QR Code Generator API

Returns a real, scannable QR symbol as SVG (Content-Type: image/svg+xml), encoded to ISO/IEC 18004 — Reed-Solomon error correction over GF(256), the standard block interleaving, BCH-protected format and version information, and full evaluation of all eight data masks. Drop it straight into an <img src>; the same URL always returns a byte-identical image and is served with long cache headers, so it is safe to hotlink.

Two routes. /image renders the symbol. /info answers the sizing questions without downloading an image: which version the payload needs, how many modules that is, the mask that scored best, and how much room is left at each error-correction level.

Encoding mode is a documented rule, never a guess. mode=auto (the default) picks numeric when every character is a digit, alphanumeric when every character is in the 45-character QR set (0-9 A-Z, space, $ % * + - . / :), and byte otherwise. Force a mode with mode=; a payload the mode cannot represent returns 400 naming the offending character and its position, and nothing is ever truncated.

Version selection takes the smallest version (1–40) whose data capacity at the chosen level fits the bit stream, and the response is a 400 stating the exact limit for that mode and level if nothing fits. The 900-character cap bounds the symbol differently at each level, because byte mode is measured in UTF-8 bytes rather than characters: at level L it tops out at version 39 (173 × 173 modules, 2,809 bytes), while at M, Q and H a multi-byte payload does reach version 40 (177 × 177) — the format's largest symbol — from 738 three-byte characters at M, 527 at Q and 407 at H.

Error correction. ecc=L|M|Q|H recovers roughly 7%, 15%, 25% and 30% of codewords respectively. Higher levels are more robust on damaged or curved surfaces but push the payload into a larger symbol.

Rendering. scale sets pixels per module (1–16, default 4), quietZone the light border in modules (0–8, default 4 — the standard's minimum; smaller values are out of spec and may not scan), and fg/bg the module and background colours as 3- or 6-digit hex. Dark-on-light with strong contrast is what scanners expect; identical fg and bg are rejected.

Scope and honesty. This endpoint encodes only — there is no decoder or scanner here. Output is SVG only; there is no raster route, so it is not a fit for HTML email, where the major clients strip or ignore SVG <img> sources. Byte mode emits UTF-8 without an ECI designator, the de-facto convention that modern readers auto-detect; ISO/IEC 18004 nominally defaults byte mode to ISO/IEC 8859-1, so a strict reader may interpret non-ASCII bytes differently. Kanji mode, ECI segments, structured append, multi-segment optimisation and Micro QR are not implemented, and there are no logo overlays or artistic QR styles — an overlay silently spends the error-correction budget this page quotes, so we will not claim a recovery rate we no longer control. The module matrix is correct, but whether a given print or screen actually scans also depends on physical size, resolution and contrast, which we cannot control. The 900-character limit counts UTF-16 code units, so characters outside the Basic Multilingual Plane (most emoji) count as two.

Your payload is public. It travels in the query string, so it is logged, cached and visible to every proxy, mail filter and URL scanner on the path — which is exactly why this endpoint adds no obfuscation value to a phishing link: the destination is readable without decoding the symbol. Do not encode passwords, tokens or anything else secret.

QR Code is a registered trademark of DENSO WAVE INCORPORATED. This is an independent implementation of the published ISO/IEC 18004 symbology, not affiliated with or endorsed by the trademark holder.