The most common failure mode at large events is not a logistical problem — it is a connectivity problem. Check-in systems go down because the venue Wi-Fi cannot handle three hundred simultaneous connections, or because the mobile signal is saturated by an audience all pulling out their phones at once. When that happens, a check-in system that requires a live server connection to validate a ticket simply stops working. Offline QR verification is the architectural solution to this problem — and it also turns out to be a significantly more robust fraud-prevention mechanism than standard approaches.
Why Does Internet Connectivity Matter at Events?
Standard QR check-in systems work by encoding a ticket identifier in the QR code, then sending that identifier to a server at scan time to confirm the ticket is valid and has not already been scanned. This requires a live internet connection for every single scan. At scale — four hundred people arriving in a thirty-minute window — that is four hundred simultaneous API calls from multiple scanning devices in a venue that is simultaneously saturating its cellular bandwidth. Under these conditions, standard systems slow down, time out, or fail entirely.
How Do Standard QR Ticket Systems Work?
In a standard system, each QR code contains a ticket ID (typically a UUID or similar identifier). When scanned, the check-in app sends this ID to a server, which looks it up in a database, confirms validity, marks it as scanned, and returns a pass or fail response. The QR code itself contains no verifiable information — it is just a reference. This means that without server connectivity, the scanner has no way to determine whether a ticket is valid. The system is entirely dependent on the network connection.
What Is Offline QR Verification?
Offline QR verification is an architecture in which the validity of a ticket can be mathematically confirmed without any server communication. This is achieved by embedding a cryptographic signature inside the QR code at the point of ticket issuance. The scanning device can verify the mathematical validity of the signature locally — confirming that the ticket is genuine — without needing to reach a server. Duplicate scan detection is handled through local state on the scanning device, synced to the server when connectivity is available.
How Does Cryptographic Offline QR Verification Work?
- 01.At ticket issuance, the server generates a payload containing the ticket ID, event ID, attendee identifier, and a timestamp.
- 02.This payload is signed using HMAC-SHA256 — a keyed hashing algorithm — with a secret key known only to the server. The result is a short cryptographic signature.
- 03.The payload and signature are encoded together into the QR code. The QR now contains the data and the proof of its authenticity.
- 04.At check-in, the scanning device decodes the QR, extracts the payload, and recomputes the HMAC-SHA256 signature using its own copy of the key (pre-loaded at session start).
- 05.If the recomputed signature matches the one embedded in the QR, the ticket is cryptographically valid — no network call required.
- 06.The device records the scan in local state, preventing duplicates. Scan records sync to the server when connectivity is restored.
What Is HMAC-SHA256 and Why Does It Matter for Event Tickets?
HMAC (Hash-based Message Authentication Code) is a cryptographic technique that uses a secret key to produce a unique, verifiable fingerprint for any piece of data. SHA-256 is the underlying hash function — one of the most widely used and trusted in security applications. The critical property for ticket verification is that HMAC-SHA256 signatures cannot be forged without knowing the secret key. An attacker who copies a valid QR code gets a copy of that specific ticket — but cannot generate new valid signatures for new tickets. Combined with duplicate scan detection, this makes the system highly resistant to both forgery and screenshot fraud.
What Are the Practical Benefits for Event Organisers?
- •Check-in works regardless of venue connectivity — no slowdowns, no timeouts, no queue building at the door.
- •Ticket forgery is computationally infeasible — signatures cannot be manufactured without the server key.
- •Screenshot sharing is caught — duplicate scan detection flags the second scan of any QR, with local state preventing bypasses.
- •Faster entry — on-device verification is instantaneous; server round-trips introduce latency at scale.
- •Audit trail — all scans sync to the server dashboard once connectivity is available, giving organisers a complete entry log.
Tikkit X is built on offline-first cryptographic QR verification. If you are running events in Pakistan and want a check-in system that works reliably regardless of venue connectivity, get in touch with Two Bit Digital.
Get In Touch →