diff --git a/pjcloud-integrated/pjcloud-integrated-biz/src/main/java/com/bsd/pjcloud/integrated/controller/AppVisitorController.java b/pjcloud-integrated/pjcloud-integrated-biz/src/main/java/com/bsd/pjcloud/integrated/controller/AppVisitorController.java
index 7abc6b0a6..3e979fc5a 100644
--- a/pjcloud-integrated/pjcloud-integrated-biz/src/main/java/com/bsd/pjcloud/integrated/controller/AppVisitorController.java
+++ b/pjcloud-integrated/pjcloud-integrated-biz/src/main/java/com/bsd/pjcloud/integrated/controller/AppVisitorController.java
@@ -1,7 +1,5 @@
 package com.bsd.pjcloud.integrated.controller;
 
-import cn.hutool.core.util.StrUtil;
-import cn.hutool.jwt.JWT;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.toolkit.Wrappers;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
@@ -40,6 +38,9 @@ import java.util.Map;
 import cn.hutool.extra.qrcode.QrConfig;
 import java.awt.Image;
 import cn.hutool.core.img.ImgUtil;
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.util.Base64;
 
 /**
  * 访客用户
@@ -147,8 +148,20 @@ public class AppVisitorController {
 
         // 2. 生成动态部分（每5分钟变化一次）
         long now5Min = System.currentTimeMillis() / (1000 * 60 * 5);
-        String secret = visitorQrSecret; // 从yml读取
-        String sign = cn.hutool.crypto.SecureUtil.hmacSha256(secret).digestHex(token + now5Min);
+        String sign;
+        try {
+            Mac mac = Mac.getInstance("HmacSHA256");
+            SecretKeySpec secretKeySpec = new SecretKeySpec(visitorQrSecret.getBytes(), "HmacSHA256");
+            mac.init(secretKeySpec);
+            byte[] hash = mac.doFinal((token + now5Min).getBytes());
+            StringBuilder sb = new StringBuilder();
+            for (byte b : hash) {
+                sb.append(String.format("%02x", b));
+            }
+            sign = sb.toString();
+        } catch (Exception e) {
+            return R.failed("二维码签名生成失败");
+        }
 
         // 3. 二维码内容
         String qrContent = token + ":" + now5Min + ":" + sign;
@@ -191,7 +204,20 @@ public class AppVisitorController {
         String now5Min = parts[1];
         String sign = parts[2];
         // 1. 校验签名
-        String expectSign = cn.hutool.crypto.SecureUtil.hmacSha256(visitorQrSecret).digestHex(token + now5Min);
+        String expectSign;
+        try {
+            Mac mac = Mac.getInstance("HmacSHA256");
+            SecretKeySpec secretKeySpec = new SecretKeySpec(visitorQrSecret.getBytes(), "HmacSHA256");
+            mac.init(secretKeySpec);
+            byte[] hash = mac.doFinal((token + now5Min).getBytes());
+            StringBuilder sb = new StringBuilder();
+            for (byte b : hash) {
+                sb.append(String.format("%02x", b));
+            }
+            expectSign = sb.toString();
+        } catch (Exception e) {
+            return R.failed("二维码签名验证失败");
+        }
         if (!expectSign.equals(sign)) {
             return R.failed("二维码签名无效");
         }