QR Code Generator

Generating a QR code for a test

Enter a URL or text and download the image. In testing, the usual reasons are getting a build onto a phone quickly, checking that a feature which displays a code renders one a camera can actually read, and producing codes for a scanning flow without waiting for the team that owns the real ones.

A QR code encodes text and nothing more. When it opens a website, the text is a URL; when it joins a network or adds a contact, the text follows a format the scanning app recognises. There is no logic inside the code, which is worth knowing because it means a code cannot be malicious by itself: only the destination can.

Why a code fails to scan

• Too small for the amount of data. A long URL produces a denser grid, and density has a minimum readable size.
• No quiet zone. The specification requires clear margin around the code; a layout that crops it tight breaks scanning.
• Inverted colours. Most scanners expect dark on light, and light on dark fails on many readers.
• Not enough contrast, or a busy background image behind a partially transparent code.
• Rendered at a non-integer scale, so module edges blur.
• Printed too small, or displayed on a screen with glare or low brightness.

QR codes carry error correction, so a damaged or partly covered code often still reads, which is how logos in the centre work. That tolerance has a limit, and a decorative overlay that removes too much makes a code that scans on the designer’s phone and fails on a cheaper one.

Testing a feature that displays QR codes

1. Scan with more than one device. Camera quality and decoder libraries differ enough to change the result.
2. Test the longest value the feature can produce: a URL with a long tracking query is the realistic worst case.
3. Check the printed size if the code appears on paper or a receipt, not just on screen.
4. Test in poor light and at an angle, which is how codes are actually scanned.
5. Confirm what happens after scanning: an expired code, an already-used single-use code and a code for another user all need defined behaviour.
6. Check the dark-mode rendering, which is a common place for an inverted, unscannable code to appear.

The security angle worth raising

A QR code is an opaque link. A person cannot read a destination before opening it, which is exactly what makes malicious codes effective: the practice is common enough to have its name, quishing. Two implications for a product that uses codes: the scanning flow should show the destination before navigating where it can, and a code that authorises something should be short-lived and single-use. If a code in the product grants access and never expires, that is worth writing up.

Frequently asked questions

How much data fits in a QR code?

Several thousand characters at the largest sizes, but capacity is not the practical limit: readability is. Long content makes a dense grid that needs a bigger image and a better camera. For anything beyond a short URL, test the scan rather than assuming it works.

Do QR codes expire?

The image never expires; it is a static encoding of text. What can expire is whatever the text points to. A code containing a one-time link stops working when the link does, which is why a code that authorises access should always be backed by a short-lived token.

Can a QR code contain a virus?

Not in itself: it holds text. The risk is entirely in the destination, which a person cannot inspect before scanning. That opacity is the reason phishing via QR codes works, and it is why a scanning flow that previews the destination is a meaningful safety feature.

Why does my QR code scan on one phone but not another?

Decoder libraries and camera hardware differ. The usual culprits are a code too dense for its size, a missing quiet zone, low contrast, or inverted colours. Testing on at least two devices catches most of it.

Can I add a logo to the centre of a QR code?

Often yes, thanks to built-in error correction, but there is a limit to how much can be obscured. Always verify a branded code on several devices, because the failure mode is a code that works for the designer and not for a portion of users.

Is the QR code generated on a server?

No. It is rendered in your browser, so a code containing an internal URL or an unreleased link is not sent anywhere.