What Data Do QR Codes Contain?
QR codes can encode a wide variety of content types, and some of them carry sensitive personal or business information: • URLs — website addresses, including private internal links or authentication tokens • WiFi credentials — network name (SSID) and password in plain text within the QR pattern • Contact cards (vCard format) — full name, multiple phone numbers, email addresses, physical address, organization • Email addresses with pre-composed subjects and message bodies • Phone numbers and pre-written SMS messages All of this data is embedded directly in the QR code pattern and can be read by anyone who scans it or decodes the image.
Risks of Online QR Generators
Many online QR code generators pose hidden privacy risks that most users never consider: • Your WiFi password is transmitted in plain text to their server during generation — potentially logged and accessible to their staff • Contact information including phone numbers, email addresses, and home addresses is sent to and logged by their servers • Some services inject tracking redirect URLs that route through their servers, allowing them to monitor every scan — who scanned it, when, from what location • QR codes generated by third-party dynamic URL services may expire or be modified later without your knowledge • Your usage patterns — what types of QR codes you generate — reveal potentially sensitive business and personal information • There is no guarantee that the data you submitted is deleted after the QR code is generated
How PrivaQR Protects Your Data
PrivaQR uses the qrcode.js JavaScript library to generate QR codes entirely in your browser using client-side computation: • Zero network requests during generation — all QR code creation happens locally via JavaScript, with no data sent to any server • WiFi passwords are encoded into the QR pattern locally and never leave your device • Contact details stay completely private on your device throughout the generation process • No tracking URLs are injected — your QR codes link directly to your intended destination without routing through any intermediary • Custom colors, error correction level, and output size are all processed client-side • Download as PNG or SVG without any server interaction
Why QR Codes Are Uniquely Easy to Abuse
Two properties make QR codes risky in a way ordinary links are not. First, they are unreadable to humans — you cannot tell a legitimate destination from a malicious one by looking, so a code physically pasted over a real one (on a parking meter, a restaurant table, a delivery notice) can route you somewhere hostile with no visible warning. This "quishing" (QR phishing) has been documented against banks and transit systems worldwide. Second, generation leaks the secret: because the encoded data — a WiFi password, a home address in a vCard — is created the instant you type it into a generator, a server-side generator sees the raw value before the image even exists. The defense is structural: generate locally so the secret never travels, and always preview a scanned code's decoded URL before acting on it.