Google Introduces QR Code Authentication in Messages Beta Replacing 80-Character Key System

Google is trialing a new message verification method for Android users, introducing a QR code-based authentication system within its Google Messages app. Initially rolled out through the beta channel, the feature builds on Google’s end-to-end encryption framework for Rich Communication Services (RCS), which the company promotes as a modern alternative to traditional SMS.

Previously, users had to manually compare a lengthy 80-digit security code to confirm they were communicating with the correct person. Although accurate, this method proved too cumbersome for most users and was rarely adopted. The new QR-based approach simplifies the process—users can now open a conversation, navigate to contact details, select “Verify encryption,” and either scan the other party’s QR code or display their own for scanning. Upon successful scan, both parties receive confirmation that the encryption keys match, ensuring a secure chat.

According to reports, the legacy method remains available for those who prefer it, but the QR code option is now the default setting. At present, the feature is only accessible to beta testers. Google is actively collecting feedback before a broader rollout to all devices running Android 9 or later. While no official release date has been set, the feature is expected to launch later this year.

This development is significant because, while encryption secures message content, it does not inherently verify the identity of the person on the other end. Without verification, there remains a risk of man-in-the-middle attacks, where an adversary could impersonate or intercept communications.

It’s also worth noting that in recent years, Google has been phasing out SMS-based account verification codes, which are vulnerable to interception, SIM-swapping scams, and redirection. Instead, the company has been embracing more secure alternatives such as in-app prompts, passkeys, and QR codes—methods that tie authentication directly to the device rather than the insecure phone number. Earlier this year, Google also introduced an AI-powered phishing detection feature in Android 15, designed to scan SMS, MMS, and RCS messages in real-time within the Google Messages app and flag suspicious content.