A profile QR is a link to something public or voluntarily shared, such as a contact card or account page. A Discord login QR is a session-approval step: it asks a signed-in phone account to authorize a desktop or browser session. If a login screen appears and you did not start a login, cancel it at the approval screen and do not approve it. Never assume every QR is just a public profile address.
Find public social profile clues with our TraceSeek app.
A profile code versus an authorization request
A shared profile code is usually a convenience wrapper around a public address. On some platforms a username can be shared as exact text, as a QR code, or as a unique URL that does not itself display the username. A profile page and its code can also be shared through the same link. These codes lead to public-facing material rather than to an access grant. A login QR is different: it is part of an authentication flow, where approving the code signs a session in. The decision that matters is what the destination asks you to do: read something, or grant access. [Signal Support: username links, message requests and changes]
- Before opening a scanned code, check whether your scanner shows a destination preview.
- If the preview or landing page asks you to approve a session, treat it as a login action, not a profile visit.
| observation | limit | next step |
|---|---|---|
| The code resolves to a public profile or contact address | The destination may require a sign-in you already have, and availability varies by platform | Read the page as public information and do not enter credentials to view a profile |
| The code was shared voluntarily by its owner | Sharing a code does not prove the owner's identity, intent, or that the account is active now | Keep the observation separate and verify through an independent channel you already trust |
| The code no longer resolves after a username change | Old username links and codes may stop starting a new chat, and changes do not notify existing contacts | Ask for a current link from the owner rather than guessing a replacement |
How a Discord login screen is meant to work
The Discord QR login is a session-approval flow. A code shown on a desktop or browser sign-in screen can authorize that session only after the signed-in mobile account approves it. The platform's own guidance says never to approve a login code that somebody else sent you, because approval is what grants the access. If you scan one by accident, you can still back out at the approval screen. [Discord Support: QR code login and approval]
- If an approval prompt appears and you did not begin a login, choose the cancel or deny option.
- If you already approved an unwanted login, change the account password so existing device sessions are signed out.
- Do not forward a login code to anyone who asks for it, even if they say it is for a profile or a server.
Separate what you see from what it proves
A working code, a matched avatar, or a familiar name is not proof of who is behind an account. Avatars can come from an uploaded picture, a connected X account, or a Gravatar image, and a repeated avatar need not be separately uploaded on every site. Treat a repeated image as a visual observation until something independent confirms the account. [Letterboxd Help: account sharing, avatars and diary entries]
Decide before you act
The safest first pass is to classify the code by what happens at the destination. A page that displays a profile, an invitation-style address, or contact details is a sharing artifact. A page that asks a signed-in account to approve a session is an authorization request, and it should only proceed if you personally started that login. If you cannot preview the destination, or the documented control is unavailable on your device, record that as unavailable and stop at that boundary rather than experimenting on a live account. [Discord Support: QR code login and approval]
- Sort the code as profile/contact or session approval before tapping anything.
- Cancel unexpected authorization first; investigate the public page afterward.
- If you cannot check the destination, stop and ask the sender for a plain current link.
A couple more questions
I scanned a code and an approval screen appeared. What should I do first?
Deny or cancel the approval without confirming, since approving it is what would authorize the session. Do not approve a login code someone else sent you. If you already approved one you did not want, change the account password to sign devices out.
Does a shared profile QR prove the sender is the person in the photo?
No. A code shows only that data was encoded and shared. Matching avatars can come from the same uploaded or connected image on different sites, so a familiar picture is a visual observation, not confirmation of identity.
A username code stopped working. Did the person block me?
The cited guidance does not address blocking. It does say username changes can mean old username links no longer start a new chat, and that changes do not notify existing contacts. Ask the owner for a current link rather than assuming intent.
Sources & editorial notes
Official references checked on October 23, 2026. Checklists, comparison tables and example wording are DateClues editorial tools, not official tests or validated risk scores.
- Signal Support: username links, message requests and changes ↗
- Discord Support: QR code login and approval ↗
- Letterboxd Help: account sharing, avatars and diary entries ↗
General information. No guide or tool can certify a person’s identity, intentions or safety. Read our editorial standards.