All posts
May 12, 20264 min read

Generate QR codes that never leave your browser

A QR code is just an image that encodes a short piece of text, usually a URL. Generating one should be a purely local operation: take the text, run an algorithm, draw some black and white squares. There is no technical reason for your data to leave your machine. Yet most free QR sites do exactly that, and some do worse.

What actually happens on many free QR sites

There are two common problems.

The first is logging. When you paste a URL into a server based generator, that URL travels to their backend so they can render the image. For a public marketing link this may not matter. For an internal dashboard address, a staging environment, a customer specific link, or anything with a token in the query string, you have now handed it to a third party with no idea what they retain.

The second problem is worse: tracking redirects. Some services do not encode your URL into the QR at all. They encode their own short link that points to your destination. Every scan then routes through their servers, where they count opens, capture device and location data, and sometimes show an interstitial. The visible effect is that you depend on a company you have never vetted, and the moment that service shuts down or paywalls the link, every code you printed stops working. A QR code on a physical sign is not something you can edit after the fact.

A QR code you generate should contain your destination directly, and nothing should have been transmitted to produce it.

How QR encoding works

QR encoding is well defined and entirely deterministic, which is why it can run client side with no network call.

Data and modes

The text you provide is encoded in one of several modes: numeric, alphanumeric, byte, or kanji. A URL uses byte mode. The encoder packs your characters into a bit stream, adds length and mode indicators, and pads to fit one of forty defined symbol sizes called versions. Version 1 is a 21 by 21 grid; each higher version adds 4 modules per side. More data means a larger version and a denser code.

Error correction levels

This is the part most people never see. QR codes use Reed-Solomon error correction so a code still scans when it is partly dirty, wrinkled, or obscured. You choose one of four levels:

  • L (Low): recovers about 7 percent of the code
  • M (Medium): about 15 percent
  • Q (Quartile): about 25 percent
  • H (High): about 30 percent

Higher correction is not free. The recovery data takes up room in the symbol, so for the same text a level H code is visibly denser than a level L code, and often a larger version. The tradeoff is real: H survives a logo stamped in the middle or rough printing, while L stays light and easy to scan at small sizes when the surface is clean.

A practical default is M for screen and digital use, and Q or H for anything printed on a surface that will get handled, scuffed, or branded with a center logo.

Drawing the image

Once the bit stream and error correction codewords exist, the encoder lays them into the grid along with the fixed patterns: the three large finder squares in the corners, the alignment patterns, and the timing rows. A masking step then flips a pattern of modules to avoid large blank areas that confuse scanners. The result is a matrix of dark and light cells, which is rendered to a canvas or SVG. None of these steps need a server.

Client side means nothing is uploaded

Because the entire pipeline is math on text, a browser can do all of it. The QR Code Generator runs the encoder locally and draws straight to an image in the page. Your URL is never sent anywhere, there is no redirect baked into the output, and the code points directly at the destination you typed. You can download it and it will keep working for as long as your destination does, with no dependency on us.

This is the same principle behind the rest of the tools here. When you decode a token in the JWT Decoder or check a value with the Hash Generator, the input stays in your browser. Privacy is not a feature toggle, it is just how local computation works when nobody chooses to phone home.

Quick checklist before you print a code

  • Confirm the code encodes your real URL, not a shortener you do not control. Scan it and read the raw decoded value.
  • Pick an error correction level that matches the surface. Use H if you are placing a logo in the center.
  • Keep a quiet zone, the blank margin around the code, so scanners can find the finder patterns.
  • Test the printed size at the distance people will actually scan from.

If you are assembling the URL itself, the URL Encode / Decode tool helps you escape query parameters cleanly before you encode them. Build the link, verify it, then turn it into a code that belongs entirely to you.