QR code generators are mostly safe, but there are two separate risks. As the creator, many tools send whatever you type — WiFi passwords, phone numbers — to their servers. For scanners, dynamic codes route every scan through the company's domain, and some services inject ads. Tools that generate codes in the browser avoid the first risk entirely.
Those two risks get blurred together in most write-ups. They deserve separate answers, because the fixes are different. One is about where your data goes when you make a code. The other is about where strangers go when they scan it.
What do QR code generators collect from creators?
Most QR generators are web forms. You type a URL, a WiFi password, or a full contact card. The site sends that data to its server, builds the image there, and returns it. Your data now sits in their request logs, and possibly in their database, under whatever retention policy they have.
For a plain URL, that matters little — the URL was public anyway. For a WiFi code, you just transmitted your network password to a company you found on page one of Google. For a vCard, you handed over your name, phone number, and address in one structured payload. Few privacy policies say plainly what happens to that form data.
Some generators run entirely in your browser instead. JavaScript on your device builds the code. Nothing is transmitted. Qranite works this way, which is also why our static codes cannot expire — there is no server involved that could switch them off.
Can a QR code generator see my WiFi password?
Yes, if the code is generated server-side. The password travels in the request like any form submission. Whether it is stored, logged for thirty days, or discarded immediately depends on the company. From the outside, you cannot tell.
There is a two-minute test. Load the generator page, then turn off your internet connection. Now try to create a code. If a working code appears, the tool is client-side and your password never left your device. If the page errors or spins, your data was headed to a server. Qranite passes this test. Try it on the homepage generator with airplane mode on.
Are QR codes safe to scan?
Static codes are the safest kind. The destination is encoded directly in the image, and a scan goes straight there with nobody in the middle. The code is just data — functionally a printed URL. This is true of static codes from any generator, including our competitors.
Dynamic codes are different. They contain a short link on the provider's domain. Every scan hits that domain first, gets logged, then redirects to your real destination. That middle hop is the whole product — it is how editing and analytics work. But it also puts a company between your scanner and your content, permanently.
That middleman can misbehave. ME-QR shows full-screen interstitial ads to people scanning free dynamic codes, per their own docs; making all your codes ad-free costs $27.99 per month. qr-code-generator.com redirects scans of expired trial codes to its own upsell page, per their support docs. Their Trustpilot rating sits around 1.4 of 5 across more than 9,200 reviews, and the one-star reviews describe exactly this.
What happens to scanners on popular generators?
The table below covers documented scanner-side behavior only — what each service's own support docs, pricing pages, and terms say happens to the people scanning your codes. Static codes are excluded because static codes from any generator go straight to the destination and keep working.
| Service | Documented behavior for scanners |
|---|---|
| qr-code-generator.com | Dynamic codes from the 14-day trial are deactivated when it ends; scans then redirect to an upsell page, per their support docs. |
| QR Tiger | Free dynamic codes stop after 500 scans each. All dynamic codes stop if your plan lapses, per their own policy. |
| ME-QR | Free dynamic codes show full-screen interstitial ads before the destination. Ad-free across all codes costs $27.99/mo, per their pricing. |
| QRFY | Codes are paused 7 days after creation unless you subscribe. Plans auto-renew annually with a no-refund policy, per their terms. |
| QRCode Monkey | Static codes are fine. The dynamic upsell routes to qrcode.studio, a separate paid service with its own subscription. |
| Qranite | Static codes go straight to the destination. Dynamic scans pass through qranite.com/r/ with no ads or interstitials, ever — even on lapsed plans. |
How do I check if a QR generator is safe?
Five checks, none of which require trusting marketing copy. Each takes a minute or two, and together they cover both the creator risk and the scanner risk.
- Run the offline test. Disconnect from the internet and try generating a code. Client-side tools still work. Server-side tools fail, which means your data was leaving your device.
- Decode the code before printing. Scan it with your own phone and read the URL your camera shows. Your domain means static and direct. Their domain means every scan routes through their servers, forever.
- Read the lapse policy. Search the service's docs for what happens when a trial or plan ends. If the answer is silence, assume the worst.
- Check the Trustpilot pattern. A cluster of one-star reviews saying 'my printed codes stopped working' is a business model, not bad luck.
- Prefer static codes unless you genuinely need editing or analytics. No account, no server, no party in the middle.
What Qranite collects, exactly
Static codes: nothing. Generation happens 100% in your browser. Your WiFi password, contact card, and URLs never reach our servers. We could not sell or leak that data, because we never receive it. That is the architecture, not a promise.
Dynamic codes: scans pass through a qranite.com/r/ short link, and we log day, country, and device type. That log is the analytics product you signed up for. We never sell scan data, and we never inject ads or interstitials between a scanner and your content. If you stop paying for a dynamic plan, your codes keep redirecting forever — you lose editing and analytics beyond free limits, not the redirect itself.
Safety here is mostly an architecture question. A generator that never sees your data cannot mishandle it. A redirect that never carries ads cannot annoy your scanners. Ask both questions before you print, and the rest takes care of itself.