Practical guide
How to make a Quick Response Code
Generating the symbol is the easy part, and it is free. Everything that decides whether your code still works in three years happens after the generator.
The short answer: you give an encoder the data you want carried — usually a web address — and it lays that data out as a grid of light and dark modules according to ISO/IEC 18004. Every generator on the internet performs the same standardised computation. The symbology is unpatented and free to use; Denso Wave holds the QR Code trademark but charges nobody for making or reading one.
Which means the interesting question is not how do I generate a code. It is what happens to that code afterwards — who controls where it points, who can prove it is genuine, and what happens when the company that hosts the redirect disappears.
Step 1 — Decide what the code carries
A Quick Response Code is agnostic about its payload. The common ones:
| Payload | What it does when scanned | Typical length |
|---|---|---|
| Web address (URL) | Opens a page in the phone's browser | 20–100 characters |
| Contact card (vCard / MeCard) | Offers to save a contact | 100–400 characters |
| Wi-Fi credential | Offers to join a network | 30–80 characters |
| Payment instruction | Opens a banking or wallet app with details prefilled | Varies by scheme |
| Plain identifier | Read by an internal system: an asset, batch, or ticket | 8–40 characters |
Shorter payloads produce smaller, more forgiving symbols. A 300-character vCard forces a large, dense code that needs a good camera and good light; the same contact behind a short URL scans from across a room.
Step 2 — Static or dynamic: the decision that actually matters
This is where most people get quietly locked in, so it is worth being precise about what the two words mean.
A static Quick Response Code encodes the destination directly in the modules. Nothing sits between the scan and the destination. The consequence is symmetrical: nobody can hijack it, and nobody — including you — can ever change it. Print it and it is fixed for the life of the paper.
A dynamic code encodes a short redirect address owned by a provider. The scan hits the provider, the provider forwards the visitor onward, and you can change the onward destination whenever you like. You also gain scan analytics. What you have actually done is insert a third party into the middle of every future scan of every copy of that code you ever print.
| Static | Dynamic | |
|---|---|---|
| Destination editable later | No | Yes |
| Scan analytics | No | Yes |
| Depends on a third party | No | Yes, permanently |
| Stops working if a subscription lapses | No | Yes |
| Symbol density for a given payload | Higher | Lower — the redirect is short |
| Anyone can verify who issued it | No | No, unless it is registered |
Step 3 — Why codes "expire" (they do not)
A printed Quick Response Code does not expire. The modules on the paper will decode identically in fifty years. What people mean when they say a code expired is that the destination died: a trial ended, a subscription lapsed, a provider was acquired and retired its short domain, or a marketing site was taken down.
This is the structural weakness of the ordinary Quick Response Code. The symbol is permanent; everything it points at is rented. A code printed on a product, a vehicle, an ID card, or a piece of equipment outlives the vendor account that keeps it alive — and there is no way for the person scanning it to tell a live code from an abandoned one, or a genuine code from one a stranger printed and stuck on top.
Step 4 — Size, contrast, and the quiet zone
- Size: symbol width of at least one tenth of the intended scan distance. Below roughly 0.8 inches, print reliability drops sharply.
- Quiet zone: four modules of blank space on all four sides. Cropping it is the single most common cause of a code that "just doesn't work".
- Contrast: dark modules on a light background. Avoid inverted colours and low-contrast pastel pairings.
- Error correction: level M is a sensible default; level H buys damage tolerance and the room for a modest central logo.
- Test at real size, on the real material, at the real distance. A code that scans on a designer's monitor is not evidence of anything.
How much fits inside
Capacity explorer
A Quick Response Code holds more or less depending on two choices: how large the symbol is (its version) and how much damage it must survive (its error-correction level). Move the two controls and watch the capacity change.
- Numeric digits
- 5,596
- Alphanumeric characters
- 3,391
- Bytes (e.g. a URL)
- 2,331
Version 40 at level M: a symbol of 177×177 modules that stays readable with roughly 15% recoverable of its area obscured. Values as published in ISO/IEC 18004.
Step 5 — Register it, so it can be proved
A generator gives you a symbol. It does not give you a way for anyone to answer the only two questions that matter at the moment of scanning: who issued this code, and is it still valid.
A Registered QR Code answers both. It is an ordinary Quick Response Code — same symbology, same free standard, same camera — that has additionally been carried through the governance chain and bound to a public identity record. The code resolves to a record that names its issuer, states its status, and can be checked by anyone, without trusting the party who printed it.
That is the difference between a code that works and a code that can be trusted to work. It is what turns a disposable marketing artefact into infrastructure fit for an ID card, a medication carton, a machine nameplate, or a payment instruction.
How registration works, step by step →
What a Registered QR Code is →
Side by side: QR Code vs Registered QR Code →
Frequently asked
- How do I make a Quick Response Code?
- You supply the data you want encoded — most often a URL — and an encoder converts it into a matrix of light and dark modules following ISO/IEC 18004. The encoding step is free, standardised, and unpatented; every generator performs the same computation.
- Are Quick Response Codes free to create?
- The symbology itself is free to use. Denso Wave holds the QR Code trademark but does not charge for generating or reading codes. What providers charge for is the service around the code: hosting the destination, editing it later, tracking scans, and maintaining a record of who issued it.
- What is the difference between a static and a dynamic Quick Response Code?
- A static code encodes the destination directly in the symbol, so it can never be changed. A dynamic code encodes a short redirect URL owned by a provider, which forwards to the real destination — so the destination can be edited, but the code only works for as long as that provider keeps the redirect alive.
- Do Quick Response Codes expire?
- The printed symbol never expires; it will decode a century from now. What expires is the destination. A dynamic code stops working when the redirect service ends the subscription or shuts down, which is why permanence is a governance question rather than a printing question.
- What size should a Quick Response Code be printed?
- A practical rule is that the symbol's width should be at least one tenth of the intended scan distance, plus a quiet zone of four modules of blank space on all sides. Anything smaller than about 0.8 inches is unreliable on printed material.
- Can I put a logo in the middle of a Quick Response Code?
- Yes, within limits. Error correction can reconstruct a portion of the symbol — up to roughly 30% of the area at level H — so a modest central logo is tolerable. Overrunning that budget produces a code that reads on the designer's phone and fails in the field.