QR codes vs. PUF-based labels for anti-counterfeiting
By TrustMarx Team · Published on June 9, 2026
A QR code alone cannot prove a product is genuine, because a QR code is data and data can be copied perfectly; a PUF-based label adds physical randomness that no copying process can reproduce. That single sentence is the whole comparison — the table below unpacks it.
Side-by-side comparison
| Capability | QR / barcode alone | PUF + cryptographic label | | --- | --- | --- | | Carries machine-readable data | Yes | Yes | | Survives photocopying | No — a copy scans identically | Yes — the physical structure cannot be copied | | Identity can be fabricated | Yes — anyone can print a plausible code | No — signatures require a key locked in an HSM | | Detects cloned labels in the field | No | Yes — scan analytics flag repetition and geography anomalies | | Consumer result | Opens a URL; proves nothing | Authoritative four-state verdict in seconds | | Unit cost | Very low | Low — standard printing plus enrollment |
Where QR codes still help
QR codes are excellent carriers: they are cheap, universally scannable and hold enough data for a signed token. The problem is not the QR code — it is treating the code as the proof. In a PUF-based system the code carries the cryptographic identity, while the physical micro-structure around or beneath it provides the unclonable evidence. The two together are strictly stronger than either alone.
The failure mode of QR-only schemes
Serialized QR schemes ("scan to check if this serial exists") fail in a predictable way: counterfeiters copy one valid code onto thousands of fakes. Every fake then passes the check, because the serial is real. Some schemes respond by counting scans per serial — but that punishes legitimate customers of the genuine item and still cannot say which scan was the original. Only a physical-match layer can distinguish the enrolled label from its copies at the moment of scanning.
Summary
- QR = data carrier; PUF = unclonable physical evidence; cryptography = unforgeable identity.
- QR-only verification collapses under label copying — the dominant real-world attack.
- Combined PUF + cryptography + scan-intelligence systems, such as TrustMarx, keep the QR code's convenience while removing its central weakness.