What's Inside the QR Code on Your Conference Badge
There are two ways to build the QR code on a conference badge, and they have opposite privacy properties. One encodes your name, employer, job title and email as plain text that any phone can read from across a room. The other encodes a meaningless reference that is useless without the organiser’s database. Nothing on the badge tells you which one you are wearing — but ten seconds with any scanner will.
You collect a lanyard at the registration desk, and there is a QR code under your name. For the next three days you will wear it at chest height in a hall full of people with phones. Exhibitors will scan it in exchange for a tote bag. It will appear in other people's photographs.
So it is a fair question what it actually says. And the answer is genuinely one of two things, with opposite consequences, decided by the organiser months ago and written nowhere on the badge.
The Short Answer
- A contact-format badge encodes your details directly — typically name, organisation, job title, email and phone, as plain text. Any phone camera reads it. No database, no app, no permission.
- An ID-token badge encodes a meaningless reference such as
A7K42QX9or a URL ending in one. On its own it reveals nothing; it only becomes your record inside the organiser's system. - Nothing visible distinguishes them. Both are square black-and-white symbols of roughly similar size.
- Ten seconds settles it. Scan your own badge. If you see your name, the badge carries your details. If you see a short string or a link, it carries a token.
- If it is a contact-format badge, treat the information on it as public for the duration of the event, because in practice it is.
Two Designs, and Why Both Exist
The split is not carelessness on anyone's part. The two designs solve different problems and the trade-off is real.
The contact-format badge
Here the code carries the data itself, in one of the two conventions that phones recognise natively for contact information.
vCard is the fuller of the two — a line-based format specified by the IETF in RFC 6350 for version 4.0, with versions 2.1 and 3.0 still widely emitted in the wild. It opens with BEGIN:VCARD, declares a VERSION, and then lists fields one per line:
BEGIN:VCARD
VERSION:3.0
N:Okonkwo;Adaeze
FN:Adaeze Okonkwo
ORG:Meridian Logistics
TITLE:Head of Operations
EMAIL:a.okonkwo@example.com
TEL:+44 20 7946 0123
END:VCARDMeCard does the same job in roughly half the characters, which matters a great deal on a badge. It is a single semicolon-separated line, originated by NTT DoCoMo, and has no formal standard — the ZXing project's Barcode Contents document is the de facto reference. The same person as a MeCard:
MECARD:N:Okonkwo,Adaeze;ORG:Meridian Logistics;EMAIL:a.okonkwo@example.com;TEL:+442079460123;;
Note two details that cause most of the field's bugs. The name is written Last,First, so a badge system that forgets the comma lands the whole name in the surname field. And the payload terminates with a double semicolon — ;; — without which some parsers silently drop the final field. If your badge's code puts your email in the last position and the terminator is missing, your email is the field that disappears.
Both formats reserve five characters that must be escaped with a backslash: \ ; , : and ". An employer called Smith, Jones & Co. contains one of them, which is why a surprising number of badges truncate company names at the comma. Our guide to special characters in QR codes covers the escaping rules in full.
The ID-token badge
Here the code carries a reference and nothing else. It might be a bare string, or a URL with the reference on the end:
A7K42QX9Scan it with an ordinary phone and you get those eight characters, which mean nothing. They mean something only to the system that issued them, and that system decides — based on the event's rules and on what you consented to — whether a given exhibitor gets your name attached to that scan.
This is the design that privacy guidance consistently recommends, and for a reason that is easy to state: a photograph of a token badge is worth nothing, while a photograph of a contact-format badge is worth everything on it. It is also, not coincidentally, the design that makes lead retrieval a product the organiser can sell, because it forces exhibitors through the organiser's system to get anything usable.
How to Tell Which One You Are Wearing
Scan your own badge with any scanner and read the raw text. You do not need the event's app — in fact using an ordinary scanner is the point, because it shows you what an ordinary scanner can see.
If you want the fields named rather than a wall of text, paste the payload into our QR code payload decoder. It recognises both contact conventions, labels each field, and flags the common faults — a missing ;; terminator, a missing VERSION line, an unescaped semicolon eating the rest of a value. It runs entirely in your browser.
| What the scan shows | What it is | Who can read you |
|---|---|---|
BEGIN:VCARD then your details | vCard | Anyone with a phone |
MECARD: then your details | MeCard | Anyone with a phone |
| A short string of letters and digits | Opaque token | Only the organiser's system |
| A link ending in a code | Token in a URL | Only the organiser's system |
| Your email or phone and nothing else | Single-field contact | Anyone with a phone |
One wrinkle: badges are not always QR codes. Plenty of conference systems print a Code 128 or Code 39 linear barcode, and some use Aztec or PDF417, usually because the check-in hardware was chosen before the badge design was. Linear symbols hold far less, so they are almost always tokens by necessity rather than by policy. If you are not sure what you are looking at, the barcode format identifier will name the symbology.
What a Contact-Format Badge Actually Exposes
The uncomfortable property of a contact-format badge is that it has no access control, because there is nothing to control. The data is written on you. Three consequences follow, and the third is the one people miss.
- Any phone reads it, not only exhibitors who paid. The stock camera app on current iPhones and Androids handles both contact conventions natively and will offer to save the contact. No special app is involved.
- A photograph is as good as a scan. A QR code is a way of writing text down so a camera can read it; a photograph of written-down text reproduces the text. Badge-system vendors who recommend the token design say this part plainly — a photo of a badge is enough to extract the data. A reasonably sharp photo from a few metres away, cropped, decodes fine.
- Badges are worn at chest height, facing out, for days. This is the part that gets underestimated. You cannot practically audit who read your badge, because reading it leaves no trace. There is no scan log for a stranger with a camera.
None of which makes a contact-format badge a scandal. For most conference attendees the information on it — name, employer, job title — is on their public professional profile anyway, which is precisely why organisers find the design reasonable. The point is that it is a decision with a consequence, and you are entitled to know which decision was made about you. If the answer bothers you, the remedies are ordinary: cover the code when you are not using it, turn the badge inward away from the hall, or ask the registration desk what the code contains. On that last one, a desk that cannot answer is itself informative.
For Exhibitors: Can You Scan Badges Without Renting the Organiser's Scanner?
This is the most-searched question in the area and the honest answer is it depends entirely on which design the organiser chose, and you cannot find out until you are on site.
Search results on this topic are dominated by lead-retrieval vendors, which makes it hard to get a straight answer, so here is one:
- Contact-format badges: yes. Any scanner captures the contact record. You do not need the organiser's product, and you own what you capture.
- Token badges: no. You will capture
A7K42QX9and have no way to resolve it. Only the issuing system can, which is what you are paying for when you rent lead retrieval. - Either way, the scan does not create a lawful basis to market to someone. Capturing a contact record is technically trivial and legally no different from any other collection of personal data. In the EU and UK, the General Data Protection Regulation applies to it the same as to a web form.
Practical advice, which the vendor guidance and our own experience of door scanning agree on: test one badge before the hall opens. Ask the registration desk for a sample or a spare, scan it, and look at what comes back. That single check tells you whether your plan for the next three days works at all, and it is far cheaper than finding out at 09:30 on day one.
If the badges turn out to be tokens and you have not bought lead retrieval, the fallback that actually works is capturing codes with timestamps and reconciling later — the same mechanic as a door check. Our guide on QR codes for events covers the organiser-side version of this, and if you are exchanging details rather than harvesting them, a vCard QR code on your own phone screen or booth card lets the other person scan you, which neatly sidesteps the whole problem.
For Organisers: Which Design Should You Choose?
Default to the token, and treat contact-format as the exception you justify. Three reasons, in descending order of how much they should weigh.
Data minimisation is the rule you are measured against. Under GDPR Article 5(1)(c), personal data must be adequate, relevant and limited to what is necessary for the purpose. A badge needs to identify an attendee to your own systems; it does not need to broadcast their employer and email to the room. Putting the data in the symbol is a choice you would have to defend, and "it was more convenient for exhibitors" is a weak defence. Treat the badge code as personal data when it resolves to a person — which it does.
Consent stops meaning anything once the data is in the symbol. If your attendees consent to sponsors receiving their details, a token badge lets you honour that: the scan happens, and your system releases the record only where consent exists. A contact-format badge releases it to everyone, consenting or not, including people who are not sponsors at all. You cannot offer a meaningful choice about data that is already printed on the lanyard.
Tokens are smaller, and smaller scans better. This is the mundane reason and it has saved more conferences than the other two. A full vCard runs 150–250 characters; an eight-character token runs eight. More data means a higher QR version with more and smaller modules, and smaller modules need a physically larger symbol to scan from the same distance. On a badge, where you have perhaps 30 mm to work with, that difference decides whether the door queue moves. Our QR code capacity calculator shows how version and module count climb with payload length.
Make the token unguessable rather than sequential. Attendee 00412 invites someone to try 00413; a random reference does not. The same reasoning applies to event tickets, and we go into it further in whether someone can screenshot your ticket QR code. If you want to see the mechanic working, our event check-in QR generator issues one random code per guest from a pasted list and admits each exactly once, with the list never leaving your browser.
Why Badge Codes Fail to Scan
Badges are a uniquely hostile place to put a QR code, and the failures are predictable enough to design out.
| Cause | Why it bites on a badge | Fix |
|---|---|---|
| Too much data, too little space | A full vCard in a 25 mm square gives modules well under 0.3 mm | Shorten the payload before enlarging the symbol |
| Lamination and glossy pouches | Specular glare from hall lighting wipes out whole rows | Matte pouches; avoid overhead spotlights at the door |
| Curved badge holders | A lanyard pouch bows; the symbol stops being planar | Rigid holders, or place the code away from the fold |
| Coloured or dark card stock | Brand colours cut the light-to-dark contrast ratio | Keep the symbol dark-on-white — check it first |
| No quiet zone | Designers butt the code against a border or the name block | Leave four modules of clear margin on all sides |
| Phone-screen badges | Auto-brightness and screen glare on the scanned device | Full brightness; no dark mode on the code |
Two of these are worth checking with a tool rather than an opinion. The QR code print size calculator gives you the minimum physical size for a given payload and scan distance — which is how you discover that the vCard will not fit before you print 1,200 badges. The QR code colour contrast checker tells you whether a brand-coloured badge still has enough contrast to read. And if the problem is scanning codes off attendees' phone screens at the door, why a barcode will not scan from a phone screen covers that specific failure.
Frequently Asked Questions
What information is in a conference badge QR code?
One of two things. Either your contact details in plain text — usually name, organisation, job title, email and phone, written as a vCard or a MeCard — or an opaque reference such as A7K42QX9 that means nothing outside the organiser's system. Nothing on the badge indicates which, so the only way to know is to scan it and read the raw text.
Can anyone scan my conference badge and get my details?
If the badge uses a contact format, yes — any phone camera reads it, with no app and no permission, and a photograph of the badge works as well as a scan. If it uses a token, no: a stranger gets a meaningless string. Since you cannot tell by looking, scan your own badge once and you will know which situation you are in for the rest of the event.
How do I check what my badge QR code says?
Scan it with any scanner and look at the raw text rather than letting the phone act on it. To have the fields named and the common faults flagged, paste the result into our QR code payload decoder, which handles both vCard and MeCard and runs entirely in your browser.
Can exhibitors scan badges without the official lead retrieval app?
Only if the badge carries a contact format. Then any scanner captures the record. If the badge carries a token, an ordinary scanner captures a string the exhibitor cannot resolve, and the organiser's lead-retrieval product is the only thing that can. You cannot find this out in advance of the event, so test a sample badge before the hall opens.
Is a badge QR code personal data under GDPR?
Treat it as personal data in both designs. A contact-format code plainly contains it. A token is an identifier that resolves to an identified person, which also falls within the regulation's definition, in the same way a customer number does. The practical difference is not whether the rules apply but how much is exposed to people outside your control — and that is what Article 5(1)(c) data minimisation speaks to. For a specific event in a specific jurisdiction, take advice rather than relying on a guide.
Should the badge code contain the attendee's name?
Generally no. Encode a random reference and keep the name in a list you hold. Your check-in screen can still display the name from that list, so staff at the door see exactly what they need, while the symbol itself never carries it. That gets you the convenience without broadcasting the data to the hall.
Why does my badge scan slowly or not at all?
Most often because too much data was put into too small a square, giving modules too fine for a phone camera at arm's length. After that: glare from a laminated pouch, a curved holder that stops the symbol being flat, insufficient contrast on coloured card stock, or a missing quiet zone around the symbol. Shortening the payload fixes more badge failures than enlarging the code does.
vCard or MeCard for a badge, if I am using a contact format at all?
MeCard, on size grounds. It encodes the same name, organisation, email and phone in roughly half the characters, which keeps the QR version lower and the modules larger — and on a badge, module size is the whole game. vCard carries more field types and is the better choice where space is not constrained, such as a full-page handout or an email signature.
Does a badge QR code track which sessions I attend?
The code itself does not record anything; it is a static symbol that cannot store a history. But session scanning is a common and deliberate use of it — staff scan badges at room doors, and the record accumulates in the organiser's system, not on your badge. If you want to know what is kept and for how long, that is a question for the event's privacy notice.
Can I reuse my badge after the event?
The symbol will still decode — a QR code does not expire. Whether it still works depends on the system behind it: a token whose record has been closed resolves to nothing, while a contact-format badge keeps handing out your details indefinitely, which is a good reason not to leave an old one in a conference bag.
The Short Version
Two designs, opposite privacy properties, and no way to tell them apart by looking. Scan your own badge on day one and read the raw text: your name means the data is on you and should be treated as public; a short meaningless string means it is not. If you are running the event, default to the meaningless string — it minimises what you expose, it keeps attendee consent meaningful, and it scans better in a queue.