What is a QR code?
A QR (Quick Response) code is a 2D matrix barcode invented in 1994 by Denso Wave. It stores data as a pattern of black and white squares and can encode text, URLs, contact info, or arbitrary binary data.
A QR code is not executable code. It is a data container. The scanner app decides what to do with the contents — and that's where most QR-related risks actually live.
Capacity
QR codes have 40 versions. Version 1 is a 21×21 grid; Version 40 is 177×177. Larger versions store more data.
| Mode | Best For | Max Capacity (v40, ECC=L) |
|---|---|---|
| Numeric | Digits only (0–9) | 7,089 chars |
| Alphanumeric | Uppercase letters, digits, spaces, $%*./:+- | 4,296 chars |
| Binary / UTF-8 | Any text, URLs, file data | 2,953 bytes |
| Kanji | Japanese characters | 1,817 chars |
Most real-world payloads fit well under 500 bytes. Larger QR codes require higher-resolution scans to read reliably.
Error Correction
QR codes include redundant data so they can still be scanned when partially damaged or obscured. You choose how much redundancy to include:
| Level | Flag | Damage Tolerance | Best For |
|---|---|---|---|
| Low | L | Up to 7% | Maximum data capacity; clean digital displays |
| Medium | M | Up to 15% | Balanced — the default for most use cases |
| Quartile | Q | Up to 25% | Printed QR codes; minor wear expected |
| High | H | Up to 30% | Outdoor signage; logos overlaid on the code |
Common Payload Formats
https://inkegg.io
WIFI:T:WPA;S:NetworkName;P:Password;;
BEGIN:VCARD VERSION:3.0 FN:Jane Doe TEL:5550100 EMAIL:jane@example.com END:VCARD
mailto:hello@example.com?subject=Hello
smsto:5550100:Your message here
geo:40.7128,-74.0060
Hello world! ASCII art, notes, anything.
BEGIN:VEVENT SUMMARY:Meeting DTSTART:20260601T100000Z DTEND:20260601T110000Z END:VEVENT
Safety
A QR code itself is inert. The risks come from what you put in it, and from the scanner that reads it.
- Tracking URLs: Commercial generators often replace your content with a redirect through their analytics server. The code encodes their URL, not yours.
- URL shorteners: Opaque links like
bit.ly/abc123hide the destination. Prefer full, readable URLs. - Scanner apps: Some auto-open URLs or execute actions without confirmation. Prefer scanners that show you the decoded content before acting on it.
- Physical tampering: In public spaces, stickers can be placed over legitimate QR codes. Inspect the destination before proceeding with anything sensitive.
- javascript: URLs: Some older scanners would treat
javascript:payloads as executable. Modern browsers block this, but it's still best practice to avoid encoding them.
How InkEgg Generates QR Codes
- Client-side only. Your content is encoded in your browser. For offline codes, nothing is sent to any server.
- No tracking URLs. InkEgg does not wrap your payload in a redirect or analytics link.
- No logs, no ads. Anonymous QR generation collects nothing.
- Open-source library. Uses qrcode — auditable, MIT-licensed.
- Optional hosted refs. Logged-in users can publish a public page and encode that URL. The content at that URL can be updated anytime — no reprinting required.