Technical reference
What a QR code actually stores
A QR code is a container for text. The prefix and structure of that text tell a phone whether to open a website, join WiFi, create a contact, draft a message or add an event. This reference shows the exact payloads our generator builds and the checks to perform before printing.
Reviewed August 4, 2026 · 10 minute read
Start by separating the image from the payload
The black-and-white symbol is only an encoded representation. Changing colors or downloading SVG instead of PNG does not change the destination. Changing even one character in the payload does. For that reason, the safest workflow is to inspect the generated text, scan the final image, and verify the action the phone proposes before approving a print run.
QR readers do not all interpret convenience formats identically. A plain HTTPS URL has the broadest behavior: the camera offers to open it in a browser. WiFi, contact, SMS and calendar payloads depend on conventions or standards implemented by the phone. Test structured codes on both iOS and Android when the audience is mixed.
Common payloads at a glance
| Action | Encoded text |
|---|---|
| Website | https://example.com/menu |
| Phone | tel:+40712345678 |
| SMS | SMSTO:+40712345678:Your appointment is confirmed |
| mailto:hello@example.com?subject=Hello&body=I%20have%20a%20question | |
| WiFi | WIFI:T:WPA;S:Guest Network;P:example-password;H:false;; |
These examples contain readable placeholder data. Do not publish a real WiFi password, private phone number or personal contact card unless everyone who can see the code is allowed to decode that information.
URL codes: simple, but verify the final address
Encode the complete HTTPS address, including the scheme. A code containing example.com may still be recognized, but https://example.com is explicit and more predictable. Open the destination in a private window before generating the code so you can catch sign-in requirements, expired sharing permissions and mobile layout problems.
Remove unnecessary tracking parameters when they do not serve a real measurement need. Shorter input normally produces a less dense symbol. If the URL redirects, verify the entire chain and make sure you control every service on which a permanent print depends.
WiFi codes: escape punctuation and disclose the security type
A commonly supported WiFi payload starts with WIFI: and contains fields separated by semicolons. T is the security type, S is the network name, P is the password, and H indicates a hidden network. Semicolons, commas, colons, quotation marks and backslashes inside a value must be escaped with a backslash so they are not mistaken for separators.
WIFI:T:WPA;S:Cafe Guest;P:coffee\;and\;wifi;H:false;;Select nopass only for an open network. WPA is the appropriate choice for the WPA2 and WPA3 networks most users encounter. After printing, forget the network on a test phone and scan again; testing with a phone that is already connected can hide a malformed payload.
vCard contacts: human-readable fields inside a standard record
vCard is a structured text format. A minimal useful card includes a version, structured name, display name and at least one contact method. Optional empty lines are usually harmless, but very large contact cards create denser symbols. Keep only information the recipient needs.
BEGIN:VCARD
VERSION:3.0
N:Popescu;Ana;;;
FN:Ana Popescu
ORG:Example Studio
TEL:+40712345678
EMAIL:ana@example.com
URL:https://example.com
END:VCARDThe phone should show a contact preview, not save silently. Check that first name and surname land in the correct fields and that international phone numbers retain their country code.
Phone, SMS, WhatsApp and email
A phone payload uses the tel: URI. An email payload uses mailto:; its subject and body belong in the query string and must be URL-encoded. Our generator performs that encoding, so spaces, ampersands and line breaks do not corrupt the link. SMS conventions vary more between platforms, which is why the final device test matters.
A WhatsApp code normally contains an HTTPS wa.me link rather than a private QR format. Use the full international number without spaces or punctuation. The scanner still chooses whether to open the app or website. A QR code cannot confirm that the recipient owns the number.
Map links and calendar events
For maps, a web URL with an encoded search query is more portable than an app-specific deep link. A street address is convenient; latitude and longitude are more precise for entrances, trailheads and large venues. Always scan from a phone that does not already have the location in recent history.
Calendar payloads use iCalendar-style properties such as SUMMARY, LOCATION, DTSTART and DTEND. Time zones are the main trap. The current generator treats the entered date and time as local wall time because a small static form cannot know the event organizer's intended time-zone rules. For travel, broadcast events or daylight-saving transitions, prefer a public calendar-event URL managed by the organizer.
Validation checklist
- Read the previewed action on the phone before tapping it.
- Confirm every field, especially country codes, dates, recipient addresses and passwords.
- Test the final exported file, not only the live preview.
- Print at actual size and test with at least two different phones.
- Keep a readable fallback URL or contact method beside important codes.
Primary references
Build one of these payloads
The generator creates the structured text locally and updates the QR preview as you type.