QR Code Generator: Create Free QR Codes Online

A $5.5 Trillion Technology Invented in a Toyota Parts Warehouse

In 1994, Masahiro Hara and his team at DENSO WAVE — a Toyota subsidiary — needed a way to track automotive parts faster than barcodes allowed. Barcodes hold ~20 characters. They needed hundreds. The result was the Quick Response code: a two-dimensional matrix that could encode 7,089 digits in a 177×177 module grid, scannable at any angle in under 0.1 seconds.

DENSO WAVE patented the technology but made a deliberate decision not to enforce the patent, releasing the format as an open standard. That choice, combined with iPhone adding native QR scanning in iOS 11 (2017) and Android in Google Lens (2018), triggered an adoption explosion. China recorded $5.5 trillion in QR payment transactions in 2023 (per Electroiq). India has over 9 million merchants accepting QR payments (per Scanova). The global QR code market is valued at $15.23 billion in 2026 and is projected to reach $33.14 billion by 2031 at a 16.82% CAGR (Mordor Intelligence).

Yet most developers treat QR codes as a black box: “call this API, get an image.” Understanding the internals matters — for choosing the right error correction level, understanding why short URLs scan faster, generating codes programmatically at scale, and protecting users from QR phishing. This article covers all of it.

How QR Codes Actually Work: The ISO/IEC 18004 Standard

QR codes are defined by ISO/IEC 18004, last updated in August 2024 (122 pages, published by ISO/IEC JTC 1 SC 31). The standard specifies the symbology completely: module arrangement, finder patterns, timing patterns, alignment patterns, format/version information cells, error correction algorithm, and decoding procedure. DENSO WAVE (qrcode.com) maintains the canonical reference implementation.

Anatomy of a QR Code

Every QR code has the same fundamental structure regardless of content:

• •Finder patterns — Three 7×7 nested-square patterns in corners (not bottom-right). The scanner uses these to locate and orient the code.
• •Timing patterns — Alternating black/white rows between finder patterns. These establish the module grid coordinate system.
• •Alignment patterns — Smaller 5×5 patterns that appear in Version 2+ codes. Version 40 has 46 of them. They compensate for image distortion.
• •Format information — Two copies of a 15-bit sequence encoding the error correction level and mask pattern applied. Stored near the finder patterns so it can be decoded even if the rest of the code is damaged.
• •Data and ECC codewords — The actual content plus Reed-Solomon error correction codes, interleaved in a specific zigzag pattern across remaining modules.
• •Quiet zone — A 4-module-wide white border surrounding the code. Required by the standard; skipping it is the most common cause of scan failures.

Versions and Module Sizes

QR codes have 40 versions. Each version increases the module grid by 4 per side:

Source: DENSO WAVE (qrcode.com). All capacities assume error correction Level L.

A typical HTTPS URL like https://example.com/products/item-123 (42 characters) encodes into Version 3 or 4 using alphanumeric mode. Adding UTM parameters can push it to Version 10+, making the code significantly denser. This is why URL shorteners exist for QR campaigns — not for aesthetics, but for scanability.

Reed-Solomon Error Correction: How Damaged Codes Still Scan

QR codes use Reed-Solomon error correction — the same algorithm used in CDs, DVDs, Blu-ray, and deep-space communications. It adds redundant codewords that allow a decoder to reconstruct missing or corrupted data. ISO/IEC 18004 defines four correction levels:

The “30% recovery” of Level H is what makes logo-overlay QR codes work: embedding a logo destroys some modules, but if those modules account for less than 30% of the data area, the Reed-Solomon codes reconstruct the missing information. This is why branded QR codes require Level H — and why generators that add logos but leave the error correction at Level M produce codes that look scannable but fail in poor lighting or at a distance.

Higher error correction has a real cost: it requires more redundant codewords, which means a larger QR code at equivalent data capacity. A URL that encodes into a 29×29 module grid at Level L may require a 37×37 grid at Level H. For digital displays where the code is crisp and undamaged, Level L or M is almost always the right call.

Encoding Modes: Why Uppercase URLs Scan Faster

QR codes are not binary blobs. They select the most compact encoding mode per segment:

• NumericDigits 0-9 only. Packs 3 digits into 10 bits. Most efficient mode (~3.3 bits per character). Useful for phone numbers, numeric IDs.
• Alpha0-9, A-Z (uppercase only), and 9 special characters: space $ % * + - . / :. ~5.5 bits/char. This is why HTTPS://EXAMPLE.COM encodes smaller than https://example.com.
• ByteFull Latin-1 or UTF-8 including lowercase, accented characters, emoji. 8 bits/char. Most URLs fall here due to lowercase letters and query parameters.
• KanjiShift JIS double-byte characters for Japanese text. ~13 bits/char but represents two bytes, so effectively more compact than byte mode for Japanese content.

Smart encoders mix modes within a single QR code. The sequence HTTPS://EXAMPLE.COM/12345 can use Alphanumeric mode for HTTPS://EXAMPLE.COM/ and switch to Numeric mode for 12345, reducing total bits compared to encoding everything in Byte mode.

Practical takeaway: if you are generating QR codes for a URL campaign and can control the URL structure, keep everything uppercase and avoid query parameters with lowercase keys. A URL using only alphanumeric characters encodes 30-40% more compactly than its lowercase equivalent, resulting in a less dense, more reliably scannable code.

For URL encoding reference, see the URL encoding guide — percent-encoding adds bytes that force Byte mode and increase QR density.

Generating QR Codes Programmatically

The Google Chart API QR code endpoint (chart.googleapis.com/chart?cht=qr) is officially deprecated and should not be used in production. Here are the production-grade options:

Node.js: node-qrcode

The qrcode npm package has 3,752,585 weekly downloads and 7,815 GitHub stars (npm registry, 2026). It generates PNG, SVG, and terminal output with zero external dependencies in production:

import QRCode from 'qrcode'

// Generate PNG buffer
const pngBuffer = await QRCode.toBuffer('https://bytepane.com/', {
  errorCorrectionLevel: 'M',
  width: 300,
  margin: 4,  // quiet zone in modules
  color: {
    dark: '#000000',
    light: '#ffffff',
  },
})

// Generate SVG string (better for print/scaling)
const svgString = await QRCode.toString('https://bytepane.com/', {
  type: 'svg',
  errorCorrectionLevel: 'M',
})

// Generate as data URL for browser <img> src
const dataUrl = await QRCode.toDataURL('https://bytepane.com/')

Python: qrcode

The Python qrcode library downloads 8.4 million times per month (pypistats.org, 2026). Version 8.2 supports all error correction levels and SVG output:

import qrcode
from qrcode.constants import ERROR_CORRECT_M

qr = qrcode.QRCode(
    version=None,          # auto-select smallest version
    error_correction=ERROR_CORRECT_M,
    box_size=10,           # pixels per module
    border=4,              # quiet zone in modules
)
qr.add_data('https://bytepane.com/')
qr.make(fit=True)

img = qr.make_image(fill_color='black', back_color='white')
img.save('qrcode.png')

# SVG output (no Pillow required)
import qrcode.image.svg
factory = qrcode.image.svg.SvgImage
img_svg = qrcode.make('https://bytepane.com/', image_factory=factory)
img_svg.save('qrcode.svg')

Go: skip.tools/qr

package main

import (
    "image/png"
    "os"

    "github.com/skip2/go-qrcode"
)

func main() {
    // 256x256 PNG at error correction level Medium
    err := qrcode.WriteFile(
        "https://bytepane.com/",
        qrcode.Medium,
        256,
        "qrcode.png",
    )
    if err != nil {
        panic(err)
    }

    // Generate PNG bytes in-memory
    png, err := qrcode.Encode("https://bytepane.com/", qrcode.Medium, 256)
    _ = png  // serve as http.ResponseWriter content
}

Browser: Choosing the Right Output Format

For web applications, always prefer SVG over PNG for QR codes. SVGs scale infinitely — a QR code rendered at 100px in SVG looks sharp at 2000px without re-generation. PNG is a raster format that blurs on high-DPI displays unless you generate at 2x/3x resolution. SVG also compresses better: a simple QR code pattern in SVG is typically 5-15KB vs 20-50KB for an equivalent PNG at display resolution.

The exception is when you need to generate thousands of QR codes server-side and serve them from a CDN — PNG is more universally supported in older email clients and document formats. When generating codes for embedding in PDFs or Word documents, use a raster PNG at 300+ DPI.

Static vs. Dynamic QR Codes: The Right Architecture for Scale

Dynamic QR codes account for 64.35% of the QR code market (QRCodeChimp, 2026). The difference:

• •Static QR code: Encodes the destination URL directly. The code is immutable. If the URL changes (product page update, campaign redirect), you must reprint. No analytics possible.
• •Dynamic QR code: Encodes a short redirect URL (e.g., qr.example.com/a1b2c3). The redirect destination is stored server-side and can be changed anytime. Enables scan analytics: timestamp, device, location, UTM attribution.

For a developer building their own system: implement dynamic QR codes with a redirect table in your database. Each QR code stores a 6-8 character random ID. A lightweight redirect endpoint resolves the ID and returns a 302. This is the same architecture as URL shorteners — see the URL encoder/decoder tool for URL construction utilities.

Static QR codes are fine for personal use, permanent links (open-source project repos, personal portfolios), and scenarios where the destination is guaranteed not to change. Dynamic codes are the default choice for any marketing or business context.

Physical Sizing: The 10:1 Rule

ISO/IEC 18004 specifies a minimum module size of 10mm × 10mm (excluding quiet zone). The practical sizing rule across the industry is the 10:1 ratio: the maximum reliable scanning distance is approximately 10× the QR code's physical width.

Sources: QR-Code-Generator.com, Nielsen Norman Group QR usability guidelines, Uniqode sizing guide.

Always include the 4-module quiet zone. Printing a QR code to the edge of a label is the single most common production error. Also test your codes on at least three different phone models including older Android devices — iPhone cameras tend to be more forgiving than budget Android hardware.

QR Code Security: The Quishing Threat

QR codes have a fundamental security problem: the encoded URL is not human-readable until decoded. A user scanning a code on a restaurant table or in a parking lot cannot tell whether it leads to a menu PDF or a phishing page. Attackers exploit this.

According to research by Keepnet Labs, QR phishing payloads grew from 0.8% of attacks in 2021 to 12.4% in 2023 (dropping slightly to 10.8% in 2024 as defenders adapted). Nearly 29% of phishing emails in the energy, manufacturing, and retail sectors contained malicious QR codes in 2024. In January 2026, the FBI issued a warning that North Korean state-sponsored group Kimsuky is actively using malicious QR codes in spearphishing campaigns targeting NGOs, think tanks, and academia.

The problem compounds with user behavior: 73% of Americans scan QR codes without verifying the URL, and more than 26 million have been directed to malicious sites (QRcode Tiger research). Only 36% of QR phishing attacks were accurately identified and reported by recipients (QRcode Tiger).

Defensive Measures for Developers

• •Always display the decoded URL in your QR scanner before navigating. iOS' native camera does this; Android's Google Lens requires an extra tap. Third-party scanner apps with URL preview enforcement are safer.
• •Add visual tamper indicators to physical QR codes in high-risk environments (payments, login). A sticker placed over a QR code is a classic attack vector; QR codes printed on a non-removable surface mitigate this.
• •Use HTTPS only in your QR code URLs. A QR code linking to an HTTP endpoint is an active security failure — the session is unencrypted and trivially intercepted.
• •Add a human-readable label beneath the QR code showing the domain: bytepane.com/tools. Users can cross-check against the decoded URL preview.

For applications generating QR codes that lead to sensitive workflows (payment confirmation, account settings), consider coupling the QR code with a time-based one-time token. This ensures a code scanned by an attacker 10 minutes later is already expired. The principles are similar to how JWT tokens expire to limit replay attacks.

QR Code Generator Comparison

There is no shortage of QR generators. Here is an honest comparison for different use cases:

For most development use cases, node-qrcode or python-qrcode is the correct choice. No API dependency, no rate limits, no privacy concerns about sending your URLs to a third-party service. For a simple, client-side generator without any npm dependency, you can also use the QRious library, which has no dependencies and generates via Canvas API.

When you need a hash of your content for verification purposes — useful for QR codes embedding signed tokens — check the hash generator tool which supports MD5, SHA-1, SHA-256, and SHA-512.

Market Context: Where QR Codes Are Actually Used

Understanding market data helps prioritize where to invest in QR code infrastructure:

• •Restaurants dominate: The restaurant segment held a 28.27% share of global QR payment revenue in 2024 (Grand View Research). A 150% increase in U.S. restaurant QR adoption post-pandemic brought 70% of American restaurants offering QR payment options (MenuTiger).
• •Asia-Pacific leads: The region accounts for 38.75% of global QR revenue (Mordor Intelligence), driven by China's 90% mobile-payment penetration and India's UPI system.
• •Global scans surging: QR code scans reached 41.77 million globally in 2024, up from 26.95 million in 2023 — a 433% surge over two years (QRCodeChimp data compiled from 50+ countries).
• •U.S. adoption is concentrated: 89.5 million Americans scanned QR codes in 2024, with the U.S. accounting for 43.9% of all global QR scans (Statista via Barkoder; Scanova).

Frequently Asked Questions