SSH and Git QR codes — how they work

An SSH QR code stores an ssh:// URI or a git clone URL as text. Scanning it gives you the string to paste — it does not and cannot open a connection. It is a convenience for moving a long URL from a screen or a sticker to another machine without typos.

The payloads

ssh://git@github.com:22/rajkaria/useqr.git
git@github.com:rajkaria/useqr.git
https://github.com/rajkaria/useqr.git

The first is a proper RFC 4253-style URI. The second is the SCP-like shorthand that Git accepts but which is not a URI — some scanners will show it as plain text, which is exactly what you want here.

Nothing connects automatically

There is no operating system handler that opens an SSH session from a scanned code, and that is a good thing. The code moves a string; you paste it. Any tool claiming to open a shell from a scan should be treated with deep suspicion.

Never put a private key in a QR code

It is technically possible — an ed25519 private key is small enough. It is a bad idea:

The code is a plain-text copy of the key visible to anyone who photographs it.
It ends up in screenshots, phone photo backups and cloud sync.
It cannot be revoked by deleting the picture.

Public keys are fine and occasionally useful — a code on a device label carrying its host key fingerprint lets an engineer verify the host without typing 64 hex characters.

Genuinely good uses

Repository stickers on hardware: scan to get the clone URL for the firmware.
Host fingerprints on a rack label, for verifying a host key on first connect.
Onboarding docs: a code next to a diagram that yields the exact clone command.
Conference talks: a code on the last slide with the repo URL, which people can capture in one second instead of typing a URL from a photo later.

Keep it short

git@github.com:org/repo.git is 30 bytes and produces a coarse, forgiving code that scans from across a room. A full ssh:// URI with a port and a long path can triple that. On a sticker or a slide, shorter is better — and for a slide, the HTTPS clone URL is usually the more useful one anyway, because it works without a key.

FAQ

Can a QR code open an SSH session?

No. There is no standard handler for that on any mainstream operating system. The code carries the string, which you paste — and that is the safe design.

Can I put my SSH private key in a QR code?

Do not. It becomes a plain-text copy visible to anyone who photographs it, and it will end up in screenshots and photo backups where it cannot be revoked. Public keys and host fingerprints are fine.

Which URL form should I use?

Use the shortest one that works for the audience. git@host:org/repo.git is compact and produces a coarse, easily scanned code; the HTTPS form is more useful on a slide because it needs no key.

Is it useful for host key verification?

Yes — a fingerprint on a rack label saves typing 64 hex characters and removes the transcription errors that make people skip the check.