Category: QR Code Basics

Short answer: static QR codes never expire. But there’s a catch – it depends on the type of QR code. Here’s the full picture.

Static vs Dynamic QR Codes

Static QR codes: last forever

A static QR code has its content encoded directly in the pattern – the URL, text, or WiFi credentials are literally inside those black squares. There’s no server involved when someone scans it, so there’s nothing to expire, no subscription to lapse, no company that can shut it down. Every QR code generated with QRVelto is static – it will scan correctly ten years from now, as long as the destination (your link, your WiFi password) still exists.

Dynamic QR codes: it depends

A dynamic QR code contains a short redirect link hosted by a service. Scanning it hits that service first, which then forwards to your real destination. The advantage: you can change the destination later without reprinting. The risk: if you stop paying for the service – or the service shuts down – your QR code dies.

When Does a Static QR Code “Stop Working”?

The code itself never expires, but it can break if:

• The linked page is deleted. A QR code pointing to a removed URL leads nowhere.
• Your WiFi password changes. A WiFi QR code encodes the old password – generate a new one.
• It’s printed too small or damaged. Physical damage, not expiry, is the usual killer. Keep good contrast and a quiet margin around the code.

Which Should You Choose?

Static: never expires, can’t change destination later, free, best for menus, WiFi, business cards, anything permanent. Dynamic: expires when subscription/service ends, changeable destination, usually paid, best for marketing campaigns needing editability. For most everyday uses – restaurant menus, WiFi sharing, business cards – static is the right call: free, permanent, private.

FAQ

Q: Will my QRVelto QR code work in 5 years? A: Yes. It’s static – no expiry, no account needed.

Q: Can someone else’s QR code expire on me? A: If it was made with a dynamic-code service whose subscription lapsed, yes. That’s a property of the service, not of QR codes in general.

Q: Do I need to pay to keep my QR code alive? A: Not with static codes. Never.

Generate a permanent code now: Free QR Code Generator – no sign-up, no expiry.

Summary: A clear-eyed look at QR code security risks, phishing via malicious codes, safe scanning habits, and how browser-based generation protects your data.

Q: Can a QR code give my phone a virus?

A: A QR code is data — it cannot directly execute code or install software. The risk comes from the content it encodes. If the code opens a malicious website that exploits a browser vulnerability, that site could theoretically deliver malware. Keeping your phone’s operating system and browser updated reduces this risk significantly.

Q: How do I know if a QR code is safe before scanning?

A: Most modern phone cameras show a URL preview before you tap to open it. Inspect that URL carefully: look for the correct domain name, check for HTTPS, and be suspicious of URL shorteners that hide the final destination. If anything looks wrong, do not tap.

Q: Is QRVelto safe to use?

A: Yes. QRVelto generates QR codes entirely in your browser using the open-source qrcode library. Nothing you enter — URLs, Wi-Fi passwords, contact details — is transmitted to a server or stored anywhere. The code is produced locally and downloaded directly to your device.

Q: Can someone track me through a QR code I scan?

A: If the QR code links to a standard URL, the website owner can log your visit just as they would any other web session — including your approximate location derived from IP address. A URL-only QR code does not grant the code creator any special tracking access beyond normal web analytics.

Q: Are QR codes GDPR-compliant?

A: The QR code itself is just a format. GDPR compliance depends on what happens after the scan. If the destination page collects personal data (email, location, etc.), standard GDPR obligations apply to that data collection. Generating a static QR code that links to a URL does not, by itself, involve any personal data processing.

QR codes are as safe or as dangerous as the content they encode. The pattern itself is just a carrier — the equivalent of a hyperlink. But because you cannot read a QR code the way you can read printed text, the security calculus is different from ordinary links. This guide explains the real risks, the threat models worth taking seriously, and the habits that protect both the people who scan codes and the businesses that create them.

How security risks arise from QR codes

A QR code can encode any string of characters: a URL, a phone number, a Wi-Fi password, a payment instruction, or raw text. The scanning device interprets that string and offers to act on it — open the URL, dial the number, connect to the network. The security risk is entirely determined by what the code encodes, not by the code format itself.

The two categories of risk worth understanding are:

• Content-based risk: The code links to a malicious website, a phishing page, or a command that performs an unintended action (launching a payment, sending an email, connecting to a rogue Wi-Fi network).
• Tampered code risk: A legitimate QR code has been physically covered with a sticker containing a different code, or a digital code image has been replaced with a lookalike that points to a different destination.

Both risks are real, both are preventable, and neither requires any technical understanding of QR encoding to defend against.

QR code phishing (quishing)

Quishing is phishing that uses a QR code instead of a hyperlink to deliver the malicious URL. It appeared in volume around 2022–2023, primarily in email-based attacks, because QR codes in email body images bypass most URL-scanning security filters that would flag a plain hyperlink.

A quishing email typically presents an urgent scenario — “your account requires verification”, “a new document is ready to sign”, “your package could not be delivered” — and asks you to scan a QR code to resolve it. The code opens a convincing fake login page for Microsoft, Google, a bank, or another trusted service. Credentials entered on that page are sent directly to the attacker.

The same technique appears in physical environments: stickers placed over legitimate codes in parking metres, restaurant menus, and public signage. The attacker replaces a code that opens a benign page with one that opens a payment page or phishing site.

How to scan QR codes safely

Developing a few consistent habits before tapping makes QR code scanning substantially safer:

Preview the URL before opening it

Modern iPhone and Android cameras display a banner showing the URL or action the code encodes before you open it. Read that preview. Check that the domain name is what you expect — yourbank.com not yourbank-secure.net. Be especially cautious of URL shorteners (bit.ly, tinyurl, and similar services) that hide the actual destination.

Check the physical code

In public spaces, look at the label area around the code. If the code appears to be a sticker placed over a printed surface, treat that as a red flag. Legitimate QR codes in restaurants, parking metres, and government signage are printed directly onto the material or protected behind laminate — not applied as a separate label.

Avoid scanning codes from unknown senders

QR codes in unsolicited emails, text messages, and social media posts should be treated with the same scepticism as unsolicited links. The urgency framing that makes phishing emails effective works equally well with quishing emails.

Keep your phone updated

The worst-case scenario — a malicious website exploiting a browser vulnerability to deliver code — depends on a known, unpatched security flaw. Keeping your operating system and browser on their latest versions closes the vast majority of known exploit paths.

How to generate QR codes safely

If you are creating QR codes for others to scan, the security responsibilities shift to your side of the transaction. The key considerations are:

Use a generator that does not store your data

Some QR code generators — particularly paid services offering dynamic codes — require a user account, log the content you encode, and store it on their servers. If you are encoding sensitive content (a Wi-Fi password, private contact details, a document URL), using a service that logs that content creates a risk if that service is breached or ceases to operate.

A browser-based static code generator that processes everything locally — like QRVelto — never sends your input to a server in the first place, so there is nothing to log, breach, or expose. This is the safest architecture for encoding any non-public content.

Link to HTTPS destinations

Always link your QR codes to HTTPS URLs. An HTTP destination exposes the entire session to network eavesdropping, which is particularly relevant on public Wi-Fi. Most modern browsers also warn users when they land on HTTP pages, which can reduce trust in your code.

Protect physical codes from tampering

If your codes are in public-facing environments, protect them physically. Laminate printed codes or print them directly onto materials rather than applying them as removable stickers. Inspect high-value placements (payment codes, sign-in codes) periodically for evidence of tampering.

CTA: Generate a QR Code Privately in Your Browser

How QRVelto handles your data

QRVelto generates QR codes entirely client-side using the open-source qrcode JavaScript library running in your browser. When you type a URL, Wi-Fi password, contact details, or any other input into a QRVelto generator, that data is processed locally on your device to produce the PNG image. It is never transmitted to a QRVelto server, logged in a database, or shared with any third party.

The finished QR code image is downloaded directly from your browser’s local memory to your device. No account is required, no session is associated with your inputs, and no record of what you generated is retained after you close the browser tab.

QRVelto uses Google Analytics to measure aggregate site traffic and Google AdSense to show contextual advertisements. These services set cookies and may collect anonymised usage data according to their respective privacy policies. All analytics are subject to user cookie consent via the banner shown on first visit.

Security considerations for businesses

Businesses deploying QR codes at scale should add a few operational practices to their standard process:

• Verify codes before publish: Scan every code before printing, launching, or distributing to confirm it links to the correct destination. This catches URL typos and accidental wrong-file attachments.
• Monitor destination URLs: Set up Google Search Console or an uptime monitor on the pages your QR codes link to. A dead page is not a security issue, but it is a bad customer experience — and it is surprisingly common.
• Use HTTPS everywhere: Every page that a QR code links to should be HTTPS. If your website does not have SSL, fix that before distributing any codes.
• Educate staff about tampering: In physical retail and hospitality environments, brief staff on what legitimate codes look like and how to report suspicious stickers or replacements.
• Do not encode customer PII in QR codes: If you are generating codes for individual customers — booking confirmations, loyalty cards, personalised offers — encode an opaque token or reference number, not the customer’s name, email, or order details in plain text.

Summary: An honest comparison of static and dynamic QR codes across editability, tracking, cost, and privacy, so you can pick the right one for your project.

Q: Which type does QRVelto make?

A: QRVelto creates static QR codes. The destination is encoded directly in the pattern and generated in your browser, so the code is free, private, and permanent, but the target cannot be edited after it is made.

Q: Can I convert a static code into a dynamic one later?

A: No. The two are structurally different. A static code holds the destination itself, while a dynamic code holds a redirect link tied to a hosting service. Switching means generating a new code and reprinting.

Q: Is a dynamic code better than a static one?

A: Neither is universally better. Dynamic codes add editability and tracking at the cost of a subscription and third-party dependency. Static codes are free and permanent but fixed. The right choice depends on whether your destination will change.

Q: Do static codes work forever?

A: The code itself scans indefinitely because the data never changes. What can break is the destination behind it, such as a web page that is later deleted. Keep the target link live and the code keeps working.

Q: Can I track scans on a static QR code?

A: Not natively. However, you can approximate tracking by pointing the code at a URL with UTM parameters (e.g. ?utm_source=print&utm_medium=flyer) and reviewing your website analytics. You will see traffic sources but not individual scan counts.

Q: What happens to dynamic codes if I stop paying?

A: Most dynamic QR code providers will disable or delete your redirect links if the subscription lapses. This means every printed code that relied on that redirect stops working, which can be a serious problem if they are on physical materials you cannot easily replace.

“Static” and “dynamic” are the two families of QR code, and choosing the wrong one before you print can be an expensive mistake. This article compares them objectively, point by point, so you can decide with clear eyes rather than marketing hype. We will cover editability, tracking, cost, privacy, real-world examples, and why QRVelto focuses on static codes for most users.

The quick answer

A static QR code stores the destination directly inside the pattern. It is free, private, and permanent, but fixed once created. A dynamic QR code stores a short redirect link managed by a hosting service, which lets you edit the destination and record scans, in exchange for an ongoing subscription and reliance on that service.

For most individuals, small businesses, and one-time use cases, a static QR code is the right choice. Dynamic codes earn their cost when the content genuinely needs to change after printing, or when detailed scan analytics are essential to a paid campaign.

Can you change the content?

This is the defining difference. With a static code, the data is baked into the squares, so the destination cannot be changed afterward. If you print a static code that points to example.com/spring-menu and later rename that page, the code breaks.

A dynamic code points at a redirect owned by the provider. Because the redirect target lives on a server, you can repoint it to a new URL any time without reprinting. That flexibility is the main reason businesses pay for dynamic codes.

The practical workaround for static codes is to point the code at a stable URL and update the content behind that URL. For example, a restaurant can link a static code to /menu and update the menu page whenever dishes change. The code never changes; only the page content does. This approach works for most real-world needs and eliminates the need for a dynamic code service entirely.

Scan tracking and analytics

Static codes carry no built-in analytics. The data goes straight from the pattern to the destination, with nothing in between to count scans. You can approximate tracking by pointing a static code at a URL that already has its own analytics, such as a link with UTM parameters, but there is no scan dashboard.

For example, a static code pointing to https://example.com/menu?utm_source=table-qr&utm_medium=print will show up in your Google Analytics as traffic from that source. You get channel-level insight without needing a dynamic code service.

Dynamic codes route each scan through the provider first, so they can log the number of scans, rough location, device type, and time. If measurable campaign performance is a hard requirement and UTM tracking is not granular enough, a dynamic code from a reputable paid provider may be justified. But understand that you are sharing every scan event with that provider.

Cost

Static codes are typically free to generate and free forever, because there is no service to maintain. Dynamic codes almost always require a paid subscription, since someone has to keep the redirect infrastructure running. If that subscription lapses, dynamic codes usually stop resolving.

Paid dynamic QR services typically charge between $5 and $30 per month depending on the number of codes, scan volume, and analytics features. For a small business that simply needs a menu code or a Wi-Fi code, this is a recurring cost with no real benefit over a free static code pointing to a well-maintained URL.

Privacy

Static codes generated locally are the more private option. With QRVelto’s generator, the code is built in your browser and nothing is sent to a server, so no third party records who scans it or what you encoded.

Dynamic codes, by design, route scans through a provider that logs them. That is useful for analytics but means a third party sees scan activity, including when, where, and on what device every scan happened. Depending on your users’ privacy expectations and applicable laws (such as GDPR in Europe), this logging may require disclosure.

Neither approach is wrong; it depends on whether you value analytics or minimal data collection. For codes that handle sensitive information, such as medical paperwork links or employee-facing tools, static codes with no third-party logging are generally the safer default.

Pros and cons of each type

Static QR codes: pros

• Free to generate, free to use forever.
• No third-party service dependency; works even if the generator goes offline.
• Private by default: no scan data sent to any server.
• Permanent: the code never expires or breaks due to a lapsed subscription.
• Simpler: no account, no dashboard, no management overhead.
• Works offline for types like plain text, Wi-Fi credentials, and vCard contacts.

Static QR codes: cons

• Cannot be edited after creation. A changed URL means a new code and a reprint.
• No native scan tracking or analytics.
• Longer content (like a long URL) produces a denser, harder-to-scan code.

Dynamic QR codes: pros

• Editable destination without reprinting the code.
• Built-in scan analytics: count, location, device, and time.
• Shorter encoded URL means a simpler, less dense code pattern.
• Useful for campaigns where the target changes over the life of the print run.

Dynamic QR codes: cons

• Requires an ongoing paid subscription to keep the redirect active.
• If the provider shuts down or you cancel, all printed codes stop working.
• Every scan is logged by the provider, raising privacy considerations.
• More setup and management: accounts, dashboards, link management.

Side-by-side comparison

Factor	Static QR code	Dynamic QR code
Editable after printing	No	Yes
Built-in scan tracking	No (UTM workaround available)	Yes
Ongoing cost	None	Monthly/annual subscription
Works if service ends	Yes (code is self-contained)	No (redirect stops)
Third-party scan logging	None	Yes (by the provider)
Privacy	High	Lower
Works offline	Yes (for text, Wi-Fi, vCard)	No (requires internet)
Code pattern density	Depends on content length	Usually simpler (short redirect)
Setup complexity	None	Account and dashboard required
Made by QRVelto	Yes	No

Which one to use

Choose a static code when:

• The destination is stable, such as a permanent website or a Wi-Fi network.
• You want a free, permanent code with no subscription.
• Privacy matters and you would rather no third party log scans.
• The code is for personal use, a one-time event, or a small business with a stable URL.
• The content type works offline: vCard contacts, Wi-Fi credentials, or plain text notes.

Consider a dynamic code (from a paid provider) when:

• The destination will genuinely change over time and reprinting is not practical.
• You need detailed scan analytics to measure and report on a campaign.
• The same printed code must serve different targets across a campaign lifecycle.
• You are running a large-scale print campaign with a dedicated marketing budget.

CTA: Make a static Wi-Fi code

Real-world examples

When static is clearly the right choice

• Restaurant Wi-Fi: A café prints a Wi-Fi QR code at each table. The password never changes, so a static code is free, permanent, and requires no service. See the Wi-Fi QR code generator.
• Business cards: A consultant prints a vCard QR code on their card. Their contact details are stable, so a static code is ideal. Even if the phone number changes, only the next batch of cards needs a new code. Read about QR codes for business cards.
• Restaurant menu: A restaurant links a static code to /menu. When dishes change, the page is updated but the code stays the same. Full guide here.
• Product packaging: A producer links product codes to their ingredient page. The URL is stable, so a static code on the printed label works permanently.

When dynamic codes make sense

• Rotating marketing campaigns: A retailer prints window decals with a QR code that must link to different promotions each month. Reprinting decals each month is prohibitive, so a dynamic code with a manageable redirect makes sense.
• Event tickets: A large venue needs to verify which ticket was scanned and when. Dynamic codes with scan logging are the right tool here.

Why QRVelto creates static codes

QRVelto is built on a simple principle: your data stays in your browser. When you generate a QR code with QRVelto, the entire process happens locally, no server upload, no account, no subscription. The code is generated instantly, the image is yours to download, and no third party ever sees what you encoded.

This approach works well because the vast majority of QR code use cases, sharing a website link, connecting guests to Wi-Fi, handing out a contact card, linking to a PDF, do not require editing after printing. A stable URL paired with a well-maintained web page solves the “editable content” problem without any cost or privacy trade-off.

For tools that need dynamic editing and scan tracking, a dedicated paid service is the honest answer. QRVelto does not try to compete with those tools; it provides the best possible static code generator for the majority of users who do not need them.

Limitations to know

The biggest limitation of a static code is that it cannot be edited. Plan the destination carefully and keep that page live. For content that changes often, such as a restaurant menu, point a static code at a stable URL (like /menu) and update the page behind it rather than the code.

The limitation of a dynamic code is dependency: if the provider changes pricing, shuts down, or you stop paying, printed codes can fail. Before committing to a large print run with a dynamic service, verify the provider’s track record and read the service terms carefully, especially the data-retention policy after cancellation.

Common mistakes

• Printing a static code to a URL you plan to rename. Use a stable link or route instead.
• Paying for dynamic codes you do not need. If nothing will change and you do not need analytics, static is enough.
• Assuming a static code tracks scans. It does not; use UTM links if you need rough measurement.
• Forgetting that dynamic codes break when you stop paying. Budget for the full lifecycle of the campaign, not just the launch.
• Using a dynamic provider with poor uptime. Every minute of downtime means failed scans for everyone holding your printed materials.

Frequently asked questions

New to the topic? Start with what a QR code is and how it works, or see the size guide before you print. To create your first static code right now, try the URL QR code generator.

QR codes are everywhere now, from restaurant tables to parcel labels to museum walls, yet most people have never been told how the little squares actually work. This guide explains what a QR code is, how it was invented, how the pattern encodes information, the practical difference between static and dynamic codes, and how to use and scan them safely. By the end you will understand not only what a QR code is but why it has become one of the most versatile communication tools in modern business.

What a QR code actually is

QR stands for Quick Response. It is a two-dimensional barcode invented in 1994 by the Japanese company Denso Wave to track automotive parts. Unlike a traditional barcode, which stores data in a single horizontal row of lines, a QR code stores data across both dimensions of the square. That is why it holds far more information and can be read from any angle.

You can spot the structure once you know where to look. The three large squares in the corners are finder patterns that tell a scanner where the code is and how it is rotated. Smaller alignment patterns help the reader correct for distortion when the code is on a curved surface or photographed at an angle. The rest of the grid is the encoded data plus error-correction information.

In essence, a QR code is a machine-readable label that bridges the physical and digital worlds. You print it on paper, a product, or a sign, and any smartphone can decode it instantly without needing any special hardware beyond the built-in camera.

History and evolution of QR codes

The story of QR codes begins on the factory floor, not in a marketing department. In 1994, Masahiro Hara and his team at Denso Wave, a subsidiary of the Toyota Group, were frustrated by the limitations of standard barcodes. A barcode could hold only 20 characters, and the automotive supply chain needed to track parts with much more detail, including part numbers, manufacturing lots, and supplier codes, all in a single scan.

Hara drew inspiration from the game of Go, whose black-and-white stones on a grid suggested a matrix-based approach. After two years of development, the team published the QR code standard in 1994 and released it royalty-free. That decision to open the standard to the world is largely why QR codes are everywhere today.

Adoption milestones

• 1994 — Denso Wave invents and publishes the QR code standard.
• 1999 — QR codes adopted across Japanese manufacturing and logistics.
• 2002 — First QR-enabled mobile phones released in Japan, bringing consumer adoption.
• 2010s — Smartphones go mainstream globally; QR codes appear on posters, magazines, and packaging worldwide.
• 2017 — Apple adds native QR code scanning to the iOS camera app, removing the last major barrier for iPhone users.
• 2020 — COVID-19 pandemic drives an explosion in contactless menu, check-in, and payment QR codes globally.
• 2024 — QR codes appear on billions of product packages, transit systems, payment terminals, and marketing materials worldwide.

The pandemic accelerated adoption by years. Restaurants replaced laminated menus overnight. Event venues switched to digital tickets. Governments used QR codes for health passports. What had been a niche marketing tool became everyday infrastructure almost overnight, and the habit has stuck.

How a QR code stores and reads data

Every black or white square in the grid, called a module, represents part of a binary value. When you scan a code, your camera captures the pattern, the software locates the finder patterns, straightens the image, and then translates the modules back into the original text, such as a web address or a block of contact details.

The process takes a fraction of a second on a modern phone. The camera does not need to be perfectly aligned: the finder patterns let the software rotate and correct the image automatically, which is why you can scan a QR code held at an angle or even slightly curved around a bottle or mug.

Error correction is the clever part

QR codes include built-in error correction based on Reed-Solomon mathematics, the same algorithm used in CDs, DVDs, and space communication. This is why a code can still scan even if part of it is smudged, torn, or covered by a logo. There are four correction levels:

• Level L — recovers about 7% of damaged data. Produces the smallest, simplest code.
• Level M — recovers about 15%. A reasonable default for most uses.
• Level Q — recovers about 25%. Good choice when a logo will be overlaid.
• Level H — recovers about 30%. Best for codes with a large logo or high-wear environments.

Higher correction adds more modules, making the code denser and therefore slightly harder to scan from a distance. This is the trade-off you will encounter again when you add a logo.

QR code structure explained

A QR code is more than a random grid of squares. Every zone has a specific job:

• Finder patterns — The three large squares in the top-left, top-right, and bottom-left corners. They let any scanner locate and orient the code regardless of rotation.
• Timing patterns — Alternating black-and-white stripes running between the finder patterns, used to determine the size of each module.
• Alignment patterns — Smaller square patterns that appear in larger QR codes to help correct for curved surfaces or camera distortion.
• Format information — Strips adjacent to the finder patterns that store the error-correction level and the masking pattern applied to the data.
• Data and error-correction modules — The bulk of the code. Data is encoded here, interleaved with the error-correction blocks.
• Quiet zone — The blank white margin surrounding the code. Scanners need this to identify where the pattern begins and ends.

QR code versions

QR codes come in 40 versions, from Version 1 (a 21×21 grid that holds 41 numeric characters) to Version 40 (a 177×177 grid that holds up to 7,089 numeric characters). The version is chosen automatically based on how much data you want to encode: a short URL might generate a Version 3 or 4 code, while a full vCard with name, address, and phone number might require Version 10 or higher. In practical terms, encode only the information you need, because a smaller, simpler code scans more reliably than a large, dense one.

Static vs dynamic QR codes

This is the single most useful distinction to understand before you make a code.

Static QR codes

A static code encodes the destination directly in the pattern. Scan it and the data, for example https://example.com/menu, comes straight out of the squares. Because the data lives in the image, it is fixed. You cannot change where it points after printing, and there is no built-in scan tracking. Static codes are free, private, and permanent, which makes them ideal when the destination will not change.

Dynamic QR codes

A dynamic code encodes a short redirect link that runs through a hosting service. When someone scans it, they hit that service first and are then forwarded to the real destination. Because the redirect can be edited on the server, you can change the target later and record scan statistics. The trade-off is an ongoing subscription and reliance on that third party staying online.

Common types of QR codes

The term “type” usually refers to what the encoded text tells the phone to do:

• URL — opens a website, the most common use by far. Use our URL QR code generator.
• Wi-Fi — connects a phone to a network without typing the password. Try the Wi-Fi QR code generator.
• vCard — saves a full contact card to the address book. See the vCard QR code generator.
• Menu — a URL pointing to a digital restaurant menu. Use the menu QR code generator.
• Email — pre-fills an email with a recipient address and subject line.
• WhatsApp — opens a WhatsApp chat with a pre-filled message.
• PDF — links directly to a hosted PDF document.
• Plain text — shows a short message on screen without requiring an internet connection.

Whatever the type, the mechanics are identical: the phone reads the text and recognizes a prefix (like WIFI: or BEGIN:VCARD or mailto:) that tells it how to respond. The QR code format itself is universal; only the content changes.

Real-world uses and examples

QR codes have found their way into almost every industry. Here are concrete examples that show just how versatile the format has become:

Restaurants and hospitality

A café prints a code on each table that opens its digital menu, using our menu QR code generator. Customers scan, browse, and order without waiting for a physical menu. A hotel places a Wi-Fi QR code at the front desk and in each room so guests connect instantly without calling reception. For a complete restaurant use-case guide, see QR codes for restaurants.

Business networking

A consultant or salesperson adds a vCard QR code to their business card. When a new contact scans it, their phone automatically adds the full contact record, including name, company, phone, email, and website, to their address book. No manual typing required. See how QR codes transform business cards.

Retail and product packaging

A food producer prints a QR code on a jar that links to an ingredient breakdown, allergen information, and recipe suggestions. A clothing brand links to a care guide and sustainability report. QR codes on packaging can hold far more information than the label itself. Learn more about QR codes for product packaging.

Events and entertainment

A conference organiser includes QR codes on lanyards that link to speaker bios and session schedules. A museum places codes beside exhibits that open audio guides or extended video content. At events, QR codes replace printed tickets entirely. Read about QR codes for events.

Real estate

A property agent adds a QR code to a for-sale sign. Passers-by scan it to view a full photo gallery, floor plans, and contact details without calling the office. See the complete guide to QR codes for real estate.

Marketing and advertising

Brands embed QR codes in print ads, billboards, and direct mail to bridge physical and digital campaigns. A code on a flyer can open a landing page, a discount voucher, or a product video. Read QR code best practices for marketing.

Benefits and advantages of QR codes

QR codes have displaced paper forms, printed directories, and spoken instructions in many settings because they offer several genuine advantages:

• Instant access. A scan takes less than two seconds. There is no typing, no searching, no memorizing. The user goes directly to the content.
• No special hardware required. Any modern smartphone with a camera can read a QR code. No dedicated scanner, no app installation in most cases.
• Bridges print and digital. Physical materials can link to content that would be impossible to print, like videos, live inventory, or interactive maps.
• Low cost to produce. Static QR codes are free to generate. Printing them costs the same as printing any other design element.
• Large data capacity. A single code can store thousands of characters, far more than any barcode.
• Error tolerance. Built-in Reed-Solomon error correction means codes keep working even with minor damage, smudging, or a brand logo overlay.
• Works offline. A QR code that encodes plain text, a Wi-Fi credential, or a vCard works without an internet connection. The data is in the image itself.
• Reduces contact. During the COVID-19 pandemic, contactless menus, check-ins, and payments via QR code became essential and remain preferred by many customers.

Security considerations

Because a QR code hides its destination behind a pattern, the main risk is not knowing where a scan will take you. Attackers sometimes paste fake codes over real ones, a technique called “quishing” (QR phishing), to redirect people to phishing pages designed to steal passwords or payment details. The FBI and consumer protection agencies have published guidance on tampered QR codes because the threat is real.

Sensible habits that reduce the risk:

• Always preview the URL your phone shows before opening it.
• Be wary of QR codes on stickers placed over an existing sign, especially in public places.
• Never enter passwords or payment details on a page reached only by an unexpected code.
• If a code sends you to an unfamiliar domain, close it rather than proceeding.
• For business codes you create, use a stable, recognizable URL so customers can verify where they are going.

For a deeper dive into this topic, read our full guide on QR code security and privacy.

Common mistakes

• Assuming any code can be edited. Static codes cannot. Choose the type before printing.
• Printing too small. Dense codes need room to be read reliably. Follow the size guide before committing to a print run.
• Skipping the scan test. Always test with more than one phone before publishing.
• Linking to a page that is not mobile-friendly. If users scan with a phone, the destination must work well on a phone.
• Forgetting the quiet zone. The white margin around the code is not optional; removing it causes scan failures.
• Using low-contrast colors. Light grey on white or dark blue on black both defeat most scanners.

If a code refuses to scan, our guide on why a QR code is not working walks through every likely cause with specific fixes for each one.

Frequently asked questions

Do QR codes expire?

A static QR code never expires on its own because the data is fixed in the pattern. What can stop working is the destination behind it. If a static code points to a web page and that page is deleted, the code still scans but the link fails.

Do I need an app to scan a QR code?

On most modern phones, no. The built-in camera app on current iPhone and Android devices detects QR codes automatically. Older phones may need a separate scanner app.

Can a QR code contain a virus?

The code itself is only data, so it cannot hold executable malware. The risk comes from where it sends you. A code can open a malicious website or a fake login page, so always preview the destination before acting on it.

How much information can a QR code hold?

A single QR code can store up to roughly 4,296 alphanumeric characters or 7,089 numeric digits at its largest version, though smaller, simpler codes scan far more reliably in the real world.

Who invented QR codes?

QR codes were invented in 1994 by Masahiro Hara and a team at Denso Wave, a subsidiary of the Toyota Group in Japan. They were originally designed to track automotive parts during manufacturing.

Are QR codes free to use?

Yes. The QR code standard was made freely available by Denso Wave, who hold the patent but chose not to enforce it. Creating static QR codes is free. Some dynamic QR code services charge a subscription for tracking and editing features.

Ready to create your first code? Start with the URL QR code generator, explore all industry solutions, or browse the QRVelto blog for more in-depth guides.