Password-protect a QR code

In the wizard's content step, expand "Password protection" and enter a password. We hash it with bcrypt before storing — we don't see the plaintext.

When someone scans the QR, they land on a password-entry page instead of the destination. They enter the password, and on success, we set a signed cookie and forward them to the real destination. The cookie lasts 30 days so they don't have to re-enter on repeat scans.

Use this for soft-restricted content: VIP menus, employee-only resources, internal links printed on stickers. It's not high-security — anyone with the password can share it — but it does keep casual scanners out.

You can change or remove the password any time from the QR's edit panel. Removing the password reverts the QR to a normal redirect.