QR Code Error Correction and Privacy
A QR code is not just a picture of a link. It is a small, self-repairing data structure with a redundancy budget you get to choose, and the service that generates it decides whether the code points at your destination or at somebody else's tracking server first. This article covers those two ideas - error correction and provenance. If you just want the click-by-click walkthrough, read how to create a QR code and then come back.
What error correction actually does
Every QR code stores its payload twice over, in a sense. Alongside the encoded data it carries Reed-Solomon error correction codewords, the same family of math used on CDs and in deep-space telemetry. A scanner that reads a damaged code can reconstruct the missing pieces from those extra codewords instead of failing outright. That is why a QR code with a coffee ring on it, a torn corner, or a logo sitting in the middle still resolves.
The specification defines four levels of redundancy. Higher levels tolerate more damage but consume more of the symbol, so the same URL produces a physically denser pattern.
| Level | Recoverable damage | Best for |
|---|---|---|
| L (Low) | About 7% | Clean screens, long payloads where symbol size is the constraint |
| M (Medium) | About 15% | The common default for general print |
| Q (Quartile) | About 25% | Industrial labels, surfaces that get handled |
| H (High) | About 30% | Codes with a logo overlay, outdoor signage, anything that will be abused |
Why level H is the right default
Our QR Code Generator encodes at level H, the highest setting. For the short URLs and WiFi strings most people encode, the extra codewords cost almost nothing in practice - the symbol grows by a version or two and stays perfectly scannable at 256 pixels. What you buy is durability. Codes printed on packaging get scuffed. Codes on posters get rained on. Codes on stickers get partly peeled. Level H absorbs all of that.
Level H is also what makes centre logos possible at all. If a design overlays a badge on a level L code, it is eating into data modules that have no backup, and the code fails. On a level H code the same overlay usually falls inside the recoverable budget.
Contrast, quiet zone, and size
Error correction cannot rescue a code that the camera never resolved cleanly. Three physical properties matter more than the redundancy level:
- Polarity. Scanners expect dark modules on a light background. The tool gives you a foreground and a background colour picker, and it is tempting to invert them for aesthetics. Many readers cope, but a meaningful minority do not. Keep the dark-on-light relationship and just tint the two ends.
- Contrast ratio. A pastel code on a cream card looks lovely and scans badly. Pick a foreground dark enough that the difference survives a phone camera in poor light.
- The quiet zone. The blank margin around the symbol is part of the symbol. Do not crop it off or let a border touch it.
For size, a workable rule of thumb is that the printed code should be roughly one tenth of the intended scanning distance. A code read from two metres away wants to be about twenty centimetres across. The 128, 256, and 512 pixel exports in the tool map to screen use, ordinary print, and large-format print respectively.
The privacy problem with hosted QR services
Most "free QR code generator" sites do not encode your URL. They encode their URL, which redirects to yours. That indirection is sold as a feature - you can edit the destination later - and it is genuinely useful for a printed campaign. But it changes who is in the middle of the transaction:
- Every scan is logged by a third party, typically with timestamp, coarse location, device type, and referring campaign.
- Your code stops working if that company folds, changes pricing, or decides your free tier has expired. Codes printed on physical objects outlive subscriptions.
- Scanners increasingly warn on unfamiliar redirect domains, and some corporate mail filters block them, so a tracked code can look less trustworthy than a plain one.
Link shorteners are the same trade in miniature. They hide the destination from the person deciding whether to scan, they add a dependency you do not own, and they attach analytics to a click you never asked to be measured.
Static codes and how to keep them editable
A static code encodes the destination directly, so it never expires and nobody sits in between. The obvious cost is that you cannot change where it points once it is printed. The fix is to own the indirection yourself: encode a URL on your own domain, such as a short path that you redirect server-side. You keep the ability to repoint the code and nobody else gets the scan log.
Because our generator builds the code with a JavaScript library running in your tab, the text you type - a WiFi password, a private event link, a phone number - is never sent anywhere. The PNG is drawn to a canvas on your machine and downloaded from it. There is no account, no shortening step, and no scan counter, because there is nothing on our side to count.
Where to go next
Follow the step-by-step QR code guide to produce your first code, then see our roundup of image tools for developers if you are packaging the code into a site or app, or JPG vs PNG vs WebP if you need the exported PNG in another format. More articles are indexed on the Privacy Pix Tools blog.