How QR codes work (and why "static" matters)
A QR code is a two-dimensional grid of modules — the black and white squares you see in the pattern. The camera reads the arrangement of those modules to recover the original data (a URL, contact card, Wi-Fi string, and so on). The ISO standard defines versions 1 through 40: each step up uses a larger grid and can store more data. When you add characters, the encoder often moves to a higher version, which is why the same style of code can look "busier" as the payload grows.
Error correction adds redundant information so a partially damaged, dirty, or covered code can still decode. Levels are often labeled L, M, Q, and H (roughly 7% through 30% recovery). Higher correction makes the pattern denser but tolerates more abuse — including a logo in the middle if you keep the logo size modest.
A static QR code embeds your destination or payload directly. What you encode is what every scan sees, today or in ten years, with no company in the middle. A dynamic code, by contrast, usually encodes a short link that points to someone else's server; that server decides where to send the user and can log every scan. That is useful for analytics and for changing a destination after print — but it means you depend on that service staying online, honest, and affordable for as long as your stickers and posters last. This tool is static-only: the pattern is the message, not a pointer we can rewrite later.
The 12 QR code types, explained
URL — The most common use: open a website, landing page, or deep link. Put one on a poster, product card, or table tent so people can open your page without typing.
Plain text — Encodes a short message or code (coupon text, stock ID, instructions). Handy when you do not want a network round trip; the scanner just shows the string.
Email — Opens the user's mail app with a pre-filled recipient and optional subject and body. Use for support addresses, press contacts, or feedback lines on packaging.
Phone — Starts a voice call to the number you specify. Event hotlines, doctor offices, and "call us" campaigns use this to avoid mis-dialed digits.
SMS — Opens a text to a number, optionally with a pre-written message. Common for short codes, opt-ins, and "text KEYWORD to …" style campaigns.
WiFi — Joins a network from the scan: guests at cafés, short-term rentals, and small offices use it so visitors never
see a password written on a sticky note. The payload follows the standard WIFI:… format.
vCard — Bundles contact fields (name, org, phone, email) for one-tap "add to contacts." Networking events, business cards, and lanyard badges are typical use cases.
WhatsApp — Starts a chat with your business number, optionally with opening text. Widely used for customer support in India, Brazil, and other markets where WhatsApp is the default channel.
UPI (India) — Encodes the upi://pay link so GPay, PhonePe, Paytm, BHIM, and bank apps can show a pay screen.
Street vendors, drivers, and small shops use these for real-time bank transfers.
Location (geo) — Opens maps at latitude and longitude, sometimes with a label. Useful for venue doors, trailheads, and "we are here" print on event flyers.
Calendar event — Carries a vEvent block so the phone can add a meeting or party to the calendar in one step. Good for wedding save-the-dates, meetups, and training sessions.
App / store link — Encodes a direct app store or your own landing URL. Many teams use a single HTTPS landing page that detects iOS vs Android; the QR always points to that one stable link.
Why browser-based generation matters
Government and law-enforcement advisories have repeatedly warned consumers about malicious QR codes: the US Federal Trade Commission (FTC) has published consumer alerts (including in 2023 and 2025) on QR-related scams and "quishing," and the FBI Internet Crime Complaint Center has highlighted risks from tampered or deceptive codes. These are public warnings about a real attack pattern: a code that looks legitimate but points somewhere harmful.
A separate, industry-wide issue affects legitimate free tools: some dynamic QR services encode a short redirect that runs on their domain, not yours. The printed code does not point to your final URL; it points to that service. If the company changes pricing, turns off a free tier, is acquired, or shuts down, your physical materials can stop working, send people somewhere else, or break in ways you cannot fix without reprinting. The comparison is structural, not a dig at any one brand — it is how redirect-based products are built.
Browser-based static generation (what you do here) never sends your Wi-Fi password, vCard, or UPI string to DoItSwift for encoding. The pattern is built from your input on your device. You can load the page once, disconnect from the network in DevTools, and still generate a code: nothing in that workflow requires a server to see your payload. That is the privacy and longevity model static codes are meant to offer.
Design tips: logo size, contrast, and error correction
Error correction and logos: At higher levels (especially Q and H), the standard allows roughly a quarter to nearly a third of the code to be obscured and still decode — which is how centered logos are possible. If you add a large image, increase correction and keep the logo small relative to the full square.
Size rule of thumb: keep the logo under about 30% of the QR width. Bigger is not always better: scanners need enough module contrast around the eyes and data area.
Contrast: the foreground (modules) should be clearly darker than the background. Inverting to light-on-dark can fail on many phone cameras. For logos, a light or white box behind a colored mark usually scans more reliably than a full-bleed dark block.
Printing tips
For a typical marketing URL, aim for a printed code at least about 2 × 2 cm (roughly 0.8 in) in quiet conditions; dense payloads (long URLs, vCards) often need about 3 × 3 cm or larger to scan comfortably on first try.
Export SVG or high-resolution PNG (e.g. 1024 or 2048 px) and send to print at 300 DPI or higher for small formats. Before you print 5,000 stickers, print one at final size, walk across the room, and scan with an ordinary phone — that single test saves more money than it costs.
Leave a quiet zone (blank margin) of at least a few modules around the pattern. Glossy lamination, foil, and strong glare from spot lighting are common real-world reasons a perfect on-screen code fails in the wild; matte stock and diffused light help.
How this approach compares to typical free QR generators
Free QR generators fall into a few broad categories — server-based generators, freemium dynamic-QR platforms, and browser-based tools like this one. Each involves different trade-offs around privacy, longevity, and cost. The comparison below focuses on the trade-offs themselves, not on any specific product.
| Capability | Browser-based generators (like this tool) | Server-based free generators | Freemium dynamic-QR services |
|---|---|---|---|
| Where generation happens | In your browser | On the provider's servers | On the provider's servers |
| Works offline after first load | Yes | No | No |
| Your data touches a third party | No | Yes, during generation | Yes, continuously (scan traffic redirects through the provider) |
| Codes expire after a trial period | No — static codes are permanent | Usually no | Often yes (14-day trials are common) |
| Signup required for full features | No | Usually no | Yes |
| Bulk CSV import with full design customization | Yes (here) | Rarely on free tiers | Usually paid |
| Dynamic URL editing and scan analytics | No — static only, by design | Usually no | Yes (paid) |
| Logo embedding on the free tier | Yes | Varies | Varies |
| Shape and gradient customization | Yes | Varies | Yes |
| SVG / print-quality vector export | Yes | Varies | Usually paid |
| On-page ads | None | Often | Often |
| Tracking and analytics on the tool page | Minimal (page analytics only) | Varies | Varies |
This comparison describes common trade-offs across broad categories of free QR tools. Policies, pricing, and feature sets change; try any tool yourself before committing to production print runs.
Static-only, on purpose
If you need to change the destination after a poster is live, or you need scan counts and funnels per campaign, you are asking for a hosted redirect product with a real backend. Those products exist, many are paid, and that is not a failing — it is a different architecture. This page does not try to be that.
What we do instead: static codes. The data you type (or your CSV) is what gets encoded. The PNG, SVG, or ZIP you download is yours. No middle layer has to keep working for your museum label or shop window to stay valid. For many use cases — Wi-Fi at a rental, a menu link, a vCard, a UPI payee, a one-off event — that simplicity is the whole point.
Reviewed by DoItSwift Editorial. This tool uses the open-source qr-code-styling library
(MIT license) for all rendering. All generation happens in your browser; no QR content is transmitted to DoItSwift
or any third party. Information on QR code security risks references public warnings from the
US Federal Trade Commission
and the
FBI Internet Crime Complaint Center.