Why free QR codes stop working, and how to make one that cannot

Somebody prints two thousand table cards. Eight months later the QR code on every one of them opens a page that says the code has expired and the account needs upgrading. Nothing was hacked and nothing broke. The code is doing exactly what it was built to do.

This is worth understanding before you print anything, because the decision that matters is made in the first thirty seconds, and it is invisible.

Two kinds of code that look identical

A QR code is a container for a string of text. What goes in the string is the whole story.

A static code contains your content directly. Encode https://example.com/menu and the pattern is that URL. A scanner reads the pattern, gets the URL, opens it. Nothing sits in between. The code cannot be changed, tracked, disabled or billed for, because there is nothing to change, track, disable or bill — only ink on paper.

A dynamic code contains a short link belonging to whoever generated it: https://qr-service.example/a8f3c. Scanning goes to their server, which then redirects you to the real destination. That hop is where scan analytics come from, and it is also where everything else comes from.

Both produce a square of black and white squares. From the outside they are indistinguishable.

What the hop actually buys, and costs

	Static	Dynamic
Change the destination later	no	yes
Scan analytics	impossible	yes
Works if the generator disappears	yes, forever	no
Can expire or be paywalled	no	yes
Someone else can redirect it	no	yes, whoever owns the link
Visitor’s IP seen by a third party	no	yes, on every scan
Code density for the same destination	depends on your URL	usually lower

The ability to change the destination is a real feature. If you print signage before the landing page exists, or you run seasonal campaigns off permanent posters, dynamic codes solve a genuine problem and are worth paying for — from a company you expect to still exist.

The trouble is that free tools overwhelmingly hand you a dynamic code without saying so, because a free static code generates no ongoing relationship and a free dynamic one generates a subscription prompt in six months.

How to tell what you were given

Scan your own code and look at what your phone displays before you tap.

If it shows your own domain, it is static. If it shows a domain you have never heard of — anything short and branded that is not yours — it is dynamic, whatever the marketing said.

Do this before printing. Not after.

Making one that outlives everything

Our generator makes static codes only. That is not a feature we added; it is a consequence of the code being computed in your browser. There is no server in the path, so there is nothing that could count a scan or redirect it later. We could not break your code if we wanted to.

The same property means we never see the contents. For a link that hardly matters. For a Wi-Fi code it matters a great deal, because a server-side generator receives your network name and password in plain text in order to draw the pattern.

The five things people encode

A link. The most common by far. Shorter URLs make sparser, more forgiving codes — see the next section.

Wi-Fi credentials. Encoded in the WIFI: format that iOS and Android both understand natively; scanning offers to join the network. This is the single most useful QR code most people ever print. Put it on a card for guests, not on the network your accounts live on — anyone who photographs the card has the password.

A contact card. A vCard with name, organisation, phone, email and site. Good on conference badges, where the alternative is typing.

Plain text. Anything at all. A serial number, a shelf location, a note to a future engineer.

A pre-filled email. A mailto: link with subject and body already written, which turns “email us about X” into one tap.

Capacity, and why shorter is better

A QR code carries error correction — redundant data that lets a scanner reconstruct the pattern when part of it is unreadable. There are four levels:

Level	Recoverable	Typical use
L	about 7%	maximum data, pristine conditions
M	about 15%	the common default
Q	about 25%	industrial, dirty environments
H	about 30%	logos, folds, coffee, bad angles

Higher correction means fewer bytes for the same physical size, which means a denser grid. At the highest level a single code still holds well over a thousand characters — far more than any sane URL — so capacity is almost never the real constraint.

Density is. A 40-character link produces a code with noticeably larger squares than a 200-character one carrying campaign tracking parameters, and larger squares scan from further away, in worse light, at worse angles, on older phones. Strip the tracking parameters before encoding, or use a short path on your own domain.

Our generator fixes error correction at H. It costs a little density and buys a code that survives a crease, a thumb, a coffee ring and a logo in the middle.

Printing rules that prevent most failures

Size. The working guideline is that scanning distance is roughly ten times the code’s width. A 2 cm code works at arm’s length, which is fine for a business card. A poster read from three metres needs a code about 30 cm across. When in doubt, bigger.

Quiet zone. The blank margin around the code is part of the specification, not decoration — scanners use it to find where the code ends. Four modules’ width is the minimum. Cropping it away to fit a layout is the most common reason a professionally printed code fails, and it fails silently: it looks fine and simply does not scan.

Contrast and direction. Dark modules on a light background. Inverting it looks striking in a design mock-up and fails on a significant share of readers. Keep strong contrast, and avoid printing on a busy photograph.

Paper. Ink spreads on uncoated stock, thickening dark modules and closing the gaps in a dense code. If the code is dense and the paper is absorbent, print it larger than you think you need.

Curves. A code wrapped around a bottle or a mug distorts. Keep it on a flat panel.

Test it like a customer, not like a designer

Five minutes here saves a reprint:

1. Scan it with the phone camera app, not a QR reader app — that is what almost everyone will use.
2. Scan it on a second phone, ideally the other platform. Android and iOS decoders differ at the margins.
3. Print it at final size and scan the print, not the screen.
4. Scan it at an angle, in dim light, from the distance a real person will stand.
5. If it goes on a leaflet, fold it first and scan it folded.

If it only fails after you added a logo, the logo is too large or the content is too long. Those are the two variables you control.

A note on what a code cannot do

A QR code is a link, not a security mechanism. Anyone can print a sticker with a different code and put it over yours — this happens to parking meters and restaurant tables often enough that several city councils have issued warnings about it. If a code leads somewhere that asks for payment or credentials, the code proves nothing about who is asking.

For your own codes, the useful defences are dull: send people to a domain they recognise, keep the printed context clear about where they are going, and check your own signage occasionally.

If you need the image itself adjusted

A downloaded code is an ordinary image, so the rest of the toolkit applies. SVG is the right download for print and signage because it stays sharp at any size; PNG is right for slides, documents and anything that will not accept vector. If a print shop hands back a raster file that needs squaring up or sizing to a template, the cropper and resizer will do it without uploading your artwork anywhere.