# SSH and Git QR codes — how they work

> An SSH QR code stores an ssh:// URI or a git clone URL as text. Scanning it gives you the string to paste — it does not and cannot open a connection. It is a convenience for moving a long URL from a screen or a sticker to another machine without typos.

Source: https://useqr.app/ssh-qr-code · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## The payloads

```
ssh://git@github.com:22/rajkaria/useqr.git
git@github.com:rajkaria/useqr.git
https://github.com/rajkaria/useqr.git
```

The first is a proper RFC 4253-style URI. The second is the SCP-like shorthand that Git
accepts but which is not a URI — some scanners will show it as plain text, which is
exactly what you want here.

## Nothing connects automatically

There is no operating system handler that opens an SSH session from a scanned code, and
that is a good thing. The code moves a string; you paste it. Any tool claiming to open a
shell from a scan should be treated with deep suspicion.

## Never put a private key in a QR code

It is technically possible — an ed25519 private key is small enough. It is a bad idea:

- The code is a plain-text copy of the key visible to anyone who photographs it.
- It ends up in screenshots, phone photo backups and cloud sync.
- It cannot be revoked by deleting the picture.

Public keys are fine and occasionally useful — a code on a device label carrying its
host key fingerprint lets an engineer verify the host without typing 64 hex characters.

## Genuinely good uses

- **Repository stickers** on hardware: scan to get the clone URL for the firmware.
- **Host fingerprints** on a rack label, for verifying a host key on first connect.
- **Onboarding docs**: a code next to a diagram that yields the exact clone command.
- **Conference talks**: a code on the last slide with the repo URL, which people can
  capture in one second instead of typing a URL from a photo later.

## Keep it short

`git@github.com:org/repo.git` is 30 bytes and produces a coarse, forgiving code that
scans from across a room. A full `ssh://` URI with a port and a long path can triple
that. On a sticker or a slide, shorter is better — and for a slide, the HTTPS clone URL
is usually the more useful one anyway, because it works without a key.

## FAQ

### Can a QR code open an SSH session?
No. There is no standard handler for that on any mainstream operating system. The code carries the string, which you paste — and that is the safe design.

### Can I put my SSH private key in a QR code?
Do not. It becomes a plain-text copy visible to anyone who photographs it, and it will end up in screenshots and photo backups where it cannot be revoked. Public keys and host fingerprints are fine.

### Which URL form should I use?
Use the shortest one that works for the audience. git@host:org/repo.git is compact and produces a coarse, easily scanned code; the HTTPS form is more useful on a slide because it needs no key.

### Is it useful for host key verification?
Yes — a fingerprint on a rack label saves typing 64 hex characters and removes the transcription errors that make people skip the check.

## Try it

- https://useqr.app/ssh
- https://useqr.app/text
- https://useqr.app/url