QR Code Generator

A QR code is not private and not encrypted

The pattern looks cryptic to a human, and that appearance does more damage than any technical limit on this page: a free decoder reads it in under a second. So if you would not print the content on a poster in the same words, do not put it in a QR code. That rules out shareable discount codes, URLs with someone's details pre-filled, links to documents with no access control behind them, and — the one that catches everybody — Wi-Fi credentials.

What a code can actually hold

A QR code has 40 sizes, called versions. Version 1 is a 21×21 grid of modules, version 40 is 177×177, and the formula is 4 × version + 17. The generator picks the smallest version that fits your text. This one is fixed at error correction level M, whose nominal job is to recover about 15% of the codewords, so these are the limits that apply here.

2,331 bytes is a hard ceiling: past it no code is produced and the preview simply goes blank. The limit is in bytes, not characters — text is encoded as UTF-8, so an accented letter costs two bytes and most emoji four, so a code full of Arabic hits the ceiling at roughly half the plain-ASCII character count, and one full of Japanese at roughly a third. The Capacity readout flags "High" past 800 characters, which is an early warning rather than the real limit.

Why a long URL makes a code phones struggle with

Take a made-up link, then the same link with campaign tracking bolted on:

The image is the same size in both rows. The tracking parameters did not make the code bigger; they made every square inside it smaller. At the extreme, a version 40 code at the Small setting gives 160 ÷ 177 = 0.9 pixels per module — less than one pixel per square. A phone camera has to make out each of those squares, often at an angle, in poor light, from a metre away. Shorten the content before generating rather than enlarging the image afterwards.

Give the code a clear margin

This is the most important practical thing on the page. The specification expects a clear light margin four modules wide on all sides — the quiet zone — because that blank border is how a scanner finds the edges of the pattern. The PNG you download includes a white margin at least four modules wide on every side, added by this page.

• Place the PNG on a white or very light rectangle noticeably larger than the code — as a rule of thumb, a clear border at least four of the small squares wide on every side.
• Keep it dark-on-light with strong contrast. DENSO notes that some colour pairs cannot be read at all, for example a red code on a white background.
• Do not crop tight to the pattern, and do not let the layout put a caption inside that border.

It is a raster image, so size it before you print

The download is a PNG, not an SVG, so enlarging it softens exactly the hard edges the scanner needs. Work the size out first: 400 pixels at 300 dpi is 400 ÷ 300 × 25.4 = about 34 mm across — fine for a business card, nowhere near a shop window. Use Large for print, and if you need more, cut the content so the grid is coarser rather than blowing the file up. If it must be lighter for the web, the image compressor shows the real before and after bytes, but do not let it resize the code down. Then test the printed article, not the screen: cheap phone, poor light, real viewing distance.

What this generator is not

It is not a dynamic QR service. The destination is baked into the pattern, so a printed code cannot be repointed and there are no scan counts. The trade is mostly in your favour — nothing expires and no third party logs who scanned what. To keep the option of changing the destination, encode a short URL on a domain you control and redirect there.

It is also not a form builder for the structured code types. It encodes exactly the characters you type, so you type the structure yourself:

All fake values. Test the Wi-Fi row on both an iPhone and an Android handset before printing a hundred of them: handling varies, and a network name containing a semicolon or colon has to be escaped. There is no error correction selector either. Level M is a sensible middle setting, but it means this is not the tool for a code printed on something that gets scuffed, or one with a logo over the centre — those want level H. For linear codes, the barcode generator is the right tool, and the rest of the family is on the generators page.

Why it matters that this one runs locally

Here is the scenario that makes it concrete. An office wants a Wi-Fi code for the meeting room, so someone types WIFI:T:WPA;S:Guest;P:the-real-password;; into the first generator a search turns up. If that site builds the image on its server, the company's Wi-Fi password has just been sent to a stranger, and it now sits in a web server log, in whatever proxy handled the request, and in that operator's backups. Nobody had to act in bad faith; routine logging is enough.

This page cannot do that. The encoder is a JavaScript library served from this site and it runs in your tab: your text becomes a canvas locally, and the download comes from that canvas via your own browser. The encoder makes no network request of its own: no fetch, no XMLHttpRequest. You can check it in ten seconds: load the page, disconnect from the network, and keep generating and downloading.

Then remember the first section, because generating locally solves only half of it. That code is now a poster with your network password on it in a machine-readable font, and anyone who photographs the wall keeps it after they leave. Put visitors on a separate guest SSID with its own password and change it on a schedule; the password generator makes that a ten-second job. A code being private to make was never the same thing as a code being private to read.

QR Code is a registered trademark of DENSO WAVE INCORPORATED. This page is not affiliated with DENSO WAVE; the term is used to name the symbol format, which is published as ISO/IEC 18004.