Guide
QR codes: what they encode and when not to scan one
A QR code is just a payload in a square. URLs, Wi-Fi strings, and text all work — so do phishing links. Encode short data, print large enough, and scan with care.
Updated 2026-08-17
It is a file, not a website
A QR code stores a short payload: a URL, a block of text, a Wi-Fi credential string, a phone number. The pattern is the data. There is no “QR account” that can expire the square later unless you encoded a URL that you later take down. Static codes that contain a URL keep working as long as that URL works.
Capacity is limited. A few thousand characters is the theoretical max; scanners and printed size fight you long before that. Short HTTPS links work. An entire vCard with a photograph does not belong in a 2 cm sticker.
Print size and error correction
QR codes include error-correction so a bit of damage or a logo still scans. Higher correction makes a denser pattern, which needs more pixels on the page. If a code fails in the wild, the usual causes are: printed too small, stretched, low contrast, or the phone is too close to a glossy poster.
Generate a PNG at a sensible pixel size, keep quiet space around the square, and test with more than one phone camera. Do not squash a square into a rectangle “to fit the banner.”
When not to scan one
A sticker on a parking meter or a flyer on a campus lamp can point anywhere. The phone will open whatever URL is inside. Prefer a camera app that shows the URL before visiting. Do not scan codes that promise prizes, crypto, or remote support from someone you do not know.
Encoding is not encryption. Anyone who photographs your posted Wi-Fi QR learns the password. Anyone who inspects a code that contains a session URL gets that URL. Put only data you would print in large type.
Generating a code in the browser
Paste the URL or text, wait for the square to redraw, download the image. There is no tracking pixel in a static QR you generate here — the payload is exactly what you typed. If you need analytics on scans, that lives on the destination website (a short link you control), not inside the pattern.
Re-print after you change the destination. A static code cannot be “updated in place.” Dynamic codes from commercial platforms are just short URLs plus a redirect you pay to keep.
Related tool: QR Code Generator