XERIA can add a small, low-visibility QR trace element to generated PDF files. The QR stores machine-readable document and recipient metadata so an issued copy can be examined later without placing a large visible code across the page.
What You Will Learn
This tutorial explains how to:
- Prepare recipient data for QR traceability
- Distinguish a hidden QR element from a visible trace code
- Enable **Add hidden QR code** in XERIA
- Combine QR traceability with personalized watermarks
- Generate QR-enabled PDFs
- Scan and verify the QR payload
- Check QR placement across different page sizes
- Protect personal data contained in the QR
- Use QR evidence together with XERIA’s TRACE Analyzer
- Diagnose common QR scanning and mapping problems
The workflow is most useful in personalized batch production, where each generated PDF is associated with a specific recipient record.
For the wider concept, see [What Is Document Traceability?](/resources/articles/what-is-document-traceability/).
What XERIA’s Hidden QR Contains
The current XERIA QR payload is a plain-text, multi-line record.
It can contain:
- XERIA identification
- Document name
- Recipient name
- Recipient email address
- Company or recipient ID
- UTC production timestamp
- Local production timestamp
A representative decoded payload may look like this:
XERIA — DOC: Confidential-Report — NAME: Elena Rossi — EMAIL: elena@example.com — CID: CUSTOMER-0042 — UTC: 2026-08-07 10:42:15 — LOCAL: 2026-08-07 13:42:15
The precise values come from the document and recipient record used during generation.
XERIA does not place the recipient’s open password or owner password inside the QR payload.
Hidden QR vs Visible Trace Code
| Control | Typical Appearance | Main Purpose | How It Is Reviewed |
|---|---|---|---|
| Hidden QR element | Small, subtle QR near the page corner | Carry machine-readable document and recipient metadata | Scan the QR with a compatible reader |
| Visible trace code | Human-readable code in a watermark, filename or document area | Identify the issued copy with a short reference | Search or decode the code, including through TRACE Analyzer |
| Personalized watermark | Recipient name, email, ID or notice displayed across the document | Deterrence and recipient accountability | Read the visible watermark |
| Processing record | Database or log entry connecting recipient, document and output | Operational evidence and reconciliation | Review XERIA records and logs |
These controls are strongest when used together.
A visible watermark makes recipient identification difficult to overlook. A trace code provides a compact reference. A hidden QR carries machine-readable metadata. Processing records preserve the source-to-recipient relationship.
For watermarking strategy, see [Personalized PDF Watermarks](/resources/articles/personalized-pdf-watermarks/).
How XERIA Places the Hidden QR
XERIA adds the QR to each page of the generated output PDF.
The current placement is:
- Lower-right corner
- Approximately 10 millimetres square
- Approximately 3 millimetres from the right and bottom edges
- Semi-transparent dark modules
- Transparent background
- No large surrounding white box
The subtle appearance reduces visual disruption, but it also means scan reliability must be tested.
Dark page backgrounds, graphics near the lower-right corner, very small printed output, aggressive image compression and low-quality scanning can make the QR harder to read.
The placement is generated automatically. It is not controlled by the main text-watermark position, angle, opacity or tiled-layout settings.
Before You Start
Prepare:
- One approved source PDF
- A recipient list in XERIA
- Accurate recipient names
- Accurate email addresses
- Company or recipient IDs where used
- A visible watermark or trace-code policy
- An output folder
- A representative test group
- A phone or QR reader for testing
- A process for protecting decoded personal data
Use a non-confidential test document first.
The QR can contain personal data, so enable it only when the information is necessary for the traceability purpose and permitted by organizational policy.
Step 1: Prepare the Recipient List
Open **Batch Processing** and select the correct recipient list.
You can:
- Use an existing XERIA recipient list
- Create a new list
- Add recipients manually
- Import an existing Excel list
- Edit records already stored in XERIA
For each selected recipient, review:
- Full name
- Email address
- Company or recipient ID
- Recipient code
- Visible trace value
- Output filename information
The QR payload uses recipient metadata available during generation. Incorrect recipient data creates incorrect trace evidence.
Do not proceed if rows are shifted, IDs are duplicated or email addresses belong to the wrong people.
Step 2: Choose the Source PDF
Select the approved PDF that will be personalized.
Verify:
- The correct document version is selected
- All required pages are present
- Page orientation is correct
- Lower-right page content has been reviewed
- The PDF is not damaged
- The file is not being edited by another application
- The output location is separate from the source
The source filename can contribute to the document name stored in the QR payload.
Use a meaningful source filename instead of a temporary numeric or random name.
Step 3: Configure Personalized Production
Use the Watermark and Batch Processing areas together.
A typical workflow is:
- Select the source PDF.
- Choose **List-Based Batch Generation**.
- Build the personalized watermark text.
- Configure the watermark appearance.
- Save the watermark settings.
- Return to **Batch Processing**.
- Review the selected recipients.
The complete recipient-based production workflow is explained in [Create Personalized PDFs in XERIA](/resources/articles/create-personalized-pdfs-in-xeria/).
The hidden QR can be used with:
- A visible text watermark
- An image watermark
- A visible trace code
- PDF encryption
- Permission restrictions
- Email delivery
It can also be enabled when no visible watermark is required, provided the selected workflow and document policy permit that design.
Step 4: Add a Visible Trace Reference
Although the hidden QR provides machine-readable metadata, a visible trace reference can make investigation faster.
Examples:
- `Trace: {TRACE}`
- `{NAME} — {TRACE}`
- `Issued to {NAME} — Ref: {CODE}`
- `Confidential — {NAME} — {DATE}`
Select supported tokens through the XERIA interface.
Do not type token names from memory when the Watermark Text Builder provides them.
A visible trace value should remain associated with:
- The recipient record
- The generated filename
- The hidden QR metadata
- The output file
- The delivery record
This relationship is more important than the visual design of any single control.
Step 5: Open the Security and Permissions Area
In **Batch Processing**, locate the section used for security and permission options.
This area includes controls for:
- PDF encryption
- Permission restrictions
- Hidden QR trace elements
The hidden QR setting is independent of PDF encryption.
You may use:
- QR only
- QR and a visible watermark
- QR and PDF encryption
- QR and permission restrictions
- QR, encryption, permissions and a visible watermark together
Choose the combination according to document sensitivity and recipient needs.
Step 6: Enable Add Hidden QR Code
Select **Add hidden QR code**.
In the XERIA interface, this option may appear under the security and permissions section.
After enabling it, confirm that the correct recipient list and source PDF remain selected.
The setting is stored as part of the batch security configuration and can be restored with the related batch plan or template.
Do not assume that a previously loaded plan has the intended QR setting. Review it before every sensitive batch.
Step 7: Review the Data That Will Be Encoded
Before generation, verify the values that can appear in the QR.
| QR Field | Source or Meaning | Validation Question |
|---|---|---|
| `DOC` | Document or source filename | Does it identify the correct approved document? |
| `NAME` | Recipient name | Is the spelling correct and linked to the right record? |
| `EMAIL` | Recipient email | Does it belong to the intended recipient? |
| `CID` | Company or recipient ID | Is it unique and accurate where required? |
| `UTC` | Production time in UTC | Is the system clock reliable? |
| `LOCAL` | Local production time | Is the workstation time zone correct? |
Empty values may be represented by a placeholder rather than omitted.
Passwords are not intended to appear in the QR payload.
Minimize unnecessary personal data in recipient records. A person who scans the QR may be able to read the encoded fields.
Step 8: Consider Privacy and Data Protection
The QR is subtle, but its payload is not secret encryption.
A compatible scanner can reveal the encoded plain text.
Before using recipient names and email addresses in the QR:
- Confirm the operational need
- Apply the organization’s privacy policy
- Inform recipients where required
- Avoid unnecessary sensitive fields
- Restrict access to generated documents
- Protect exported trace records
- Define retention periods
- Define incident-response procedures
Do not use the hidden QR as a covert method for collecting unrelated personal information.
Do not encode passwords, authentication secrets or unnecessary confidential identifiers.
Step 9: Run a Small Test Batch
Select a representative test group.
Include:
- A short recipient name
- A long recipient name
- A non-Latin recipient name
- A recipient with a long email address
- A recipient with a company ID
- A page with a light lower-right corner
- A page with a dark lower-right corner
- A portrait page
- A landscape page
- A page containing a chart or image near the corner
Generate the test PDFs with **Generate PDF**.
Do not distribute them yet.
Step 10: Inspect the QR Placement
Open each test PDF and inspect multiple pages.
Check:
- The QR is present near the lower-right corner
- It does not cover important text
- It is not outside the visible page area
- It appears on portrait pages
- It appears on landscape pages
- It remains present on pages with different dimensions
- It does not interfere with signatures or legal notices
- It remains subtle enough for the intended design
The QR is added to each page of the generated output.
If the source layout places essential content in the lower-right corner, revise the source document or reconsider use of the hidden QR for that document.
Step 11: Scan the QR
Use a compatible phone camera or QR reader.
Try scanning:
- At normal PDF zoom
- At increased zoom
- From a screen
- From a printed test page where printing is part of the workflow
- From a scanned copy where scanned documents are expected
A successful scan should display a plain-text record containing XERIA, document information, recipient information and production timestamps.
Confirm that the decoded values match the selected recipient and document.
Do not accept a successful scan as sufficient if it shows the wrong recipient metadata.
Step 12: Test Difficult Pages
QR reliability can vary by page content and output method.
Test pages with:
- Dark backgrounds
- Dense graphics
- Low contrast
- Small page dimensions
- Large margins
- Cropped output
- Image-based PDF content
- Print-and-scan degradation
- Compression
- Photocopying
The QR has a subtle design and no large white quiet zone, so difficult backgrounds can reduce scan reliability.
When reliable machine scanning is more important than visual subtlety, a clearly visible QR design may be more appropriate than XERIA’s hidden QR option.
Step 13: Generate the Full Batch
After the test succeeds:
- Select the approved recipients
- Confirm the source PDF
- Confirm the output location
- Confirm **Add hidden QR code**
- Confirm the visible watermark and trace settings
- Confirm security settings
- Start **Generate PDF**
Monitor:
- Total recipient count
- Current item
- Completed files
- Failed files
- Skipped records
- Output location
- Error messages
A completed progress indicator does not prove that every QR contains the correct recipient data.
Step 14: Verify the Output Set
After generation, reconcile:
- Selected recipient count
- Generated file count
- Output filenames
- Visible watermark values
- Visible trace codes
- Recipient records
- QR-decoded metadata
- Failed or skipped records
- Delivery mappings
Open and scan samples from:
- The beginning of the batch
- The middle of the batch
- The end of the batch
- Different recipient groups
- Different page formats
For a high-risk distribution, verify every recipient-to-file relationship.
Step 15: Use TRACE Analyzer During Investigation
XERIA’s **TRACE Analyzer** works with trace records stored in the local trace database.
A trace-code search can provide fields such as:
- Recipient name
- Company or recipient ID
- Tenant ID
- Application date and time
- Document or output filename
The hidden QR and TRACE Analyzer complement each other.
Use the QR to read metadata embedded in the document copy.
Use the visible trace code and TRACE Analyzer to search the operational trace registry.
When investigating a redistributed file:
- Preserve the original file
- Record where and when it was obtained
- Scan the QR
- Record the decoded payload
- Identify any visible trace code
- Search TRACE Analyzer
- Compare recipient and document information
- Review generation and delivery records
- Avoid concluding responsibility from one indicator alone
A document may have been forwarded, copied from another device or obtained through another person. Trace evidence identifies the issued copy and its associated records; it does not automatically prove who performed a disclosure.
Optional: Deliver the QR-Enabled PDFs by Email
After verification, XERIA can distribute the matching files through configured email workflows.
Before sending:
- Confirm recipient-to-file matching
- Confirm QR metadata for representative files
- Review the email template
- Review the attachment mapping
- Confirm password-delivery rules
- Send the approved files
- Review **Mail Log**
Generate and verify the files before sending high-risk documents.
The detailed email workflow will be covered in the related XERIA email tutorial.
Common Problems
The QR Is Not Present
Confirm that **Add hidden QR code** was enabled before generation.
Generate a new file after changing the setting.
The QR Cannot Be Scanned
Increase the PDF zoom, test another QR reader and inspect the page background.
Also test whether printing, scanning or compression reduced readability.
The QR Covers Important Content
The hidden QR is placed near the lower-right corner.
Review the source layout and avoid placing essential content in that area.
The QR Shows the Wrong Recipient
Stop distribution immediately.
Check the selected recipient list, row mapping, recipient record, output filename and batch order.
Regenerate affected files after correcting the data.
The Document Name Looks Wrong
Use a meaningful original source filename.
Avoid temporary, numeric or random source names.
A Field Shows a Placeholder
The related recipient field may be empty.
Review the recipient record before regenerating the file.
The QR Contains Personal Data That Should Not Be Included
Stop using the affected output and review the recipient-data policy.
Regenerate the file after correcting the data or disabling the hidden QR.
The Visible Trace Code and QR Information Do Not Match
Do not distribute the file.
Review token mapping, recipient selection, trace records and output generation.
TRACE Analyzer Does Not Find the QR Text
TRACE Analyzer searches registered trace records and trace codes. The hidden QR payload is a separate plain-text metadata record.
Search using the visible or registered trace code rather than assuming the complete QR payload is a TRACE Analyzer key.
Best Practices
- Use an approved and versioned source PDF.
- Keep recipient records accurate.
- Use meaningful document filenames.
- Assign unique recipient or trace identifiers.
- Combine hidden QR with a visible watermark where appropriate.
- Keep visible trace values linked to recipient records.
- Enable **Add hidden QR code** deliberately.
- Review privacy requirements before encoding recipient data.
- Never encode passwords in the QR.
- Minimize unnecessary personal data.
- Test portrait and landscape pages.
- Test light and dark page backgrounds.
- Test screen scanning and printed output.
- Inspect multiple pages in long PDFs.
- Run a representative test batch.
- Reconcile recipient and output counts.
- Scan samples from different parts of the batch.
- Stop distribution when metadata does not match.
- Protect trace databases and exported records.
- Review Mail Log after email delivery.
- Preserve source files and evidence during investigations.
- Treat QR evidence as one part of a broader traceability process.
Frequently Asked Questions
Is the Hidden QR Completely Invisible?
No. It is a small, semi-transparent QR placed near the lower-right corner. It is designed to be subtle, not impossible to see.
What Information Does the QR Contain?
It can contain the document name, recipient name, email, company or recipient ID, and UTC and local production timestamps.
Does the QR Contain the PDF Password?
No. Open passwords and owner passwords should not be embedded in the QR payload.
Is the Hidden QR the Same as a Visible Trace Code?
No. The QR contains machine-readable metadata. A visible trace code is a separate human-readable reference that can be linked to trace records.
Is the QR Added to Every Page?
Yes. XERIA adds the hidden QR to each page of the generated output PDF.
Can I Change the QR Position or Size?
The current hidden QR placement and size are applied automatically. The main watermark position and size controls do not configure the hidden QR.
Can a Recipient Remove the QR?
A technically capable person may be able to crop, cover, edit or recreate a PDF. The QR supports traceability but is not tamper-proof digital rights management.
Can I Scan the QR with a Phone?
Usually, yes, but scan reliability depends on screen zoom, page background, print quality, compression and the QR reader.
Does QR Traceability Prove Who Leaked a Document?
No. It can identify metadata associated with an issued copy. Investigation should also consider delivery records, access context and other evidence.
Conclusion
XERIA’s **Add hidden QR code** option adds a compact machine-readable trace element to each page of a generated PDF.
The QR can carry document name, recipient name, email, company or recipient ID, and production timestamps. It does not contain PDF passwords, and it is distinct from a visible trace code.
A reliable workflow prepares accurate recipient data, enables the QR deliberately, tests difficult page layouts, scans representative outputs, reconciles files with recipients and uses QR evidence together with visible watermarks, trace records and delivery logs.