Scan a QR code on a product and a page loads. It feels like proof. It isn't, on its own. A 2D barcode answers "what does this code say?" It does not answer "is this physical object the one the record describes?" For a battery passport that gap is mostly harmless: the passport is public information and the law asks only that the code resolve to it. For a medicine or a high-value part, the gap is where counterfeits live.
Choosing a carrier for an EU battery passport specifically? Our guide NFC vs QR for EU battery passports covers Article 13(6), the QR the law requires, and where a chip fits. The rule itself is on the EU battery passport page.
A QR code is open, visible data
A QR or other 2D barcode is, by design, a printed pattern that anyone can read and anyone can reproduce. That openness is its virtue for data exchange and its fatal flaw for authentication. Three failure modes follow directly from it.
It is trivially cloneable
Photograph a genuine code, reprint it, and the copy is indistinguishable from the original. Both encode the same identifier; both resolve to the same verification page. A counterfeiter who buys one authentic unit can clone its code across a thousand fakes, and every one of them will "verify." The code is real. The product isn't.
It is vulnerable to redirect hijack
Because a QR code usually encodes a URL, a fake can point its code at a look-alike verification site that always returns "authentic." A consumer can't see the destination before scanning, and a convincing clone of a brand's verification page is cheap to build. The scan succeeds; the trust is misplaced.
It is tamper-blind
A printed code has no idea what happened to the product it's attached to. A bottle can be refilled, a box reopened and resealed, a pill blister substituted — and the original barcode rides along, still scanning clean. The code cannot report a tamper event because it has no state to change.
Where the 2D barcode is still required
None of this means abandon the barcode. Regulators mandate it as the data carrier — the GS1 2D barcode under DSCSA and EU FMD, and the data carrier behind the EU Digital Product Passport. It is the open, universal, line-of-sight way to carry a GTIN, lot, expiry, and a link to the record. For carrying regulated data, the 2D barcode is correct and required. The error is asking it to also be the proof of authenticity. That is a different job.
An NFC chip is cryptographic identity
A chip can do what a printed code cannot. A secure NFC chip holds a protected key that is never read out, and chips of this class are designed to prove possession of that key on demand rather than present a static number. You cannot photograph a secret you never see. Bonded so that an opening attempt severs or disables it, the chip also carries tamper state: break the seal and the identity is void. Aeroz tags are built on chips designed to be clone-resistant, and every Aeroz tag is issued and identified by Aeroz; what a given deployment verifies on each tap is set out in its statement of work, not assumed.
That is the difference in kind. A barcode is data anyone can copy. A chip is an identity bonded to one object. One is a label; the other is a name tag that is hard to forge.
| Attack | 2D barcode alone | NFC / chip | The pair |
|---|---|---|---|
| Photograph & reprint | Cloned | Resists | Fails counterfeit |
| Redirect hijack | Spoofable | Identity checked server-side | Both checked |
| Tamper / refill | Invisible | Seal voids | Seal voids |
| Regulated data carrier | GTIN, lot, expiry | Identity only | Both, bound |
| Offline durability | Smudge / tear | Sealed IC | Redundant |
The bound pair
The answer is not to choose. It is to bind the two so each covers the other's weakness. The 2D barcode carries the regulated data the law requires and the open link anyone can scan. The chip carries the cryptographic identity the barcode can't. Tie a unit's chip identity to its serialized barcode and each attack has to beat both: a copied barcode does not carry the chip; a lifted chip voids its seal; a spoofed page does not hold the record the chip identity points to.
This is the same conclusion the regulated supply chain keeps reaching — under DSCSA, where a cloned barcode passes verification and only a bonded identity catches it, as we cover in the DSCSA countdown, and under the EU DPP, where a passport is only as trustworthy as its link to the item.
When to use which
For the EU battery passport, the answer is the QR code. Article 13(6) of Regulation (EU) 2023/1542 requires a QR code on the battery that resolves to the passport from 18 February 2027; nothing in the regulation requires a chip. The work is the 49 mandatory data points behind the code, not the carrier (see the deadline page). Add a chip to a pack only when you want a durable, identified tag for service, warranty or second-life handoffs, where a printed label will not survive.
Use the 2D barcode wherever you need open, universal, regulated data exchange and broad reach — it is required, and it is the right tool for that. Add the chip wherever the cost of a convincing counterfeit is high: medicines, high-value goods, safety-critical components, anything where "the code verified" is not good enough. For most regulated products the honest answer is both — the barcode for the data, the chip for the proof.
A barcode tells you what a product claims to be. A chip tells you which object you are holding. The durable approach binds them so neither can be borrowed. That pairing — on one platform that runs on its own and connects to the systems you already run — is the basis of the Aeroz verification layer.