URL QR Code Generator

The generator asks for the protocol (https://) deliberately. A QR code is just text; scanners decide what to do with it by its shape, and example.com/menu without a protocol is ambiguous — some camera apps open it, some search it, some show it as plain text. https://example.com/menu is unambiguous everywhere. Prefer https over http: phones increasingly warn on plain-http links, which is not the first impression you want a poster to make.

That is also why the builder refuses a bare domain instead of quietly adding a protocol for you. The convention this page follows — the ZXing "Barcode Contents" reference our payload engine cites, verified 2026-07-20 — is that the symbol encodes exactly the text of the URL, and that the protocol must be part of that text so a reader recognises it as a link. Type example.com/menu and the engine answers: "Include the protocol (e.g. https://) so scanners recognize the link." Guessing a protocol on your behalf would mean encoding text you never typed, which is the one thing a direct link code must not do.

New to versions, modules and error-correction levels? Start with the guide How a QR code encodes data. This page assumes those terms and shows what they come to for link payloads specifically.

A link code is one of the plainest payloads the engine produces — like a plain-text code — and the easiest to misunderstand precisely because it is so plain. There is no wrapper, no prefix, no field separator: the payload is the link, character for character. The worked example above encodes 31 characters, and the text in the box is the complete content of the symbol. Before accepting a link the builder does four things, in this order, and then nothing else:

1. Trims the edges. Leading and trailing whitespace — the usual by-product of a copy and paste — is removed. Whitespace inside the address is never rewritten — it either passes through verbatim or fails the parse step below.
2. Requires some text. An empty box is refused as a missing field rather than encoded as an empty symbol.
3. Requires a scheme and a parseable address. The text must begin with a scheme — a letter, then letters, digits, +, . or -, then a colon — and the whole thing must parse as a URL. A scheme with nothing after it fails here: https:// gets "This is not a valid URL."
4. Accepts only http and https. Other schemes can be perfectly valid URLs without being web links, and this generator is for web links. ftp://example.com/files is refused with "Only http:// and https:// links are supported." Email, phone and SMS codes have their own pages — mailto:, tel: and sms: — each with its own scheme and its own encoding rules.

Everything that passes is returned exactly as typed, once the edges are trimmed. The builder does not lower-case the host, does not add or remove a trailing slash, does not percent-encode anything, does not decode anything you percent-encoded yourself, and does not reorder a query string. The methodology page states the same rule from the other direction: links are encoded exactly as entered after validation, and never wrapped in a shortener or tracking redirect. The two examples below are the proof, built by the engine from invented addresses on example.com, example.org and example.net.

Each example carries the facts the encoder reports: the version, the module count, the error-correction level and, once it is a file, the print size. They are reported, not chosen. The engine hands the payload to a vendored copy of the reference encoder, which picks the smallest version that holds the text at the requested correction level; the encoding guide explains the mechanism, and the guides index covers the rest of the engine. Here is what the facts come to for links.

• Version and modules. The version is the grid size; a higher version means more, smaller modules. The symbol for the menu link is 29 modules on a side. The download adds the standard quiet zone of 4 background modules on every side, so the image is 37 modules across. The quiet zone is rendered into every PNG and SVG and cannot be switched off.
• Error correction. Every example on this page requests level M. The facts show the level actually encoded, which can be higher: the reference encoder raises the level whenever the stronger correction fits in the same version, so the symbol is no larger and simply recovers from more damage. Where the table below shows a level other than M, that is the boost at work. Adding a logo in the style panel forces level H regardless, for the reason the methodology page gives: the logo destroys modules that error correction must rebuild.
• Print size. A PNG is exported at one of 3 pixel sizes, and the generator reports what each becomes at 300 DPI, quiet zone included:
  • 512 px — 1.71 in × 1.71 in (43.3 mm × 43.3 mm) at 300 DPI
  • 1024 px — 3.41 in × 3.41 in (86.7 mm × 86.7 mm) at 300 DPI
  • 2048 px — 6.83 in × 6.83 in (173.4 mm × 173.4 mm) at 300 DPI
  The readout applies to the PNG; the SVG download is vector and scales to the size the layout gives it.

The same destination at four lengths

Four links to the same fictional menu, from the bare domain to a long query string. Every cell is the engine's own output for that payload at the requested level M; the last column divides the 512 px preset (which prints at 1.71 in × 1.71 in (43.3 mm × 43.3 mm) at 300 DPI) by the modules across the image, quiet zone included, to give the pixels per module.

Reading down the table: the characters grow, the version steps up from 2 to 5, and each module gets narrower at the same pixel size. That is the whole mechanism behind "keep the URL short". The table is generated at build time and would change — or fail the build — if the encoder ever changed, so it cannot silently disagree with the generator above.

The engine validates format, not truth. It can tell that example.com/menu is not a complete URL; it cannot tell that https://example.com/sumer-menu has a letter missing. A mistyped address encodes just as cleanly as the right one — exactly as a wrong WiFi password produces a flawless WiFi code — and the symbol facts will look perfectly healthy. The builder is a pure function with no network access: it never fetches the address, so it cannot know whether the page exists, whether it is the page you meant, or whether the link is safe to open.

Nor can the symbol be corrected later. The code is static: the link lives in the image, with no redirect through our servers, which is why it cannot expire or be held hostage — and why it cannot be edited after printing. The remedy is the one the methodology page gives for every generator: treat a freshly generated code as untested until a real device has scanned it and landed on the page you expected. Error correction helps a damaged code scan, but print size and contrast still matter, and neither rescues a wrong link.

• Cropping the white border. The 4-module quiet zone is required by the standard around the symbol; it is not optional padding. Trimming it to fit a layout, or printing the code flush against artwork, is the most common self-inflicted scan failure. The downloads include it; leave it there.
• Inverting the colours. A light code on a dark background looks striking and is rejected by many scanners. The style panel measures your pair with the same assessor that produced these readouts: black on white scores 21.0:1 with no warning; white on black scores 21.0:1 — the ratio is symmetric — and triggers "Light-on-dark (inverted) codes are not reliably read by all scanners. Prefer dark modules on a light background."
• Low contrast. Below 4.5:1 the panel warns, with the measured ratio in the message. A mid-grey #9a9a9a on white produces: "Low contrast (2.81:1). Scanners may fail below 4.5:1 — darken the foreground or lighten the background."
• Expecting the generator to shorten or track the link. It does neither. The payload is your URL and nothing else, which is why the code has no expiry date and no scan counter. The section below explains the trade-off in full.
• Leaving the protocol off. example.com/menu is refused, not repaired; add https:// and the same text is accepted unchanged.
• Trusting a clean-looking symbol. A symbol with healthy facts proves that the text encoded; it proves nothing about where the text leads. Scan it.

Many QR services silently replace your link with a shortened one on their own domain. That is how they offer scan counts and "editable" codes — every scan passes through their server first. We do not do that, and you should know the trade-off you are choosing on each side:

• Direct (this site): the code contains your URL. It cannot expire, cannot be held hostage by a subscription, adds no third party between your visitor and your site — and consequently there is no scan analytics and no editing after printing.
• Shortened/dynamic (other services): editable destination and scan counts, but the printed code is only as durable as that company's domain, business model, and your subscription. If any of the three lapses, every printed code dies at once.

If you legitimately need a shorter payload — very long URLs make dense codes — shorten the URL at the source (a cleaner path on your own domain) rather than through a tracking middleman. And if you want scan statistics, add a query parameter like ?src=poster and count it in your own website analytics: same insight, no middleman.

Special cases with their own pages: Google review links, WhatsApp chat links, and plain text when there is no URL at all.