Topic
File formats, bulk generation and code safety
The technical side: which file to download, how to generate at volume, and what a QR code can and cannot tell you.
Once a code is designed, a set of practical questions follow that have nothing to do with how it looks. Which file format survives a printer. How to produce four hundred of them without checking each one by hand. Whether a code can be trusted at all.
These are the questions that come up after the interesting design work is finished, and they are where projects quietly go wrong — an upscaled PNG sent to a printer, a batch of codes pointing at the wrong records, a sticker placed over someone else's code.
None of it is difficult, but most of it is invisible until it fails.
What you'll learn here
- Why vector formats matter more for QR codes than for ordinary images, and why JPG is the worst choice.
- How to generate codes in bulk and verify a whole batch without inspecting them by eye.
- What a QR code can and cannot do to your phone, and how attackers exploit the format's opacity.
- How to publish codes people can reasonably trust.
3 guides
GuidesQR code security: what a code can and cannot tell you
A QR code hides its destination until scanned, which is exactly what makes malicious codes effective.
GuidesGenerating QR codes in bulk
Generate programmatically through an API, keep payloads short and consistent, and verify by decoding every generated image back to text and comparing it byte-for-byte against the intended value.
GuidesPNG, SVG, PDF or JPG: which QR code file to download
Use SVG or PDF for anything printed, because they are vector and stay sharp at any size.
Common questions
- What file format should a printed QR code be?
- SVG or PDF. Both are vector, so the code stays sharp at any size and nothing is upscaled. PNG is fine for screens but should not be enlarged for print.
- How do I verify hundreds of generated codes?
- Decode every image back to text automatically and compare byte-for-byte with the intended payload. Visual checking cannot catch a systematic error that produces valid codes pointing at the wrong records.
- Can scanning a QR code harm my phone?
- Scanning alone hands your phone a string of text and nothing more. The risk lies in acting on it — visiting a malicious page or entering credentials — which is why reading the URL preview before tapping matters.
Related topics
Design
How far you can push shape, colour and branding before a decoder stops finding your code.
Choosing a code type
Static or dynamic, and which payload format actually does what you want.
Build a code with these rules applied
The generator shows a live contrast reading and blocks corner shape pairings our testing found unreadable, so most of what you just read is enforced as you design.
Open the generator