How QR code time clocks work, and which design to choose

How a QR code time clock works

A QR code time clock turns a scan into a punch. The code holds a short ID; the scanner reads it and sends it to the time clock's server, which saves a clock-in or clock-out with the time. Scan once to clock in, scan again to clock out.

The QR code itself stores no hours and no timestamps. It's a key. Everything that matters happens when the scan arrives: the system looks up who or what the code belongs to, checks whether that person is already on the clock, records the time, and adds the minutes to the week's timesheet. That's why one printed code can last for years, and why a lost or copied code can be switched off without reprinting everyone else's.

What changes from one product to the next is what the code identifies (a place, a moment or a person) and whose camera reads it. That gives three designs.

The three QR time clock designs

Most QR code time clocks use one of three designs. They differ in who needs a smartphone and how hard the clock is to cheat.

1. A posted code employees scan with their own phone

The business prints one QR code per site and tapes it by the door. Each employee opens an app or web page on their own phone and scans it, and the system records that this logged-in person was at this site at this time. It's the cheapest design to roll out, because there's nothing to hand out. But every worker needs a smartphone, data, battery and usually an app and a login.

2. A rotating code on a kiosk or in an app

A tablet by the entrance shows a QR code that changes every few seconds, and employees scan it with their phones. A variant flips the direction: each employee's app shows a personal code that keeps refreshing, and a kiosk scans it. Rotating codes fix the biggest flaw of a posted code, because an old photo stops working. They still need an app on every employee's phone.

3. A printed badge per person, scanned by a supervisor or a kiosk

Every employee gets a badge with their own QR code, and a supervisor's phone or a tablet at the door scans it. Because the code identifies the person, the scanning device can be anyone's. Employees need no phone, app or login, just the badge. Several time clocks offer printable per-employee codes for a kiosk; some, like TrackBadges, are built entirely around a supervisor scanning them.

How secure is a QR code time clock?

A QR code is easy to copy, so a QR time clock is only as secure as what surrounds the scan: whose camera it is, where it is, and whether a person is watching. These are the four weak points and how each design handles them.

• Photographed codes. An employee photographs a posted code on day one, then scans the photo from the parking lot or from home. The fixes are rotating codes, a GPS check at each scan, or not posting a code at all.
• Location spoofing. GPS checks run on the employee's own phone, and mock-location apps can fake a position. A geofence catches honest mistakes better than determined cheating, and it proves where a phone is, not who is holding it.
• Shared badges. A printed badge can be handed to a friend, and at an unattended kiosk one person can scan two badges in five seconds. The fixes are a photo with every punch (and someone who reviews them) or a person doing the scanning.
• Supervisor presence. When a supervisor scans each badge, the badge is only half the proof; the other half is the supervisor looking at the person in front of them. It's the strongest check that costs nothing, but it only works where a supervisor or lead is there at the start and end of the shift.

Whatever the design, the audit trail is your backstop: which device made each punch, where, and whether anyone edited it later. A run of punches seconds apart on one device, for people who never arrive together, is worth a question. For more, see how to stop buddy punching.

What a QR punch records

Every punch should record who, when, and whether it was a clock-in or a clock-out. A good system also records which device scanned, the site, optionally a GPS position, and the original punch whenever someone edits it.

These fields are the raw material for the records the Fair Labor Standards Act requires, including hours worked each workday and each workweek (29 CFR 516.2). The FLSA recordkeeping guide has the full list.

How to set up a QR code time clock

A badge-based QR time clock takes minutes to an afternoon to set up. These steps assume the printed-badge design; for a posted code, replace steps 3 and 4 with printing the site code and getting the app onto every employee's phone.

1. 1Pick the design. Choose by how your crew starts work: together with a lead (supervisor scans badges), through one door with nobody watching (kiosk), or alone at scattered sites (employee phones with GPS).
2. 2Add your people. Enter each employee's name, plus anything your payroll needs, like an employee ID.
3. 3Print the badges. Credit-card size (3.375 × 2.125 in) fits standard badge holders and lanyards; card stock in a plastic sleeve lasts for months. The free QR badge maker works for a test.
4. 4Set up the scanner. Pair the supervisor's phone, or mount a tablet by the entrance; see how to set up a time clock kiosk.
5. 5Set your pay rules. Choose the day your workweek starts, your overtime thresholds, any rounding, and an automatic clock-out for forgotten shifts.
6. 6Run a test day. Scan everyone in and out, and check the timesheet against a paper sign-in sheet for that day.
7. 7Tell the crew the rules. Explain who scans, what to do about a lost badge, and how to fix a missed punch.

What a QR code time clock costs

The software is usually priced per user per month, and hardware runs from nothing to a few hundred dollars a site. The bigger difference between designs is whose phones are involved.

The reimbursement row is easy to miss: California and Illinois require employers to reimburse employees for required use of a personal phone. See can employers require personal phones and the time clock cost guide.

Which design fits your crew

Pick by where people start work and whether they all carry smartphones.

• Everyone has a smartphone and works alone at scattered sites: a posted code or an employee app with GPS.
• One entrance with nobody stationed there: a kiosk with badges or rotating codes, plus photo capture if buddy punching is a worry.
• Crews that start together with a lead present: supervisor-scanned badges.
• Workers without smartphones, phones banned on the floor, or language barriers: printed badges, scanned by a supervisor or a kiosk.

How TrackBadges does it

TrackBadges uses the third design. Every employee gets a printed QR badge with their name and a backup PIN, and a supervisor's phone or a shared tablet scans it in the browser, so nobody installs anything. Each punch records the time, the scanner, its location and, if you turn it on, a GPS stamp. A lost badge is reissued in one click and the old one stops working. It's free for up to 3 people with every feature; Pro is $9 a month for the first 3 people plus $1.50 a month for each person after that. It's built for crews that start together; a solo worker with nobody to scan them is better served by a GPS app on their own phone. More on the QR code time clock page.