Key Takeaways
- The QR code is a key handover, not a login. Scanning it grants a browser its own cryptographic identity on your account, which is why the same square of pixels is both the fastest way in and the most abused attack surface on WhatsApp.
- Scan it from inside WhatsApp, never with your phone's camera app. The scanner lives under Linked devices, and using the default camera instead is the most common reason people think the code is broken.
- A camera that won't cooperate is not a dead end. The linking screen offers a phone-number route that replaces the scan with an eight-digit code typed into your phone.
- Four linked devices, and a 14-day clock on the primary phone. Let the main phone sit unused past that and every browser session logs itself out. Higher device counts on the Business app are tied to a Meta Verified or Meta One subscription rather than a setting.
- Audit the device list on a schedule. Attack campaigns documented through 2025 and 2026 work by getting a real person to approve a real linking request, so the list under Linked devices is the only place the intrusion is visible.
Most guides treat the WhatsApp Web QR code as a login screen. It isn't one. There is no password and no session cookie, because what happens when you scan is that your phone issues a new device its own key material and adds it to the account. That explains most of what people find confusing about it: why the code refreshes on a timer, why your phone can be switched off afterwards but not for two weeks, and why scanning a code a stranger sent you is a full account takeover rather than a phishing attempt that still needs your password.
For a business answering customers from a desktop, linking is the easy part and access control is the real work.
What the QR code actually does
Since multi-device support rolled out, each linked device holds its own encrypted connection to the people you talk to. Your browser is not mirroring your phone's screen or relaying traffic through it. It talks to the other side directly, with end-to-end encryption on the Signal Protocol intact on every linked session.
That design means your phone can be face down, out of battery or on a plane while the desktop session keeps working. It also makes a linked browser a full participant in the account rather than a viewer, which is why the ceiling is four companion devices and why the primary phone has to check in every 14 days.
The QR code carries the pairing data for that key exchange, and it cycles on a short timer for the same reason a bank's one-time code does: a screenshot of it should be worthless a minute later.
How to link WhatsApp Web with a QR code
The whole sequence takes under a minute when nothing fights you. Have the phone unlocked and in your hand before you open the browser, because half the failures in the next section are really timing problems.
Step 1: Open the real address
Go to web.whatsapp.com in Chrome, Edge, Firefox, Safari or Opera, on a current version. Type the address rather than clicking a search result. Fake WhatsApp Web pages are a standing problem, and they look convincing because they display a genuine QR code, a point the security section below comes back to.
The desktop client for Windows and macOS pairs through the identical flow, so nothing below changes if you prefer an installed app.
Step 2: Open the scanner inside WhatsApp
On Android: open WhatsApp, tap the three-dot menu, then Linked devices, then Link a device.
On iPhone: open WhatsApp, go to Settings, then Linked devices, then Link device.
Your phone may ask you to confirm with your fingerprint, face or device PIN before the camera opens. That prompt is the account's last checkpoint, so read what is on screen before you approve it out of habit.
Do not point your phone's regular camera app at the code. It will happily decode the square and hand you a link that goes nowhere useful. WhatsApp only accepts a scan made by its own scanner.
Step 3: Scan, then wait for the handshake
Hold the phone 20 to 30 centimetres from the screen, square to it, and let autofocus settle. The browser shows a brief loading state after a successful read while the key exchange completes, then your chat list appears. On a slow connection that pause runs several seconds, and closing the tab during it is how people end up scanning four times in a row.
Chats sync newest first, so an incomplete list right after linking is normal rather than a fault.
Step 4: Use the phone-number route when the camera won't cooperate
Below the QR code, the linking screen offers Link with phone number instead. Choose your country, enter the number on the account, and the browser prints an eight-digit code. On the phone, a notification prompts you to enter it, and the pairing completes the same way.
This is the better option on a cracked lens, a dim laptop screen, a phone whose camera permission is switched off, or any setup where the machine you are linking sits in a different room from the display. WhatsApp's own guide to linking a device with a phone number covers the Business app variant too.
Step 5: Check the device list before you walk away
Go back to Linked devices on the phone. You should see the session you just created, with the browser or platform name and a last-active timestamp. Anything in that list you cannot account for gets tapped and logged out now, not later. Ten seconds, and it is the only view you get of who else holds your account.
When the QR code won't scan, in order of likelihood
Work down this list rather than restarting your router first. The causes are ranked by how often they turn out to be the real one.
- You used the wrong scanner. Covered above, and it accounts for more failed attempts than every technical cause combined. The scanner must be the one inside WhatsApp under Linked devices.
- The code expired mid-scan. It refreshes on a short cycle. If the browser shows a greyed-out code with a reload button, click it and scan the fresh one straight away.
- Screen brightness or contrast. A QR code is read as black-and-white geometry, so a dimmed laptop screen, a heavy dark-mode extension or a matte privacy filter can flatten it past what the camera can resolve. Push brightness to full and retry.
- A smudged lens. Unglamorous and common. Wipe it.
- Camera permission is off. On iPhone, Settings > Privacy & Security > Camera. On Android, app info, then Permissions > Camera.
- The browser never rendered the code properly. A blank space, a permanently spinning loader or a code that never refreshes usually means an extension or a stale cache. Try a private window with extensions disabled, then clear the site data, then a different browser.
- An outdated WhatsApp build. Older versions occasionally refuse to open the scanner at all.
- Corporate network filtering. Managed networks sometimes block the persistent connection WhatsApp Web depends on, which produces a code that scans fine and then hangs. A phone hotspot isolates that in thirty seconds.
If the code scans and the browser still hangs after a hotspot test, switch to the phone-number method. It routes the pairing differently and clears a fair share of the stubborn cases.
The scan you should never make
Everything above assumes you opened the browser yourself. The attack pattern that matters inverts that.
Through late 2025 and into 2026, researchers documented a campaign that abuses device linking directly, reported as GhostPairing by Malwarebytes and tracked in parallel by Infosecurity Magazine and Security Affairs. The mechanics are uncomfortable because nothing about them is technically broken:
- A message arrives from a contact you trust, often a photo lure or a request to vote for someone's friend, carrying a link with a Meta-styled preview.
- The page asks for your phone number.
- Behind the scenes it submits a real device-linking request for a device the attacker controls, then shows you the genuine QR code or the genuine eight-digit pairing code that WhatsApp generated.
- You approve it, because every screen you have seen is authentic.
From there the attacker's device has the same rights as your laptop: reading new and synced messages, downloading media, and sending the same lure onward to your contacts under your name. No password was stolen, so no password reset helps.
The defences are unexciting and they work. Never scan a code or enter a pairing code unless you started the action yourself, on a page you typed in. Turn on two-step verification so there is a PIN in the chain that an attacker cannot produce. Treat the Linked devices list as a security log and log out anything unfamiliar, and on a business number make that check part of whoever owns the phone's routine.
Reporting on the campaign also notes German police warnings during 2026, which matters if you handle customer conversations under GDPR: an attacker inside a linked session has read access to personal data you are the controller for, and that is a reportable incident rather than an IT annoyance.
Managing linked access when more than one person answers
The device model that makes WhatsApp Web convenient for one person is what makes it awkward for a team. Four companion devices is the free ceiling, on the consumer app and the Business app alike. Raising it on the Business app depends on what a Meta Verified or Meta One subscription includes, and if that subscription lapses, only the four most recently active devices stay linked.
Every one of those devices is also the same identity. Two colleagues working the same number cannot see who replied, cannot assign a conversation, and cannot hand one over cleanly. Customers see one business, which is the intended behaviour, and internally you see nothing. Teams that reached this ceiling by putting the business on a virtual number for WhatsApp hit it in exactly the same place.
meetergo sits on the WhatsApp Business Platform rather than on linked devices, which is a different route to the same inbox. Several team members work one number with chats assigned, customer details sit in a sidebar next to the conversation via the built-in CRM, and booking links go out inside the thread so an enquiry turns into a confirmed appointment without the customer leaving the chat. The Mira AI agent answers from your own knowledge base, qualifies, books and hands over to a person when it should, and appointment reminders go out on the same channel the booking came in on.
Be clear about what that does and does not change. It is not a substitute for WhatsApp Web authentication, and it does not make a hijacked personal account safe. It is a different way to run customer messaging, with per-user access instead of a shared phone. Budget for it as an add-on: €39 per number per month sits on top of whichever plan you are on (Free €0, Light €9.90/mo, Suite €29.90/mo, Premium €49.90/mo), and Meta bills its own per-message fees separately, as it does with every Platform-based tool. Our breakdown of WhatsApp Business API pricing covers that model before you commit, the WhatsApp automation guide covers what is worth automating first, and teams for whom messaging data residency decides it should read the security page rather than a summary.
Not ready for any of that? The free WhatsApp link generator produces a click-to-chat link for a website or an email signature, and pairs well with a QR code business card for anyone who meets customers in person.
Common mistakes
Scanning with the phone's camera app. Worth repeating because it is the top cause of "the QR code is broken".
Assuming the phone has to stay online. It doesn't, for a given session. It does have to be used at least once every 14 days or the linked browsers disconnect.
Leaving sessions on shared machines. A hotel business centre, a client's laptop, a colleague's desktop. Logging out of the browser is polite; logging the device out from the phone is what revokes the key.
Treating a shared handset as a shared inbox. Passing one phone between people breaks at the point the second person needs to work in parallel. If you can see the team coming, plan the move to a proper inbox at two people rather than at five.
Ignoring the device list because nothing looks wrong. A linked attacker has no reason to make noise, so silence is the expected state during a compromise. That is why the check has to be scheduled rather than triggered.
Start with meetergo's free plan and connect a calendar first, so booking links work in chat before you commit to a messaging add-on. No credit card required, and paid tiers carry a 7-day trial. Compare the plans or book a demo if the team question is the one you are stuck on.
Booking + video conferencing in one tool.
Booking + video conferencing in one tool.
FAQs
Why does the linking page say "código QR" instead of "QR code"?
The page renders in whichever language your browser asks for, so the same screen reads código QR, code QR or QR-Code depending on your system settings. It is the same code and the same flow. Change your browser or system language if you would rather read it in English.
Do I need my phone nearby every time I open WhatsApp Web?
Only for the first link. After that the browser session runs independently. The primary phone does need to be used at least once every 14 days, otherwise linked devices log out and you start again from the QR code.
How many devices can I link at once?
Your primary phone plus four more. On the WhatsApp Business app, going beyond that is tied to what your Meta Verified or Meta One subscription includes, and cancelling the subscription drops you back to the four most recently active devices.
Someone sent me a QR code to scan for a prize or a vote. Is that safe?
No. Treat any unsolicited code, whether a QR image or an eight-digit pairing code, as an attempt to link a device to your account. Approving it gives that device read and send access to your conversations.
Is a linked browser session still end-to-end encrypted?
Yes. Each linked device holds its own keys and encrypts directly with the other participants rather than relaying through your phone. The encryption is not the weak point. Who holds a linked device is.
Can I stop a specific linked device without logging out everywhere?
Yes. Open Linked devices on the phone, tap the entry you want gone, and log it out. Other sessions are unaffected.
What happens to my linked sessions if I change phones?
Moving the account to a new handset invalidates the existing links. You re-link each browser from the new primary device, which is also a convenient moment to drop the sessions you had forgotten about.
