FaceTec’s UR Code Protocol Aces Independent Security Review

FaceTec’s UR Code protocol has passed a comprehensive security review conducted by Praetorian Security Inc., with zero vulnerabilities detected across all risk categories. The assessment reinforces FaceTec’s claims about the protocol’s resilience, as the company continues to position UR Codes as a foundational technology for secure, decentralized digital identity verification.

Praetorian’s analysis included reverse engineering of the UR Code software development kit (SDK), specifically targeting potential exposure of internal hashing functions, encryption keys, and personally identifiable information. According to the firm’s attestation, the SDK revealed zero critical, high, medium, or low risk issues — and no informational risk issues either. The full findings are available in public security letters.

Secure-by-Design Architecture

In addition to reverse engineering, Praetorian also examined security controls related to code obfuscation, such as dead code insertion, control flow flattening, and renaming of variables, classes, and functions. The clean results add weight to FaceTec’s assertion that UR Codes are secure by design — a key consideration as the technology gains traction in digital identity use cases.

UR Codes serve as digitally signed biometric barcodes that bind facial biometrics and legal identity data, enabling offline, verifiable identity proofing. Unlike e-passports that rely on NFC chips, FaceTec says its solution avoids durability issues and high costs while preserving comparable privacy and security. The biometric data encoded in a UR Code cannot be reconstructed into a viewable face image, protecting user privacy while still allowing biometric matching.

Momentum Builds Around UR Code Ecosystem

The security validation follows a series of recent product rollouts and upgrades for the UR Code ecosystem. In April, FaceTec released its Scan+Match apps, which allow individuals to scan a UR Code and match it to a live 3D face photo directly on their mobile device — with no biometric data ever leaving the phone.

Earlier in the year, the company introduced its UR Encoder software, enabling issuers to generate codes from behind their own firewalls. This technology ensures that the encoding of biometric and legal identity data, along with the cryptographic signature using the issuer’s private key, remains under the control of the issuing authority. The resulting UR Codes are immutable and verifiably authentic when checked against the issuer’s public key.

FaceTec also recently upgraded the cryptographic structure of UR Codes, extending their validity through at least 2035. The future-proofing measure is intended to support long-term deployment scenarios in government, finance, education, and beyond.

Decentralized Verification for All

UR Codes can be generated by any approved issuing authority — such as a DMV, school, or employer — using FaceTec’s encoder tools. Codes are then scannable by any standard webcam or smartphone using the freely available Scanner/Matcher SDK. FaceTec offers this SDK at no cost to nonprofits, law enforcement, and government agencies, aiming to encourage widespread adoption in both public and private sectors.

Because all verification happens locally, without sending data to a central server, UR Codes support a privacy-preserving approach to digital identity. It’s a decentralized model that also enables offline use, broadening the technology’s potential reach in regions with limited connectivity.

–

May 6, 2025 – by Cass Kennedy and Alex Perala