Once it is ink, everyone with a camera is in the audience
Use this when you need a payload on paper or a slide: a HTTPS URL, a vCard, a guest Wi-Fi join string, a mailto with a subject. Generate, scan with your own phone at the print size you actually intend, then send the PNG to the printer. The unique failure is treating a QR as a private channel. It is a poster. Anyone who can see the marks can read the payload. Do not encode a secret you would not write in 48-point type on the same wall.
Wi-Fi join codes are the worst case. The WIFI: payload carries the SSID and the password in plaintext. Anyone who scans it joins as if you handed them a sticky note. Table tents at a café, slide 12 of an all-hands, a “staff network” sticker on a router in a glass office — those are publications. Rotate the passphrase when the intern leaves. Never put the production VLAN on a tent next to the muffins.
Worked example: 256px URL on a card vs 512px on a poster
Encode https://privytools.com/. At 256 pixels, the module size is fine for a business card held 20 cm from a camera. Print that same 256px file at A3 and the modules get interpolated into mush; scanners hunt and fail. For a poster read from 1.5 m, generate at 512 or larger and keep quiet zone (the white margin) intact. Cropping the margin off in Canva is how “the QR on the banner never worked” tickets start. Scan the physical print, not the PNG on your laptop.
Worked example: café Wi-Fi on a table tent
SSID CafeGuest, WPA, password Summer2026. The payload looks like WIFI:T:WPA;S:CafeGuest;P:Summer2026;;. Every phone that scans it gets the password. That is the feature for guests and the incident for a network you also use for the till. If Summer2026 is also the back-office password, you just published the till. Use a guest SSID with a password you are willing to reprint quarterly. If the tent is still on the table in December, the password is still Summer2026 for anyone who photographed it in June.
Worked example: a 7-day signed URL on 5,000 flyers
A presigned S3 or “magic login” URL that expires in 7 days is a fine SMS. It is a terrible print run. Flyers live in drawers. Day 8 every scan is a dead link. Same class of mistake: encoding a Bitly or campaign redirect when a stable HTTPS page would do, then losing the shortener account. If you need scan counts, that is your tracking URL, not this generator. This page draws an image. It does not run a SaaS that phones home when someone scans.
What this will not save you from
A logo slapped over the centre can kill finder patterns; test, do not assume. vCard is a payload, not a CRM — phones disagree on which fields they import. mailto and sms payloads still need a client that honors them. A QR that encodes an http:// URL on a 2026 poster will look like a phishing drill. Scan before you print. If your phone will not decode it, 5,000 copies will not decode it either.
Questions
Is a Wi-Fi QR secret?
No. The SSID and password sit in the payload. Anyone who scans it gets both. Treat a printed Wi-Fi code as a public notice.
Why did the banner scan fail?
Usually print size, missing quiet zone, or a 256px file stretched to A3. Generate larger, keep the white margin, scan the physical print.
Do I get scan analytics?
Only if you encode a tracking URL yourself. This image does not report home when someone points a camera at it.
Can I put a logo in the middle?
You can overlay one in another editor. Test every device you care about. Finder patterns are not decoration.
What about vCard / mailto / sms?
They are payloads. Phones disagree on import fields. Scan once before you print 500 badges.
Does the PNG phone home from this page?
The image is drawn in this tab. If the payload is a tracking link, that link fires when someone scans — that is your URL, not this generator.