Which QR code generator can you trust?

Why it is worth a look

A QR code is made in seconds and used for years. It ends up on the menu, in the shop window, on the company van or on a thousand flyers. Whether it still works there in two years, who reads along with every scan and what happens to what you type in is decided when you create the code, not when you print it.

The good news: a trustworthy generator can be spotted in a few minutes. You need no expertise, just a phone, and a computer for one of the questions. Each of the seven questions below comes with a test that takes about 30 seconds. There is deliberately no list of providers here. It would be out of date with the next price change, while the questions stay valid.

1. Does the code contain your destination or someone else’s address?

This is the most important question. With a static code, your address sits in the pattern itself, such as https://example.com/menu. With a dynamic code, it holds a short address belonging to the provider, and every scan goes through their server. Whether the code works is then up to them. How that model works is covered in detail in Dynamic QR codes: when the free code needs a subscription.

The test: Create a code with your own address, download it and scan it with your camera app. Before the phone opens the page, it shows the address. If it is your domain, all is well. If it is a short address you don’t recognise, it is a dynamic code. A good sign is a generator that shows the encoded content right below the preview.

2. Do you get usable files without an account?

Once a static code has been generated, it costs the provider nothing more. If they still want an account or your email address before handing over the file, they are after something else: a contact for later offers or a path into a subscription. For print you also need a vector format such as SVG, EPS or PDF. A small PNG is fine on screen, but turns blurry on a poster.

The test: Create a code and click download. Do you get the file, or a sign-up window? Is there a vector format, and is there a logo or watermark of the provider in or next to the code that you didn’t ask for?

3. Does the code expire after a trial period?

“Free” does not always mean “free for good”. Some offers are only free for a trial period of a few days or weeks. After that, the printed code leads to a notice page until someone pays. A static code cannot expire at all: there is nothing that could be switched off.

The test: Open the pricing page and the terms of use and search with Ctrl+F (on a Mac ⌘+F) for “trial”, “term”, “expire” and “deactivated”. If there are subscriptions for dynamic codes and the free route is not clearly labelled “static”, be careful.

4. Where is the code made: in your browser or on a server?

A QR code sometimes holds more than a link: the Wi-Fi password, the mobile number on the contact card, the IBAN for a bank transfer. If a server calculates the code, those details go there. That need not be a disaster, but it is not necessary either. A browser can calculate any QR code on its own.

The test: Open the generator, then switch off Wi-Fi or put your phone into flight mode and keep typing. If the preview keeps updating, your device is doing the work. If an error appears or the preview freezes, every entry travels over the network.

5. What does the page load before you consent?

Almost every site shows a consent window. Whether it is meant seriously shows in what loads before you answer it. Advertising and analytics services run by other companies should only start after you click “Accept”, not before.

The test: Open the page on a computer in a private window, bring up the developer tools (F12, on a Mac ⌥+⌘+I) and switch to the “Network” tab. Reload the page and don’t click anything in the consent window. Look at the domains in the list. The site’s own server and the consent window belong there. If ad networks and the trackers of big platforms show up as well, the operator is not taking your consent seriously.

6. Is there a legal notice with a postal address?

If a code stops working or a charge appears that you did not expect, you want to know who you are dealing with. In Germany, commercial websites must publish a legal notice, the Impressum, with a name and address. With providers elsewhere, too, it should be clear who is behind the site and where.

The test: Scroll right to the bottom and open the legal notice or company details. Is there a name with an address you could send a letter to? Or just a contact form and no name?

7. Are statistics switched on by default?

Counting scans sounds handy. But it only works with a redirect through the provider’s server, in other words with a dynamic code. If statistics are on by default, you get a dynamic code without having chosen one. And whoever scans your code is then recorded by the provider, not by you.

The test: Look at the form before you click create. Is there a switch for “dynamic” and “static”, for “tracking” or “statistics”? What is preselected? And can you make a static code without an account at all?

The seven questions at a glance

Not every question carries the same weight. For anything that goes to print, the first and the third are decisive: if the code holds someone else’s address or expires, it does not belong on a sign. The other questions tell you how the provider treats you and your data.

If you want to be able to change the destination later, you don’t need a dynamic code for that. A short address on your own domain does the same job and stays in your hands. How that works is explained in the section The alternative: changeable, but in your hands. And if you are the one scanning, the article Quishing: how to spot fake QR codes has the matching checks for the other side.

And qrmacher.de?

The questions apply to us too. This is how things stand here:

1. The code contains your destination. Below the preview you see the encoded content, exactly what is in the pattern.
2. You download PNG, SVG, PDF and EPS without an account and without a watermark.
3. The codes are static and never expire, not even if this site should disappear one day.
4. The code is made in your browser. You can try the flight mode test right here.
5. Before consent, the page loads its own files, the Usercentrics consent window and our audience measurement with Matomo. It runs on our own servers in the EU, without cookies, and in the generator it only counts the kind of code, the file format and whether a logo or frame was chosen, never the content. Ads from Google only load once you agree.
6. Name and address are in the legal notice.
7. There are no scan statistics, because no server sits between the code and its destination.

Feel free to check up on us: the tests above work here just as they do anywhere else. Who is behind the site and how it is funded is on the About qrmacher.de page.