How to make a QR code without uploading the payload

The usual failure

A café owner types the WiFi password into a popular generator, downloads a PNG with a watermark, then pays to remove it. The password has already crossed the network. A recruiter pastes a personal mobile number into a vCard form on a site that “helps you design QR codes.” That number is now in someone else’s request log. The symptom is not a crash. The symptom is a secret sitting on a server you do not run.

Upload generators also tend to wrap your payload in their own short link so they can count scans. The printed sticker then depends on that vendor. If you wanted a static code, you did not get one.

Why this page is different

Mark uses the open-source qrcode encoder (soldair/node-qrcode) in the browser, then draws modules onto a Canvas. Optional logo overlay is our own draw, not a third-party QR SaaS. There is no call to qrserver, goqr or Google Chart. If you watch the network panel while you type a password, you should not see that password in a POST body.

Limits are honest. QR versions have a capacity. A 2 MB logo is too large. HEIC is not decoded here. Low contrast is warned, not silently shipped. SVG is offered only when there is no raster logo.

Steps

1. Open the generator. Leave the type on URL for a link, or switch to WiFi, vCard, Email, Phone, SMS or Text.
2. Fill the fields. For a URL, “example.com” becomes https://example.com. For WiFi, pick WPA unless the network is actually open. For vCard, first name plus a phone number is already useful.
3. Watch the preview. It updates after a short debounce. An empty field disables download on purpose — we will not emit a scannable code of an empty string and call it a feature.
4. Optional: set size 512 (default) or 1024 for print, margin 4 modules, colors near black on white. Drop a logo only if you will test the scan. Error correction becomes H automatically.
5. Download PNG. Download SVG if there is no logo. On iPhone, use Share if the file does not appear in Files. Open the camera app and scan the image on the same phone before you send it to a printer.

If it does not scan

Five common causes, in the order we see them:

1. Foreground too light on a light background (yellow on white is the classic miss).
2. Logo covering a finder pattern because it was scaled past the centre island.
3. Quiet zone cropped in print — the margin was set to 2 and the shop trimmed the paper.
4. Payload too long, so the modules became a dense speckle at 256 pixels.
5. Gloss lamination plus a phone held at a sharp angle; try matte stock or a larger print.

There is a longer list on troubleshooting. If the scan fails after you sent the PNG through a chat, that is recode, not contrast — see WhatsApp.

Error correction, size and the logo

Error correction L recovers the least damage and packs more data. M is the default. Q and H spend modules on redundancy. A logo punches a hole in the centre, so H is mandatory — Mark switches it for you. Size 256 is for on-screen shares; 512 is the default; 1024 is for print. A 1024-pixel canvas is still a raster: if you need infinite scale without a logo, that is the SVG button, not a bigger PNG.

iOS may refuse to “download” and still happily Share a PNG into Photos. That is enough. Do not assume ClipboardItem works in Safari. After the file is on the phone, open Camera and scan your own lock screen or a printed proof — scanning the preview in the same tab can succeed while a scaled-down Instagram crop later fails.

After you close the tab

The URL, password and vCard are gone from Mark’s memory. The PNG on disk is yours. Scanning it does not notify us. If you encoded a WiFi password, anyone who photographs the sticker can join that network — that is how guest QR works, and also why you should not print the staff VLAN on a window.

Compared with Photos, Canva and upload sites

Apple’s Camera can read codes; it does not give you a designer for WiFi strings. Canva and similar editors will make a pretty frame, then often generate the matrix through a cloud API. A dedicated upload generator will watermark the free tier. Mark is unpretty on purpose: modules, quiet zone, a stamp-like preview. If you need a campaign with editable destinations, use a dynamic vendor and accept the server. If you need a private static mark, stay here.