What is a decoy link, and when would you use one?

Search "decoy link" and you get two different answers. One is a security-world term: a trap URL buried in a web page that no real person would ever click, sitting there to catch bots and scanners. Useful, but niche, and not what most people are after.

The other meaning is the one worth pulling apart. A decoy link is a link that shows one thing to everyone and carries something else for one person. Scan it with a normal camera and you get an ordinary web page. The same code, opened the right way by the right person, reveals a private message. Two destinations, one QR, and no sign from the outside that the second one is there.

That second sense is what GhostCode's Decoy Link feature does, and it's a genuinely different idea from a plain QR code.

What actually happens

A normal QR code holds one link. Point a phone at it, and the phone opens that link. Everyone who scans it lands in the same place. There's no room in that for a secret, because whatever the code carries, the camera shows.

A decoy link splits the code's job in two. You give it a public link: a page you're happy for anyone to see. You also give it a hidden message and a Key. Anyone who scans the code with their camera gets the public page and never knows anything else is attached. The one person you meant it for opens the same code inside GhostCode, enters the Key you gave them, and reads the private part.

The word decoy is doing real work here. The public link isn't a placeholder or an error page. It's a believable, ordinary destination whose whole job is to look like the only thing the code does.

When you'd actually use one

Most of the time you don't need this. A grocery list doesn't need a decoy. The feature earns its place in the narrow set of moments where a code has to work for a crowd and also say something to one person in that crowd.

A few that come up:

• An event. A poster or table card opens the public schedule for every guest who scans it. For one person, the same card carries the room and time for the part that isn't on that schedule.
• A members-only drop. A flyer sends everyone to your public page. The people who already hold the Key get the actual link to the thing that hasn't been announced.
• A gift. A card opens a normal photo album for anyone who picks it up. For the person it's meant for, it opens a note you wrote just for them.

The shape is the same in each: a public layer that stands on its own, and a private layer only one person can reach. If you only ever needed the private part, you wouldn't reach for a decoy at all. You'd just send the message. The decoy is for when the code also has to be seen by other people and give nothing away.

The key is the whole thing

The Key never travels inside the code. You share it with the recipient separately: say it out loud, send it on its own, write it on a different card. The code can go anywhere, get photographed, get reposted, and it still only opens for the person holding the Key.

That separation is the point, and it's also the honest limit. Whoever has the Key can open the message. Send the Key to the wrong person and the decoy doesn't save you. The feature narrows who can read something down to the people you handed the Key to. It doesn't judge who deserves it.

What a decoy link is not

It is not a way to prove a code is untampered or that a page is authentic. It doesn't make the public link private. And a screenshot taken while the private message is open is outside everyone's control, ours included. If the person you sent it to captures the message on their screen, that capture is theirs to keep. A decoy controls who can open a message, not what they do once it's open. Better to be straight about that, because a feature that oversells itself is worse than one that tells you its edges.

If you want the hidden layer to close on its own, you can put a self-destruct timer on it. After that point the app won't reopen the private message, though the public link keeps working like nothing changed. And if you'd rather not have to explain why a code has a hidden side at all, that's closer to plausible deniability, a related but separate idea.

Questions people ask

Is a decoy link the same as a dynamic QR code?

No. A dynamic QR sends everyone to a link you can change later, but it's still one destination at a time. A decoy link serves two things at once: the public page for anyone, the private message for the one person with the Key. The point isn't editing the link, it's holding a second layer under the first.

Can someone tell there's a hidden message?

To an ordinary scanner, a decoy link code just opens its public page and looks finished. Someone who knows GhostCode exists might guess a code could carry more, but guessing isn't opening. Without the Key, the message stays closed.

Do I need an app for this?

You do, and so does the person reading the private part. The public link works for anyone with a camera. The hidden message opens only inside GhostCode with the Key, the same mechanism behind a hidden message in a QR code. That two-step is the trade for keeping it genuinely private rather than merely hard to notice.