Security Code: How to Protect Your Digital Card So Only Those You Choose Can See It
With CardQR's security code, your digital card only opens with the link or QR that carry its 8-character code. What it protects and what it doesn't, why it is incompatible with appearing on Google, and when it makes sense to use it.
The security code turns your public digital card into a restricted-access card: it only opens with the link or QR that contain its code, an 8-character alphanumeric key generated by the system. Anyone who arrives without it only sees a notice that the card is protected — never your information. It's a Pro feature and lives in the Basic tab of the editor, inside "Security Settings".
This guide explains how to activate it, what it actually protects and doesn't, why it's incompatible with appearing in Google, and in what situations it makes sense to use it.
How to activate it
- Open your card editor and go to the Basic tab.
- Scroll down to "Security Settings" and enable the toggle. In the Free plan it appears locked — it's a Pro feature.
- Save. The system automatically generates a unique 8-character code associated with your card.
- Share your card only with whoever should see it. The QR and the link you copy from the panel already include the code: whoever receives them gets straight in, without typing anything. Anyone who arrives with just the address (card-qr.com/c/your-name), through NFC or with a link that doesn't include the code will see the notice that asks for it. That's why that QR is the key: don't put it where anyone can see it.
- Regenerate the code whenever you want to revoke access from someone who already had it. Your card's address doesn't change, but the QR and the link with the old code stop opening it: download the new QR and share it again.
What it protects and what it doesn't
It's important to be honest about what this feature does: it's an access control for your card's public page, not end-to-end encryption or an identity management system. The code prevents someone without it from seeing your card's content: anyone who opens the bare address, finds it by chance or holds a phone up to your NFC stays at the notice. It doesn't verify who the person is — anyone with the correct link or QR gets in, regardless of who they are — and it doesn't protect anything outside the card itself: if someone takes a screenshot or forwards the link to a third party, that person can also access it.
In other words: the security code controls access distribution, not the identity of who accesses it. It's the right tool for "only those I decide should see it", not for "verifying that it's really you".
The protection applies to any way of arriving without the code: the bare address, the NFC or a forwarded link without it ask for the code before showing anything. The QR and the link with the code, on the other hand, open directly: treat them as the key. And it only affects that specific card — if you have multiple cards in your account, activating the code on one doesn't change anything on the others.
The trade-off: no Google indexing
The security code and Google indexing are mutually exclusive by design, and this is verified directly in the code that decides which cards get indexed: a card with the code activated never gets indexed, regardless of whether you have "Appear in Google" enabled. It makes sense — a search engine can't index content that requires a code to view.
This aligns with how CardQR treats indexing in general: it's optional and comes disabled by default on any card, with or without a code. For a card to be indexed, you need to explicitly enable the toggle and also pass five minimum quality checks — photo, a description of at least 40 characters, company or position, at least one contact method, and at least one external link (website, social media, or a widget with a URL). Privacy and indexing are two deliberate axes of the product, not an oversight: you can have completely private cards, indexable cards, or both combinations at once across different cards.
This has an additional consequence worth knowing: by not being indexed, a card with a code also can't appear cited by AI assistants like ChatGPT or Perplexity, which rely on indexed content to answer questions about people and businesses. It's the same reason indexing matters on public cards — here, you're simply giving it up in exchange for privacy.
How to distribute the code in practice
- Private or invitation-only event: send the QR or the link with the code only in the confirmation email to attendees; the printed material for the general public doesn't carry it.
- Corporate template: if several employees use cards with the code activated, each person distributes the QR of their own card — there's no need for a shared code for the entire company.
- Specific client: a card with terms, rates, or links that aren't for the general public — the link with the code goes only to that client.
In all three cases the pattern is the same: the QR and the link with the code are the key, so they go through a channel where you know who receives them — a personal email, a direct message, an in-person conversation. Printing that QR on a poster or a public slide defeats the purpose of having it. If you also want something for the public, share the address without the code (whoever opens it will see the notice) or use another card without protection.
When to regenerate it
Regenerating the code doesn't change your card's address, but it does change the QR and the link with the code: the old ones stop opening it, so if you had them printed you'll have to reprint them. It makes sense to do it when:
- Someone who had access leaves the company or project.
- The event or promotion for which you distributed the code has ended.
- You suspect the code has been forwarded beyond who you authorized.
Scenario: code or no code?
| Scenario | Code? | Why |
|---|---|---|
| General networking card | No | The easier to share and index, the better — the code would prevent that |
| Company internal directory | Yes | Only those with the code should see it, not anyone with the link |
| Executive profile with direct contact info | Yes | Control over who can reach that contact |
| Private or invitation-only event | Yes | Only confirmed attendees should have access |
| Product card you want to rank in Google | No | The code blocks indexing completely |
Works with all other features
Activating the security code doesn't disable anything else: a protected card can still have Lead Capture active, or widgets for bookings, video, or PDF. The code restricts who can view the card; once inside, the rest of the features behave just like on any other card.
And if you need both things at once — a public part you want found in Google and a private part that only those you decide should see — the solution isn't to choose just one card, but to use two: you can have several cards in your account, each with its own URL, and apply the security code only to the one that needs it.
Frequently asked questions
Can I change the code later? Yes, regenerate it whenever you want from the same security settings section.
Does my QR change when I regenerate the code? Yes. Your card's address stays the same, but the QR carries the code inside: the old one stops opening the card and you have to download the new one from the panel.
Does it appear in Google search results? No, never, while the code is active — it's incompatible with indexing by design, regardless of whether you have "Appear in Google" enabled.
Can it give access to multiple people at once? Yes. The same link or QR works for everyone who receives it; there's no usage limit or different codes per person.
Does it work with NFC? Not on a protected card: the NFC tag opens the address without the code, so it shows the notice. For a protected card, share the QR or the link from the panel.