How to create a QR code that scans reliably
Choose content, size and error correction, then test a QR code before printing or publishing it.
Encode the shortest trustworthy destination
A QR code stores data; it does not verify whether that data is safe. For a website, use the final HTTPS URL and remove unnecessary tracking parameters when possible. For plain text, check spelling and line breaks. Shorter content generally produces a less dense symbol that is easier to scan at a given physical size.
Avoid placing passwords, private tokens or personal records in a QR code. Anyone who sees the image can decode it. If the destination may change, understand that a directly encoded static URL cannot be edited later. A redirect service adds flexibility but also adds dependency, tracking and the risk that the redirect account or domain expires.
Choose size and error correction together
QR codes offer four common error-correction levels: L, M, Q and H. Higher levels can recover from more damaged codewords, but add redundancy and can make the symbol denser. DENSO WAVE describes M as a frequently used general level, while Q or H can suit dirtier environments. Choose based on print conditions rather than automatically selecting the highest value.
Preserve the quiet white area around the symbol. Do not stretch the image, crop its border or place it over a busy photograph. Print size depends on symbol density and scanning distance. A small code containing a long URL can fail even when the downloaded PNG looks sharp on a monitor.
Test the real production version
Scan with at least two different phones or scanner apps before publishing. Test the exact printed item, screen, label or sign at realistic distance and light. Confirm that the displayed destination is correct before opening it. For public campaigns, ask another person to repeat the test without knowing the expected result.
After publishing, monitor the destination domain and TLS certificate for as long as the code remains visible. A QR code on a poster can outlive the webpage it references. Maintain redirects carefully and do not recycle an expired domain that appears on old signs, packaging or documents.
Current QR security and design practice
QR technology remains standardized and widely supported by phone cameras, but attackers also use codes to hide phishing destinations. Users should see the resolved address and recognize the domain before entering credentials or payment details. Organizations should pair a code with a readable short destination so people have context and an alternative.
Decorative logos, rounded modules and unusual colours may work in controlled tests, but deformation consumes the same tolerance needed for dirt or damage. SableApps generates a conventional dark-on-light symbol without an embedded logo. This conservative design improves predictable scanning and keeps the encoded content visible to any standards-compatible reader.
Worked example: a QR code for an event poster
Use the event's final HTTPS registration address rather than a draft link or a personal URL shortener. Generate a 512-pixel PNG at medium correction, place it on a plain light area and keep a clear border. Print a proof at the actual poster size; testing the image only on the design monitor does not reveal ink spread, glare or viewing-distance problems.
Scan the proof with Android and iPhone devices from the expected distance, confirm the domain shown by the camera and complete a test registration. Print the readable short URL below the code. Assign someone to maintain the destination through the event and for a reasonable period afterward, then archive or redirect it deliberately rather than allowing the domain or path to fail silently.
Quick checklist
- Use a short final URL or carefully checked text.
- Keep private values out of the code.
- Preserve the white quiet zone.
- Match correction level and physical size to conditions.
- Scan the final printed or displayed version twice.
- Maintain the destination for the code's full lifetime.
Primary references
Standards and platform support change. Use these authoritative sources to check the current specification and migration guidance.