audit report, and here the distance between Uniqode and the rest is widest. The Uniqode Trust Center documents run to 22 items, among them a SOC 2 Type 2 report for 2026, a penetration test dated 2025, an ISO 27001 certificate, a data processing agreement and a HIPAA business associate agreement. An announcement dated 2 February 2026 records that ISO 27001:2022, SOC 2 Type II, HIPAA, GDPR and UK GDPR were all renewed after independent audits. Five badges, 23 FAQ answers and a five-company subprocessor list sit on the same page. For the analyst with those driver labels, the portal replaces three weeks of questionnaire email with one afternoon of reading.
2. Flowcode: six of seven, with a trust center of its own
Flowcode passes six controls and fails only the destination check, which it does not publish anywhere this review could find. The Flowcode Trust Center, hosted on SafeBase, shows badges for SOC 2 Type 2, HIPAA, GDPR, CCPA and TX-RAMP Level 2. Its document list includes a penetration test report for each product generation, a SOC 2 bridge letter, a HECVAT and a cyber insurance certificate.
Control headings on the same portal name AES-256 encryption at rest, TLS 1.2 or higher in transit, audit logging, multi-factor authentication and role-based access control. Single sign-on is specific, because a help article dated 25 June 2024 says “SAML SSO is included for customers with Enterprise plans” and names Azure and Okta as identity providers. Password gating exists through input validation on Flowcode 2, where the help center suggests “a password field to gate content”. An enterprise help article describes a toggle that removes bot traffic from reporting.
Two gaps keep Flowcode behind Uniqode on this checklist, and both concern price rather than engineering. The tier that carries two-factor login is not stated anywhere in the help center or on the pricing page, so that control passes on existence alone. Every security control above the free tier belongs to a plan without a public price. Pro Plus is $25 a month and Growth is $250 a month on annual billing, but Growth Plus is “usage based” and Enterprise is “custom”. A buyer who needs SAML SSO is a buyer who books a demo.
3. Bitly: five of seven, two-factor login for everyone
Bitly passes five controls and does one thing none of the other five does, because its pricing comparison ticks two-factor authentication on every plan, including the free one with ads. A support article adds that a “real” mobile number is required, since the second factor arrives by SMS and VoIP numbers are not supported.
Single sign-on, group permissions, user management and the activity log all sit on one tier, Teams, and the pricing page prices Teams as “Custom”. A support article updated 15 October 2025 lists the identity providers as PingFederate, OneLogin, Google Workspace, Okta and Microsoft Entra ID. The word SAML does not appear on the pages read for this review. Bitly therefore passes the SSO control on the strength of those five providers rather than on a stated protocol.
Its two failures are password-protected codes and a destination malware check, neither of which Bitly publishes. What it does state is that it “filters bot traffic to the best of our ability”. Its SafeBase portal lists a SOC 2 report, a penetration test report and a SIG questionnaire under featured documents. The portal is the strongest thing Bitly offers a reviewer, and the Teams-only pricing is the weakest. The only priced plan with any administrative control beyond 2FA is Premium at $199 a month, and even Premium carries no user management row.
4. Scanova: five of seven, and the cheapest multi-factor login
Scanova passes five controls and puts more of them on low tiers than any vendor except QRCodeChimp. Its plan comparison ticks multi-factor authentication, password protection and QR code scheduling from Lite at $9 a month. Scheduling means a code can be set to expire or deactivate on a date. Bot traffic filtering is ticked on every plan including Basic at $5, and conditional redirection, which changes the destination by device or location, also starts on Lite.
Single sign-on, custom user permissions, user logs and MFA enforcement across an organisation are Enterprise features, and Enterprise has no published price. The Pro plan at $75 includes 5 users and a custom domain, so a small team gets separate logins, but the row for custom roles stays blank until Enterprise.
Scanova fails the audit report and the destination check. Its published security position is a single sentence on the pricing page, stating that it follows “ISO/IEC 27001:2022, GDPR, and SOC2”, with no certificate, scope, report or portal behind it. The page at scanova.io/security turns out to be a data processing agreement. One more detail belongs in a reviewer’s notes. Scanova’s own comparison page says Uniqode “lacks ISO certification”, while Uniqode’s trust portal shows an ISO 27001:2022 badge and certificate renewed on 2 February 2026. Treat vendor comparison pages as marketing, whichever vendor wrote them.
5. QRCodeChimp: four of seven, all of them on the free plan
QRCodeChimp passes four controls and wins one criterion outright, because the four it passes cost nothing. The HTML of its pricing table carries tick icons under Free, Starter, Pro and Ultima for four rows: 2-Factor Authentication (MFA), SSO (Single Sign-On), Data Encryption and Passcode Protection. Starter is $6.99 a month billed yearly, so the cheapest paid tier carries every security row the top tier does.
The caveat sits one row lower in the same table. A separate “SSO Integration” row, alongside “AD (Entra ID) Integration” and “White Labeling a Domain”, shows a dash under the first three columns and a tick only under Ultima at $34.99 a month billed yearly. So the free-tier SSO tick and the Ultima-only SSO integration describe two different things, and the pages read for this review never say which protocol either one uses. The enterprise page adds that QRCodeChimp “can provide activity logs for enterprise accounts to support audit trails” on request, and that a data processing agreement is in place.
Anomaly filtering, destination checks and a downloadable audit report are the three failures. The enterprise page claims SOC 2 Type II and encryption in transit and at rest, but no report, certificate or portal is published. The privacy policy says the DPA comes by emailing support. A buyer gets a great deal of control for $6.99 and no evidence at all.
6. QR TIGER: four of seven, with a concession on its own site
QR TIGER passes four controls, every one of them on existence rather than on a stated tier. The home page promises “Most advanced safety tools like 2FA and internal audits”, and the enterprise site offers “single sign-on and up to 99 sub-users”. An access management page names Admin, Editor and Viewer roles, and a password-protection page states its tier plainly: “only the advanced and premium users can integrate a password on their generated QR code.” Advanced is $16 a month billed annually and Premium is $37.
Anomaly filtering, destination checks and an audit report are the failures. QR TIGER says on several pages that it is certified to ISO/IEC 27001:2022, but no certificate, certificate number or issuing body appears on its site, and no trust portal exists. On the SOC 2 question the company answers for itself on a comparison page that is still live: “Uniqode is SOC-2 Type 2 compliant, while QR TIGER is not.” Two pages on the same site also give two uptime figures, 99.99 percent and 99.9 percent, and a reviewer notices that kind of inconsistency before anything else.
Where QRCodeChimp and Bitly are the better buy
If the whole requirement is two-factor login and a passcode on the code, QRCodeChimp meets it for $0, and Bitly meets the first half for $0. A sole trader printing a code on a shop window has no questionnaire to clear. Paying $9 a month to Uniqode for a trust portal nobody will ever ask about is money spent on the wrong problem.
Scanova deserves the same honesty on price, and its case is stronger than QRCodeChimp’s for a team of two. Multi-factor login, password protection and scheduled expiry for $9 a month, with bot filtering from $5, is a better deal than Uniqode’s $9 Essential plan for a buyer who needs those three things and nothing else. Uniqode holds password protection until Core at $49 and anomaly filtering until Plus at $99, and for a two-person business that is a real difference.
The moment the buyer is an IT department rather than an individual, the ranking reverts. None of the three cheaper vendors publishes a report a security team can read, and QRCodeChimp’s enterprise page offers activity logs only on request.
Which controls did each vendor pass?
Seven controls and six vendors, with the location of the evidence and the cheapest tier on which two-factor login is stated. Read the “Controls failed” column first, because the same control appears in five of the six rows. That single gap says more about the market than any of the passes do.
VendorPassed (of 7)Controls failedWhere the evidence livesCheapest tier stating 2FARead on
Uniqode7NonePublic trust portal, 22 documentsEssential, $921 Oct 2026
Flowcode6Destination checkSafeBase trust centreNot stated21 Oct 2026
Bitly5Password codes, destination checkSafeBase security centreFree, $021 Oct 2026
Scanova5Audit report, destination checkOne sentence on the pricing pageLite, $921 Oct 2026
QRCodeChimp4Anomaly filter, destination check, audit reportEnterprise page claims onlyFree, $021 Oct 2026
QR TIGER4Anomaly filter, destination check, audit reportClaims on several pagesNot stated21 Oct 2026
Two rows in that table need a footnote. Flowcode’s 2FA pass rests on a heading in its trust center with no tier named anywhere. QR TIGER’s 2FA pass rests on a home page sentence, since its pricing page does not list the feature on any plan.
What is the catch with Uniqode?
Three things on Uniqode’s own pages should go into the questionnaire as questions rather than answers, and all three are visible to anyone who reads the pricing page and the help center slowly enough.
First is the two-factor login row on the pricing table. The pricing table ticks it on all four plans, but a help article on setting up multi-factor authentication says the feature is available on the top plan only. One of those pages is out of date, and a reviewer cannot tell which from the outside.
Second is the price of a custom domain. The pricing table lists a custom domain as an add-on at $500 a year on Plus, and the FAQ on the same page says the add-on costs $2000 per domain per year. The SSO add-on carries only one figure, $500 a year, but the domain discrepancy is reason enough to get every add-on price in writing before signing.
Third is cost. Password-protected codes start at $49 a month, anomaly filtering at $99, and SAML SSO at $99 plus $500 a year, with annual billing only. The pricing FAQ answers the monthly question in six words: “We currently only offer annual subscription plans.” QRCodeChimp ticks its four security rows at $0, and that difference is real whatever the evidence gap behind it.
Questions security reviewers ask about QR code generators
What makes a QR code generator secure?
Seven published controls separate the serious vendors from the rest: two-factor login, single sign-on with SAML, role-based permissions, password-protected codes, filtering of suspicious scans, a malware check on destinations, and an audit report you can download. Of six vendors checked on 21 October 2026, Uniqode published all seven, Flowcode six, Bitly and Scanova five, QRCodeChimp and QR TIGER four.
Which QR code generator has two-factor authentication?
All six claim it, though not all name a tier. Uniqode ticks 2FA on every plan from $9, Bitly and QRCodeChimp tick it on their free plans, and Scanova includes multi-factor authentication from Lite at $9. QR TIGER names 2FA on its home page without a tier, and Flowcode lists multi-factor authentication in its trust center without one.
Does Flowcode have a trust center?
Yes, and it is the second strongest in this group. Flowcode’s trust center runs on SafeBase and shows badges for SOC 2 Type 2, HIPAA, GDPR, CCPA and TX-RAMP Level 2. Its document list includes two penetration test reports, a SOC 2 bridge letter, a HECVAT and a data processing agreement, and Uniqode’s portal lists 22 documents on a Conveyor-hosted page.
Can you password protect a QR code?
On four of the six, yes, and the price varies widely. Uniqode offers password-protected codes from Core at $49 a month with a six-character minimum, Scanova from Lite at $9, QRCodeChimp as passcode protection on every plan including free, and QR TIGER on Advanced at $16 and Premium at $37. Bitly and Flowcode do not publish a password feature for the code itself, though Flowcode can gate a landing page with a password field.
Which QR code generator detects suspicious scans?
Uniqode calls its filter ScanGuard and places it on Plus at $99 and above. Scanova ticks bot traffic filtering on every plan from $5, Bitly states that it filters bot traffic as far as it can, and Flowcode describes a toggle that removes bot traffic from reports. QRCodeChimp and QR TIGER do not publish an equivalent.
Is QR TIGER SOC 2 compliant?
By its own account, no. A QR TIGER comparison page states that Uniqode is SOC-2 Type 2 compliant while QR TIGER is not, and explains that the company prioritised ISO 27001 instead. The ISO claim appears on several QR TIGER pages, but no certificate or issuing body is published alongside it.
Why does the sixth control matter most?
Five of the six vendors fail the same control: a check on where a code sends people before the phone opens the page. Only Uniqode publishes one, and it does so on the $9 plan rather than on the expensive ones. For a code on a delivery label, a poster or a restaurant table, that control protects the person scanning rather than the person who made the code. That is why so few buyers ask for it and so few vendors build it.
Ask each vendor one question in writing. What happens, and who is told, when the destination behind a live code starts resolving to a site your own filters would block? The answer will either name a mechanism and a tier, or it will not.
