# Matter QR > Source: https://docs.barcoder.ai/docs/standards/matter-qr > research date 2026-10-30 · extracted at 2026-10-30 > Publisher: Barcoder — encyclopedia of QR, barcode and payment-code standards Specifications: - [Connectivity Standards Alliance specifications download page](https://csa-iot.org/developer-resource/specifications-download-request/) - [Matter 1.6.1 Core Specification (linked from the CSA page; not read for this entry, see Technical specification)](https://csa-iot.org/wp-content/uploads/2026/09/23-27349-012_Matter-1.6.1-Core-Specification.pdf) - [IANA registration of the mt URI scheme](https://www.iana.org/assignments/uri-schemes/perm/mt) - [SetupPayload.h, Matter reference SDK](https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/SetupPayload.h) ## Overview A **Matter onboarding QR code** is a [QR Code](https://docs.barcoder.ai/docs/standards/qr-code) symbol that starts commissioning of a Matter smart-home device. Its payload is the text `MT:` followed by a base-38 string that packs the device's vendor and product IDs, discovery methods, discriminator and setup passcode [1][1] [2][2]. Scanning the code gives a phone's Matter software what it needs to find the device and open a passcode-protected session with it [1][1] [25][25]. The format belongs to the Connectivity Standards Alliance (CSA), and `mt` is a permanent IANA URI scheme [1][1]. An 11-digit or 21-digit manual pairing code carries a reduced form of the same data for typing or reading aloud [7][7] [10][10]. ## History Matter began as **Project Connected Home over IP (CHIP)**. Wikipedia dates the announcement to 18 December 2019, naming Amazon, Apple, Google, Samsung SmartThings and the Zigbee Alliance [19][19]. On **11 May 2021** the Zigbee Alliance became the Connectivity Standards Alliance and CHIP took the name Matter [15][15]. The `mt` URI scheme was registered with IANA six days later, on 17 May 2021, and last updated on 20 January 2023 [1][1]. The CSA published **Matter 1.0** and opened certification on 4 October 2022. That release used Bluetooth Low Energy for commissioning [14][14]. Later releases changed how the onboarding data can be delivered: - **Matter 1.4.1 (7 May 2025)** added a single QR code for several devices and allowed NFC tags to store the same onboarding details as a QR code [16][16]. - **Matter 1.6 (17 June 2026)** let the full commissioning exchange run over NFC, where 1.4.1 tags still relied on Bluetooth LE [17][17]. The fetched sources do not name the individuals who designed the payload format. ## Technical specification **Source note.** The CSA offers the Core Specification as free PDF downloads [18][18], but those files exceeded this research run's fetch limit and were not read. The details below come from the CSA's open-source reference SDK, the IANA registration and the independent matter.js implementation. Section 5.1 of the specification is the normative text; SDK comments cite it [2][2]. **Carrier.** The text is an ordinary QR payload. The `mt` grammar is `MT:` followed by one or more base-38 segments separated by `*`, and the registration says the payload's internal structure is defined by Matter rather than meant to be parsed from the URI [1][1]. Google's sample code treats a string as a Matter code if it has the prefix and a suffix of at least 19 characters, which may be longer [11][11]. **Base-38 alphabet.** The alphabet is the digits, the uppercase letters A to Z, then `-` and `.` [3][3]. These are QR alphanumeric mode's 45 characters [33][33] minus space, `$`, `%`, `*`, `+`, `/` and `:`, so a whole `MT:` string fits that mode. Each 3-byte chunk is read as a little-endian integer and written as 5 characters, least significant digit first. A final 2-byte chunk becomes 4 characters and a final single byte becomes 2 [3][3] [4][4]. One trade article says the alphabet drops confusing characters [23][23]. The SDK table contains all 26 letters [3][3], and Google's own sample has an `O` in it [11][11]. **Bit layout.** Fields are packed least significant bit first, in this order, followed by optional TLV data [6][6]. Widths come from the SDK [2][2] [5][5], and matter.js gives the same offsets [10][10]. | Field | Bits | Notes | |---|---|---| | Version | 3 | Must be 0 [8][8] [10][10] | | Vendor ID | 16 | 0 means unspecified [10][10] | | Product ID | 16 | 0 means unspecified [10][10] | | Commissioning flow | 2 | 0 standard, 1 user action required, 2 custom [2][2] | | Discovery capabilities | 8 | See below | | Discriminator | 12 | Long form; the manual code keeps only the top 4 bits [5][5] | | Setup passcode | 27 | 1 to 99,999,998, with exclusions below [2][2] [8][8] | | Padding | 4 | Zeros [6][6] | That is 88 bits, or 11 bytes, which base-38 turns into the 19 characters seen in a code with no optional data. **Discovery capabilities.** The SDK header assigns bit 0 to SoftAP, 1 to BLE, 2 to on-network, 3 to Wi-Fi PAF, 4 to NFC and 5 to Thread [2][2]. The matter.js schema names only bits 1 to 4 [10][10], so this entry does not state which bits are normative in a given specification version. **Excluded passcodes.** The SDK rejects 0, anything above 99,999,998, the eight repeated-digit values from 11111111 to 88888888, and 12345678 and 87654321 [8][8]. A parser may still accept such a string as well-formed: an SDK test keeps one with passcode 111111111 for that case [9][9]. **Optional TLV data.** Bytes after the fixed block are TLV. Tags below 0x80 are common and 0x80 to 0xFF are vendor-specific [2][2]. The common tags are serial number (0x00), PBKDF iterations (0x01), PBKDF salt (0x02), number of devices (0x03) and commissioning timeout (0x04) [2][2]. matter.js rejects tags 0x05 to 0x7F as reserved and requires the iteration count and salt to appear together [10][10]. **Several payloads in one code.** Segments after the first are joined with `*` and repeat no prefix [1][1] [6][6]. An SDK test parses four payloads from one such string [9][9]. matter.js caps a single payload at 255 characters and the whole string at 4,296 [10][10]. ### Worked example `MT:Y.K9042C00KA0648G00` is the sample published by Matter Alpha, which describes its IDs as test values for uncertified devices [22][22]. Decoded for this entry with a short script following the layout above: | Field | Value | |---|---| | Bytes | `88 ff 07 00 44 00 e0 4b 84 68 02` | | Version | 0 | | Vendor ID | 65521 (0xFFF1) | | Product ID | 32768 (0x8000) | | Flow | 0, standard | | Discovery | 2, BLE | | Discriminator | 3840 | | Passcode | 20202021 | The discriminator and passcode match the example setup values on Google's Matter guide [12][12]. Google's sample `MT:Y3.13OTB00KA0648G00` [11][11] decodes the same way apart from its vendor and product IDs. **Symbol size.** The specification's required error-correction level and minimum print size were not read, so none is stated here. The sample's 22 characters encode in alphanumeric mode as version 1 (21 × 21) at L, version 2 (25 × 25) at M and Q, and version 3 (29 × 29) at H (computed with segno 1.6.6, no error-level boost), in line with published capacities [32][32]. ### Manual pairing code The manual code is decimal and has 11 digits, or 21 when vendor and product IDs are included. The final digit is a Verhoeff check digit [7][7] [10][10]. | Digits | Content | |---|---| | 1 | Top 2 bits of the short discriminator, plus a flag for "VID and PID present" | | 2 to 6 | Low 14 bits of the passcode, plus the low 2 bits of the short discriminator | | 7 to 10 | Remaining 13 bits of the passcode | | 11 to 15 | Vendor ID (long form only) | | 16 to 20 | Product ID (long form only) | | Last | Verhoeff check digit | The SDK uses the long form when the flow is not standard [7][7]. Matter Alpha notes that the manual code omits the long discriminator as well as the IDs, yet is still enough to set up the device [22][22]. Applying this layout to the sample's passcode and discriminator reproduces `34970112332`, the code printed by Matter Alpha [22][22] and Google [12][12]. Google's long example `749701123309050652796` [12][12] also regenerates exactly, check digit included. ### Security properties Base-38 is an encoding, not encryption, so anyone who reads the code has the passcode, as the worked example shows. Nordic engineers note the same for the manual code: it contains the passcode, while the device should hold only the SPAKE2+ verifier. They add that both codes should be created during manufacturing, and that logging them is for debugging [26][26]. The CSA describes onboarding as a passcode-based session followed by device attestation, under which a device cannot join a fabric unless proven genuine [25][25]. The passcode therefore gates access to an uncommissioned device, while attestation is a separate check on the device itself. A KU Leuven security analysis (ePrint 2025/1268) lists low-entropy passcodes, static per-device salts and weak PBKDF2 parameters among the PASE weaknesses it found. It also reports that a certified codebase did not enforce limits on failed pairing attempts. The authors say all identified vulnerabilities were disclosed and patched [24][24]. ## Use cases - **Consumer setup on phones.** iOS has supported Matter since 16.1 and shows a camera viewfinder for the setup code; apps can use their own scanner and pass the payload to the pairing API [13][13]. On Android, an app can start commissioning with an `ACTION_VIEW` intent whose data URI is the `MT:` string, handled by Google Play Services [11][11]. - **Multi-packs.** Before 1.4.1, each device in a pack had its own code, scanned and completed in turn. A single code can now set up several devices, with compatible commissioners [16][16]. - **Factory labelling.** Espressif's production tool prints QR labels from a server, spreadsheet or scanned data, and can return QR, manual and DSN codes for laser marking [28][28]. - **Development boards.** Firmware commonly prints its `MT:` string to the serial console or shows it on a display, and Google's guide scans that output during bring-up [12][12]. - **Hard-to-reach products.** NFC tags carry the same details for bulbs in fixtures or switches whose codes are hidden once installed [16][16]. - **Adding a second ecosystem.** TP-Link's support guide says a printed code works only once, so the first ecosystem's app must generate a new code for the next one. Several platforms issue these as 11-digit numeric codes, and validity varies, from 3 minutes on Google Home to 15 on the Tapo app [27][27]. ## Implementations Stars and activity were read from the GitHub API on 2026-10-30. | Project | Lang | Stars | Last active | Notes | |---|---|---|---|---| | [project-chip/connectedhomeip](https://github.com/project-chip/connectedhomeip) | C++ | ~9.0k | 2026-10 | Reference SDK; `src/setup_payload` generates and parses both code types, and `SetupPayload.py` is a command-line tool for them [34][34] | | [matter-js/matter.js](https://github.com/matter-js/matter.js) | TypeScript | ~0.9k | 2026-10 | Independent implementation with its own pairing-code schema [10][10] | | [espressif/esp-matter](https://github.com/espressif/esp-matter) | C++ | ~1.1k | 2026-10 | Espressif's Matter SDK for ESP32 chips, built on connectedhomeip | | [project-chip/rs-matter](https://github.com/project-chip/rs-matter) | Rust | ~0.6k | 2026-10 | Rust implementation; its example prints the QR text and code at runtime | General QR scanners can read the symbol. Google's sample app, for example, detects the code with ML Kit Barcode Scanning and only then hands it to Matter commissioning [11][11]. ## Comparison - **Matter QR vs [HomeKit Setup Code](https://docs.barcoder.ai/docs/standards/homekit-setup-code).** Both put an 8-digit setup code in a compact base-N string. HomeKit's payload, as documented by the third-party HomeSpan project, is `X-HM://` plus nine base-36 characters and a 4-character setup ID [30][30]. No Apple specification was read for this comparison. Matter's is a multi-vendor format with a public URI scheme [1][1]. The choice follows the ecosystem: a Matter accessory is paired through iOS's Matter setup-code flow [13][13], not as a HomeKit code. - **Matter QR vs [WiFi QR](https://docs.barcoder.ai/docs/standards/wifi-qr).** A `WIFI:` code carries the network password in readable text [21][21] and joins a phone to a network. A Matter code carries a passcode for one device's commissioning session [25][25], and the phone supplies the Wi-Fi or Thread credentials itself [13][13]. - **Matter QR vs [Wi-Fi Easy Connect QR](https://docs.barcoder.ai/docs/standards/wi-fi-easy-connect-qr).** Wi-Fi Easy Connect uses a `dpp` bootstrapping URI that can also travel by QR, BLE or NFC [31][31]. It is a Wi-Fi Alliance format for network onboarding, whereas Matter's code onboards a device into an application-layer fabric. - **QR vs manual code.** The QR code holds the full discriminator, IDs and optional TLV. The manual code holds less but can be typed or spoken, so it suits a device whose code cannot be scanned [7][7] [22][22]. ## Fun facts - Matter and HomeKit, as documented above, both use a **27-bit** field for a decimal setup code [2][2] [30][30]. That is the smallest width that fits 99,999,998, since 2^26 is only about 67 million. - A second payload added to the same symbol does not repeat `MT:`. The 42-character string formed by doubling the sample's segment still fits version 3 at level M (computed with segno 1.6.6). The string is illustrative, not a working multi-device code. ## Status **Active.** The CSA download page lists Matter Core Specifications through 1.6.1 [18][18]. The Matter handbook describes a major.minor.patch scheme with normally two minor releases a year [20][20]. Version 1.6 of June 2026 added commissioning over NFC [17][17]. The QR code has not been replaced. CSA's FAQ still describes setup by scanning the QR code or entering the digits by hand, and says some manufacturers also support NFC tapping [29][29]. Only Matter-certified devices may carry the Matter logo [29][29]. A test vendor ID cannot be used in a consumer device [12][12]. ## Sources [1]: https://www.iana.org/assignments/uri-schemes/perm/mt [2]: https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/SetupPayload.h [3]: https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/Base38.h [4]: https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/Base38Encode.cpp [5]: https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/lib/support/SetupDiscriminator.h [6]: https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/QRCodeSetupPayloadGenerator.cpp [7]: https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/ManualSetupPayloadGenerator.cpp [8]: https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/SetupPayload.cpp [9]: https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/tests/TestQRCode.cpp [10]: https://raw.githubusercontent.com/matter-js/matter.js/main/packages/types/src/schema/PairingCodeSchema.ts [11]: https://developers.home.google.com/samples/intent-based-commissioning [12]: https://developers.home.google.com/matter/integration/pair [13]: https://developer.apple.com/apple-home/matter [14]: https://csa-iot.org/newsroom/matter-arrives/ [15]: https://csa-iot.org/newsroom/connectivity-standards-alliance/ [16]: https://csa-iot.org/newsroom/a-smarter-start-matter-1-4-1-makes-setup-easier/ [17]: https://csa-iot.org/newsroom/matter-1-6-enables-more-intuitive-setup-multi-ecosystem-experiences-and-context-driven-control/ [18]: https://csa-iot.org/developer-resource/specifications-download-request/ [19]: https://en.wikipedia.org/wiki/Matter_(standard) [20]: https://handbook.buildwithmatter.com/specification [21]: https://docs.barcoder.ai/source/standards/wifi-qr [22]: https://www.matteralpha.com/explainer/how-does-matter-qr-code-work [23]: https://www.rfwireless-world.com/terminology/anatomy-of-matter-qr-code [24]: https://eprint.iacr.org/2025/1268 [25]: https://csa-iot.org/wp-content/uploads/2022/03/Matter_Security_and_Privacy_WP_March-2022.pdf [26]: https://devzone.nordicsemi.com/f/nordic-q-a/126960/inquiry-regarding-manual-pairing-code-length/562273 [27]: https://www.tapo.com/us/faq/294/ [28]: https://docs.espressif.com/projects/esp-test-tools/en/latest/esp32/production_stage/tools/matter_qr_code_generator.html [29]: https://csa-iot.org/all-solutions/matter/matter-faq/ [30]: https://github.com/stockhuman/HomeSpan/blob/master/docs/QRCodes.md [31]: https://www.iana.org/assignments/uri-schemes/prov/dpp [32]: https://www.thonky.com/qr-code-tutorial/character-capacities [33]: https://www.thonky.com/qr-code-tutorial/alphanumeric-table [34]: https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/python/README.md [1] [URI scheme registration: mt](https://www.iana.org/assignments/uri-schemes/perm/mt) — IANA, registered 2021, updated 2023, accessed 2026 [2] [SetupPayload.h](https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/SetupPayload.h) — Project CHIP connectedhomeip, accessed 2026 [3] [Base38.h](https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/Base38.h) — Project CHIP connectedhomeip, accessed 2026 [4] [Base38Encode.cpp](https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/Base38Encode.cpp) — Project CHIP connectedhomeip, accessed 2026 [5] [SetupDiscriminator.h](https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/lib/support/SetupDiscriminator.h) — Project CHIP connectedhomeip, accessed 2026 [6] [QRCodeSetupPayloadGenerator.cpp](https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/QRCodeSetupPayloadGenerator.cpp) — Project CHIP connectedhomeip, accessed 2026 [7] [ManualSetupPayloadGenerator.cpp](https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/ManualSetupPayloadGenerator.cpp) — Project CHIP connectedhomeip, accessed 2026 [8] [SetupPayload.cpp](https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/SetupPayload.cpp) — Project CHIP connectedhomeip, accessed 2026 [9] [TestQRCode.cpp](https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/tests/TestQRCode.cpp) — Project CHIP connectedhomeip, accessed 2026 [10] [PairingCodeSchema.ts](https://raw.githubusercontent.com/matter-js/matter.js/main/packages/types/src/schema/PairingCodeSchema.ts) — matter.js, accessed 2026 [11] [Intent-based Commissioning for Matter](https://developers.home.google.com/samples/intent-based-commissioning) — Google Home Developers, accessed 2026 [12] [Pair a Matter device](https://developers.home.google.com/matter/integration/pair) — Google Home Developers, accessed 2026 [13] [Matter support in iOS](https://developer.apple.com/apple-home/matter) — Apple Developer, accessed 2026 [14] [Matter Arrives](https://csa-iot.org/newsroom/matter-arrives/) — Connectivity Standards Alliance, 2022 [15] [The Zigbee Alliance Rebrands as Connectivity Standards Alliance](https://csa-iot.org/newsroom/connectivity-standards-alliance/) — Connectivity Standards Alliance, 2021 [16] [A Smarter Start: Matter 1.4.1 Makes Setup Easier](https://csa-iot.org/newsroom/a-smarter-start-matter-1-4-1-makes-setup-easier/) — Connectivity Standards Alliance, 2025 [17] [Matter 1.6 Enables More Intuitive Setup, Multi-Ecosystem Experiences, and Context-Driven Control](https://csa-iot.org/newsroom/matter-1-6-enables-more-intuitive-setup-multi-ecosystem-experiences-and-context-driven-control/) — Connectivity Standards Alliance, 2026 [18] [Specifications download](https://csa-iot.org/developer-resource/specifications-download-request/) — Connectivity Standards Alliance, accessed 2026 [19] [Matter (standard)](https://en.wikipedia.org/wiki/Matter_(standard)) — Wikipedia, accessed 2026 [20] [The Matter Specifications](https://handbook.buildwithmatter.com/specification) — Matter Handbook, accessed 2026 [21] [WiFi QR](https://docs.barcoder.ai/source/standards/wifi-qr) — Barcoder in-corpus report, 2026 [22] [Matter QR codes explained: What happens when you scan one?](https://www.matteralpha.com/explainer/how-does-matter-qr-code-work) — Matter Alpha, 2024 [23] [Matter QR Code: Base-38 Encoding Language](https://www.rfwireless-world.com/terminology/anatomy-of-matter-qr-code) — RF Wireless World, accessed 2026 [24] [What's the Matter? An In-Depth Security Analysis of the Matter Protocol](https://eprint.iacr.org/2025/1268) — IACR Cryptology ePrint Archive, 2025, revised 2026 [25] [Matter Security and Privacy Fundamentals](https://csa-iot.org/wp-content/uploads/2022/03/Matter_Security_and_Privacy_WP_March-2022.pdf) — Connectivity Standards Alliance, 2022 [26] [Inquiry regarding Manual Pairing Code length](https://devzone.nordicsemi.com/f/nordic-q-a/126960/inquiry-regarding-manual-pairing-code-length/562273) — Nordic DevZone, accessed 2026 [27] [Matter Setup Guides for Alexa, Google and Apple](https://www.tapo.com/us/faq/294/) — TP-Link Tapo (vendor), accessed 2026 [28] [Matter QR Code Generator](https://docs.espressif.com/projects/esp-test-tools/en/latest/esp32/production_stage/tools/matter_qr_code_generator.html) — Espressif, accessed 2026 [29] [Matter FAQs](https://csa-iot.org/all-solutions/matter/matter-faq/) — Connectivity Standards Alliance, accessed 2026 [30] [HomeKit QR Codes](https://github.com/stockhuman/HomeSpan/blob/master/docs/QRCodes.md) — HomeSpan documentation (third-party fork), accessed 2026 [31] [URI scheme registration: dpp](https://www.iana.org/assignments/uri-schemes/prov/dpp) — IANA, accessed 2026 [32] [Character Capacities by Version and Error Correction Level](https://www.thonky.com/qr-code-tutorial/character-capacities) — Thonky.com, accessed 2026 [33] [Alphanumeric Table](https://www.thonky.com/qr-code-tutorial/alphanumeric-table) — Thonky.com, accessed 2026 [34] [Setup payload Python tool README](https://raw.githubusercontent.com/project-chip/connectedhomeip/master/src/setup_payload/python/README.md) — Project CHIP connectedhomeip, accessed 2026 ## Deployments _No country reports mention this standard by name._ ## Regions / aggregations not mapped to a single country - Universal