Definitions for the QR code and QRForge terms that show up across the product and guides.
A 2D matrix barcode that encodes text, URLs, or structured data, readable by a phone camera.
A QR (Quick Response) code is a two-dimensional barcode defined by ISO/IEC 18004. It encodes up to around 4,000 characters of text or 7,000 numeric digits in a grid of black and white modules. Modern phone cameras on iOS 11+ and Android 8+ read QR codes natively with no app install required.
A QR code whose destination is encoded directly into the printed pattern and cannot be changed after printing.
A static code encodes the target (a URL, vCard, Wi-Fi string) verbatim. Scanning decodes the exact bytes printed. Static codes work offline, never expire, and cost nothing — but if the destination needs to change, you have to generate and print a new code.
A QR code that encodes a short link on a provider domain, redirecting to an editable destination.
Dynamic codes route through a short link (e.g. /q/abc123). The final destination lives on a server and can be changed anytime without reprinting. Dynamic codes also enable per-scan analytics — device, browser, country, timestamp — that static codes cannot provide because there's no server in the loop.
Redundant data that lets a scanner recover the payload even when part of the code is obscured or damaged.
QR codes include Reed–Solomon error-correction codewords. Four levels are defined: L (7%), M (15%), Q (25%), and H (30%). When overlaying a logo, always use level H — the 30% redundancy lets the scanner reconstruct the modules covered by the logo. Higher correction means a larger code for the same payload.
A single black or white square in the QR code pattern. Each module carries one bit of data.
The total number of modules depends on the payload length and error-correction level. A small QR code starts at 21×21 modules (Version 1); the largest standard version is 177×177 (Version 40). Module size in print should be at least 0.25 mm for reliable scanning.
A brand mark placed on top of a QR code, covering part of the pattern.
Logos typically cover 15–30% of the code area. Because error correction can recover a missing portion, overlays are safe as long as they don't exceed the redundancy budget and sit centrally, not over format or timing patterns. Keep logos under 25% of the code area and use error-correction level H.
The empty margin around a QR code that lets scanners detect its boundaries.
The QR code spec requires a quiet zone of at least 4 modules of empty space on all sides. Codes printed without a quiet zone — butted against other ink or a colored background — scan unreliably or fail entirely. When in doubt, increase the margin.
A text string format that encodes Wi-Fi credentials so a scanned QR code joins the network automatically.
The format is WIFI:T:<type>;S:<ssid>;P:<password>;H:<hidden>;; where T is WPA, WEP, or nopass. Semicolons, commas, colons, quotes, and backslashes in the SSID or password must be backslash-escaped. Native support exists on iOS 11+ and Android 10+.
A QR code that encodes contact details in vCard format so a scan saves the contact to the phone.
vCard is a text-based format (RFC 6350) for electronic business cards. A QR-encoded vCard includes fields like FN (full name), ORG, TEL, EMAIL, and URL. Scanning opens a contact-save prompt. Keep vCards short to avoid bloating the QR — phone and email are the essentials.
The server component that receives scans of a dynamic QR code and routes them to the current target URL.
When a dynamic code is scanned, the scanner's browser hits the redirector at the provider's short-link URL. The redirector looks up the current destination, logs the scan event, and responds with an HTTP 302 redirect. Redirector uptime is the single most important operational metric for a dynamic-QR provider.
Data collected each time a dynamic QR code is scanned — device, browser, country, timestamp, referrer.
Scan analytics let you measure the real-world performance of printed QR codes. Good providers hash IP addresses so unique-visitor counts work without storing PII, detect and exclude bot traffic, and retain history long enough to compare month-over-month.
A secret string that authenticates API requests to the QR generation endpoint.
API keys are issued from the dashboard and sent in the Authorization header as 'Bearer qrf_...'. Keys are hashed before storage — we never see the plaintext after issuance. If a key is leaked, revoke it from the dashboard and create a new one; revocation takes effect immediately.
The maximum number of API requests allowed per minute on a given API key.
Every API response includes X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers so clients can back off cleanly. Exceeding the limit returns HTTP 429. Rate limits are enforced per key, not per account, so keys with different rate limits can coexist.