The first QR code I ever printed did not work. It was for a client's product packaging — a link to a setup video — and the design team had made it look beautiful: brand purple on a slightly darker gray, no white margin, tucked neatly into a corner at about 12mm square. It scanned fine on the designer's monitor. On the printed box, under warehouse lighting, with a two-year-old Android phone, it scanned approximately never. We reprinted 4,000 boxes.
That mistake taught me more about QR codes than any documentation did. A QR code is not a logo; it is a data format with physical requirements. Contrast, quiet zone, module size, and error correction are not aesthetic preferences — they are the difference between a code that reads in 200 milliseconds and a code that makes a customer give up. I build toolz.dev, so when I needed a QR generator I could trust, I wrote the encoder myself rather than embedding a third-party widget, and shipped it as the QR Code Generator.
TL;DR: A QR code stores data directly in the image, so a static code never expires. Most free online generators give you a dynamic code that secretly points at their short link — which they can disable, meter, or monetize later. The QR Code Generator encodes URLs, WiFi, vCards, email, SMS, and phone numbers entirely in your browser, at any of the four error-correction levels, and exports SVG for print and PNG for screens. Nothing is uploaded, nothing expires, and there is no account.
What is a QR code, really?
A QR code is a two-dimensional barcode that stores bytes in a grid of black and white squares called modules. It was designed by Denso Wave in 1994 for tracking car parts, standardized as ISO/IEC 18004, and it is genuinely royalty-free — the patent exists, but Denso Wave chose not to enforce it, which is why QR codes appear on everything from restaurant menus to central bank payment systems.
The structure is more organized than it looks. The three big squares in the corners are finder patterns, and they are what a scanner locates first to work out where the code is and how it is rotated. The dotted lines running between them are timing patterns, which tell the scanner how wide one module is. The smaller squares scattered through the body are alignment patterns, used to correct for perspective when you photograph the code at an angle. Everything else is either data, error-correction bytes, or format information describing which error-correction level and mask pattern were used.
That last piece — masking — is the part most people never hear about. Raw encoded data often produces large blank areas or patterns that look like finder squares, and both confuse scanners. So the encoder XORs the data region against one of eight geometric mask patterns, scores each result against four penalty rules from the spec, and keeps the lowest-scoring one. It is a small optimization that quietly makes the difference between a code that scans instantly and one that hunts. Any generator worth using does this; the QR Code Generator implements all eight masks with proper penalty scoring, exactly as the standard describes.
The practical takeaway: a QR code is a self-contained data structure. The information lives inside the picture. Once it is printed, no server on earth is involved in decoding it.
What is the difference between static and dynamic QR codes?
This is the single most important thing to understand before you use any free QR generator, and almost none of them explain it.
A static QR code encodes your data directly. If you encode https://toolz.dev/tools/qr-generator, the modules literally spell out that URL. A scanner reads the bytes and opens the link. There is no intermediary, no account, and no way for anyone to switch it off. It works in 2026 and it will work in 2046.
A dynamic QR code encodes a short link belonging to the generator — something like https://qr-svc.example/x7Kp2 — which redirects to your real destination. The pitch is that you can change the destination later and see scan analytics. The catch is that your printed code now depends permanently on a third party's server staying online, staying free, and staying in business. Plenty of people have discovered this the hard way: the "free" code they printed on 10,000 flyers starts showing a "your trial has expired, upgrade to reactivate" page, and the only fix is a reprint. That business model exists specifically because your code is hostage.
Here is how the two compare on the things that actually matter:
| Static QR code | Dynamic QR code | |
|---|---|---|
| Where the data lives | Inside the image | On the provider's server |
| Expires | Never | When the provider says so |
| Destination editable after printing | No | Yes |
| Scan analytics | None | Yes, via the provider |
| Requires an account | No | Almost always |
| Privacy | Scanner sees only your URL | Provider logs every scan |
| Code density | Depends on payload length | Always short (the short link) |
| Works if the provider disappears | Yes | No |
Dynamic codes have one legitimate advantage: for a physical campaign where the destination genuinely might change, editability is worth something. But you should get that from a redirect you control — a short path on your own domain that you can repoint at will — not from a free service that can hold it ransom. Encode yoursite.com/go/menu as a static code, and you have editability and independence at the same time.
Everything produced by the QR Code Generator is static, by design. There is no server in the loop to expire anything.
How do I make a QR code that scans reliably?
Five things determine whether a code reads on the first try. In rough order of how often they get botched:
Contrast. Dark modules must be genuinely dark against a genuinely light background. Scanners binarize the image before decoding — every pixel becomes black or white — and low-contrast color pairs land ambiguously. Dark navy on white is safe. Mid-gray on light gray is not. If you must brand the code, tint the dark modules and keep the background white or near-white.
Do not invert. Light modules on a dark background works in about 70% of scanner apps and fails in the rest, because many decoders assume dark-on-light and never try the inverse. It looks great in a dark-mode mockup and disappoints in the real world.
Quiet zone. The spec requires a light margin of four modules on all sides. This is not decoration; it is how the scanner distinguishes the code from surrounding artwork. Crop it tight against a photo or a colored panel and detection rates fall off a cliff. The QR Code Generator defaults to a four-module margin and lets you widen it.
Physical size. The rule of thumb from the industry is that the code's width should be at least one-tenth of the intended scanning distance. Scanning from 30 cm (a menu on a table) means at least 3 cm of code. A poster read from 3 meters needs 30 cm. Below roughly 2 cm printed, cheap camera modules struggle regardless of how good your encoder is.
Payload length. Every extra character adds modules. A 30-character URL might produce a 29×29 grid; a 300-character one balloons to 69×69, and each module gets tiny at the same physical size. Shorten your URLs. Strip the UTM parameters, or move them behind a redirect. This is the cheapest reliability win available, and it is free — use the Slug Generator to keep the URL path itself short and clean.
Test on at least three phones, including an old cheap Android, before committing to print. Screen tests are not print tests.
What error correction level should I choose?
QR codes carry Reed-Solomon error-correction bytes, which let a scanner reconstruct the payload even when part of the code is unreadable — smudged, torn, glared, or covered. You choose how much redundancy to include:
| Level | Recovers about | Good for |
|---|---|---|
| L (Low) | 7% | Clean digital display, maximum data in minimum modules |
| M (Medium) | 15% | The sensible default: screens and clean print |
| Q (Quartile) | 25% | Industrial, outdoor, curved, or small print |
| H (High) | 30% | Codes with a logo on top, or harsh environments |
The trade-off is density. Redundant bytes take up space, so at a fixed payload, level H needs more modules than level L — which means either a bigger printed code or smaller modules. Cranking every code to H "for safety" can backfire: you end up with a denser code that is harder to scan at the same physical size.
The one case where H is non-negotiable is a logo in the middle. That trick works precisely because error correction can reconstruct the modules your logo covers. Keep the logo centered, keep it under roughly 25–30% of the code area, and never let it touch the finder patterns in the corners. Export the SVG from the QR Code Generator at level H, place your logo on top in a design tool, and then — this part is mandatory — scan the composite with several phones before you ship it.
What can you encode besides a URL?
A QR code holds bytes, and phone cameras recognize several conventional text formats and act on them. The formats are simple; the escaping is where people trip.
WiFi credentials. The payload looks like WIFI:T:WPA;S:MyNetwork;P:mypassword;;. Scan it and the phone offers to join the network — no typing a 24-character password out loud to a guest. The gotcha is escaping: if your SSID or password contains a semicolon, comma, colon, quote, or backslash, those characters must be backslash-escaped or the payload parses wrong and the join silently fails. The QR Code Generator handles that escaping automatically, which is more than can be said for a lot of generators that just string-concatenate your input.
Contact cards. A vCard payload (BEGIN:VCARD … END:VCARD) puts your name, company, phone, email, and website into one code, and a scan offers to save the contact. It is the closest thing to a business card that still makes sense, and unlike a "smart" NFC card there is no vendor account behind it. vCards run long, so expect a denser code — print it bigger than you think.
Email, SMS, and phone. mailto:, SMSTO:, and tel: payloads pre-fill a message or dial a number. Useful for support posters and event signage where you want to remove the friction of typing an address correctly.
Plain text. Serial numbers, coupon codes, asset tags, WiFi guest instructions, a short note. No scheme, no action — the phone just shows the text.
If you are encoding structured data of your own, remember the encoder writes UTF-8 bytes, so accented characters, non-Latin scripts, and emoji all survive intact. They cost more bytes than ASCII, though: an emoji is four bytes where a letter is one. If you are curious how that byte math works, the Binary Translator shows the UTF-8 encoding of any string directly.
Should I export SVG or PNG?
Use SVG for anything that gets printed. It is a vector: the modules are described as shapes, not pixels, so the code stays perfectly crisp whether it lands on a business card or a bus shelter. Printers prefer it, designers can drop a logo on it, and it will never show the soft-edged blur that kills scan reliability when a low-resolution raster is scaled up.
Use PNG for screens — websites, slide decks, emails, documentation. Export at a generous size (512px or more) and let the layout scale it down; a code that is upsampled from 128px will have fuzzy module edges, and fuzzy edges are exactly what scanners struggle to binarize.
One rendering detail matters in both formats: turn off anti-aliasing or image smoothing if you have the choice. Sharp, square modules decode better than softly blended ones. The SVG the QR Code Generator emits sets shape-rendering="crispEdges" for exactly this reason, and its PNG export disables canvas image smoothing.
How much data fits in a QR code?
The theoretical maximum in byte mode is 2,953 bytes at version 40 with error-correction level L — roughly 2,900 characters of plain ASCII. You will almost never want to go near it.
QR codes come in 40 versions, from 21×21 modules (version 1) up to 177×177 (version 40), growing by 4 modules per side each step. The version is chosen automatically from your payload length and error-correction level; you never pick it directly. What you feel is the consequence: a 20-character URL at level M lands in version 2 or 3 — a chunky, forgiving grid that scans across a room. A 500-character payload at level H lands somewhere in the twenties, producing a dense thicket of modules that needs excellent print quality and a close, steady camera.
So the practical ceiling is not 2,953 bytes; it is however much data still leaves modules big enough to photograph at your intended distance. My working rule: keep URL payloads under about 100 characters, and if a vCard pushes past 300, print it at least 4 cm wide. The QR Code Generator shows the chosen version, the module count, and how full the code is as a percentage, so you can watch the density climb as you type and cut the payload before it becomes a problem.
Why does a QR code fail to scan?
When someone tells me a code "doesn't work," it is nearly always one of these, in this order:
- No quiet zone. The code was cropped flush against artwork or a colored background.
- Bad contrast or inversion. Brand colors chosen for looks, or a light-on-dark scheme.
- Printed too small for the distance people are actually standing at.
- Density too high — a long URL with tracking parameters, or an over-stuffed vCard.
- Glare or curvature — laminated menus and bottles reflect light straight into the lens. Matte finishes and higher error correction help.
- A logo that ate the finder pattern. The corners are not negotiable.
Notice that none of these is "the encoder produced an invalid code." Generation is a solved problem; the failures are physical. Which is why testing on real hardware, at real size, under real lighting, is worth more than any amount of care in the generator.
Is it safe to use a free online QR generator?
It depends entirely on what you are encoding and where the encoding happens.
Think about what goes into a WiFi QR code: your network name and your password, in plaintext. If the generator sends that to a server to render the image, you have just emailed your WiFi password to a stranger. The same applies to a vCard with a personal phone number, or a URL to an unlisted internal document. Most free QR sites do the encoding server-side, and their privacy policies are typically vague about retention.
The QR Code Generator runs the whole encoder — UTF-8 conversion, Reed-Solomon error correction, mask selection, rendering — in JavaScript in your browser. There is no upload, no request, nothing to log. Open the network tab and watch: after the page loads, generating a code makes zero requests. Load the page once and you can pull the network cable and it still works. That is the same principle behind every tool on the site, and it is the whole argument in why browser-based tools are safer than upload-based ones.
The second safety question runs the other direction: as a scanner, treat QR codes like links from strangers, because that is what they are. "Quishing" — malicious codes stuck over legitimate ones on parking meters, restaurant tables, and EV chargers — is now common enough that the FTC has issued consumer warnings about it. Check the URL your phone previews before you tap, and be suspicious of any code that leads straight to a login or payment form.
Common use cases
Restaurant and venue menus. Static code, level M, printed at 3–4 cm on a matte card. Point it at a page you control, not at a menu-hosting service's URL that might change.
WiFi for guests and offices. Print the WiFi code on a small card by the door. Rotate the password and reprint — takes two minutes, and it means you never say a password out loud again.
Conference badges and business cards. vCard payloads at level Q or H. People scan the badge and the contact lands in their phone with no typing and no app.
Product packaging and manuals. Link to setup videos, warranty registration, or documentation. This is where reliability matters most because reprinting is expensive — go level Q, leave a generous quiet zone, and test on old phones.
Internal tooling. Asset tags, server-rack labels, deployment runbook links. Plain text or a short internal URL, printed on a label. Cheap, permanent, and no vendor involved.
Event tickets and check-in. Encode an opaque ID, not personal data. The code should be a key that your system looks up, not a payload that leaks a name and email to anyone who scans it in someone's hand.
If you are assembling a general kit of browser-based tools for work like this, I wrote up the ones I actually keep pinned in the web developer's toolkit — the QR generator sits alongside the UUID Generator and the Meta Tag Generator in the same daily rotation.
FAQ
Do QR codes expire?
Static QR codes never expire. The data is encoded directly in the image, so there is no server in the loop that could stop responding. Dynamic QR codes — the kind most free generators produce — encode a short link owned by the provider, and those can and do stop working when a trial ends or a company shuts down. Every code from the QR Code Generator is static.
What error correction level should I use for a printed QR code?
Level M is the right default for clean print and screens. Move up to Q for small print, curved surfaces, outdoor exposure, or anything likely to get scuffed. Use H only when you are placing a logo over the center of the code, since the extra redundancy is what allows the covered modules to be reconstructed. Higher levels make the code denser, so do not raise the level without also giving the code more physical space.
How do I create a WiFi QR code?
Choose the WiFi preset, enter your network name (SSID) and password, and pick the security type — WPA/WPA2 for nearly all modern networks. The tool builds the standard WIFI: payload and escapes any semicolons, commas, or quotes in your credentials, which is where hand-built payloads usually break. Guests point their camera at it and get a prompt to join the network without typing anything.
Can I put a logo in the middle of a QR code?
Yes, if you generate at error correction level H and keep the logo centered and under roughly 25–30% of the code's area. Never let it overlap the three finder squares in the corners, since those are what the scanner uses to locate the code at all. Export the SVG, composite your logo on top in a design tool, then test the result on several different phones before you print anything.
How much data can a QR code hold?
The maximum is 2,953 bytes in byte mode at error correction level L, which is around 2,900 ASCII characters. In practice you want far less: longer payloads produce more modules, and more modules means each one is physically smaller at the same print size, which makes the code harder to scan from a distance. Keeping URLs under about 100 characters keeps the code comfortably readable.
Why won't my QR code scan?
The usual causes are physical, not technical: too little contrast between the dark and light modules, an inverted light-on-dark color scheme, a missing or cropped quiet zone (the four-module light margin), printing too small for the distance people scan from, or a payload so long that the modules became tiny. Fix those in that order — they account for nearly every failed scan I have ever debugged.
Is SVG or PNG better for QR codes?
SVG is better for anything printed, because it is a vector and stays perfectly sharp at any size, from a business card to a billboard. PNG is more convenient for screens — websites, slide decks, email — where a fixed-pixel image is easier to drop in. Export the PNG at a generous size and scale it down rather than up, since upscaling blurs the module edges that scanners depend on.
Are QR codes free to use commercially?
Yes. The QR Code standard is published as ISO/IEC 18004 and is royalty-free in practice — Denso Wave holds the original patent but has never enforced it, which is exactly why the format became universal. Codes generated here carry no watermark, no attribution requirement, and no usage limit, so you can put them on products, packaging, menus, and advertising freely.
Is my WiFi password uploaded when I generate the code?
No. The entire encoder runs in JavaScript in your browser — UTF-8 conversion, Reed-Solomon error correction, mask selection, and rendering all happen locally. Nothing is transmitted to a server, nothing is logged, and once the page has loaded the tool keeps working with the network disconnected. That matters most for WiFi and vCard codes, which contain credentials and personal details in plaintext.
