A QR code looks like a simple picture. What it contains, though, can be two very different things: a direct link to your destination, or a link to a middleman's server that records the scan and then forwards the visitor. Both kinds scan the same way on a phone. Only one of them keeps the scan private. If you have ever wondered whether a QR generator is watching your customers, the answer depends on which kind of code it makes — and most people never check.
QR Code Generator makes the direct kind: the code is drawn in your browser for whatever text or URL you enter, with size and error-correction controls, downloadable as PNG or SVG — and no tracking link sits between the code and its destination. This post explains how redirect-based codes work, why they exist, what they cost you in privacy and control, and how to tell which kind you have.
How a redirect code watches a scan
A redirect code does not contain your website address. It contains an address belonging to the generator company, plus a short identifier. When someone scans it, their phone first contacts that company's server, which logs the scan — often the time, the device type, and an approximate location — and then forwards the visitor to your real destination. The visitor usually notices nothing: the redirect is fast, and the final page is the one they expected.
For the generator company, this is a business model. The free code is paid for by the data, or by the ability to charge later for features such as changing the destination, viewing scan statistics, or keeping the redirect alive. For you, the cost is subtler: your customers' scans pass through a third party you did not choose for them, and your link depends on that third party's server staying up, staying in business, and staying honest. If the company closes, changes its terms, or starts charging for redirects, your printed codes can stop working — even though your website is fine.
How a direct code differs
A direct code contains your destination itself. Scan it, and the phone goes straight to your address (or displays your text) without contacting anyone else first. There is no middleman to log the scan, no server to go down, and no subscription that can switch your codes off. The trade-off is equally plain: a direct code cannot be edited after printing, because the destination is baked into the pattern itself. If your web address changes, the printed code must be reprinted. And a direct code gives you no scan statistics — if you want to know how many people scanned, you need your own analytics on the destination page, for example through consistently tagged links built with UTM Campaign Builder.
That trade-off is worth making deliberately rather than drifting into it. A menu, a business card, or a poster is usually printed once and used for months or years; a code that depends on a stranger's server for all that time is a fragile foundation for something so permanent. A direct code's permanence is its strength: what you print is what works, for as long as the destination itself exists.
How to tell which kind you have
You do not need special tools to check. Scan the code with your phone's camera and look at the address it offers before tapping through. If the address is your own domain, the code is direct. If it is a short domain or a domain belonging to a QR company, with your address nowhere in sight, the code routes through a redirect. A second check is to look at the generator's own description: tools that offer "dynamic" codes, scan statistics, or destination editing after printing are, by definition, redirect-based — those features are only possible because the middleman sits in the middle.
Also check what the code contains beyond a URL. Some generators add their own branding or a tracking parameter to your address before encoding it. A direct code for a plain address should contain exactly that address. Anything extra deserves a question before it goes to print.
Worked example: a fictional café's menu code
A fictional café, Example Corner Café, wants a QR code on each table linking to its online menu at https://example.com/menu. The owner tries a popular generator first and gets a code that scans to a short redirect address. It works, and the generator's dashboard even shows a handful of scans. But the fine print says the redirect is part of a free tier that may change, and the café's printed table cards cannot be recalled if it does.
The owner rebuilds the code with the browser-drawn generator instead: the same destination, https://example.com/menu, encoded directly, with a medium error-correction level and a PNG download sized for print. Scanning the new code offers https://example.com/menu immediately — no middleman domain in sight. The café loses the scan dashboard, but it gains something more valuable for print: a code that will keep working as long as the menu page itself exists, with no third party standing between a customer and a menu. If the café later wants to measure menu visits, it can add UTM tags to the destination address itself before generating the code, so its own analytics — not a QR company's dashboard — record the visits.
Honest limitations
A direct code does not guarantee scans. Print size, contrast, and testing matter at least as much as the code's content: a code printed too small, in low contrast, or on a curved or glossy surface may fail to scan no matter how clean its destination is. A direct code also cannot be updated after printing, cannot report scan counts by itself, and cannot fix a destination page that is down or mistyped. Always test the printed result with more than one phone, at the distance customers will actually stand, before printing a full run. For preparing the image itself, Image Optimizer can resize and compress artwork for print and web, and the background guide is UTM parameters explained.
FAQs
Do QR code generators track scans?
Some do. Generators that route scans through their own redirect server can log the time, device, and approximate location of each scan. Direct codes, drawn in the browser with your destination encoded in the pattern itself, pass through no middleman and are not tracked that way.
How can I tell if my QR code uses a redirect?
Scan it and look at the address your phone offers before tapping. If it shows your own domain, it is direct. If it shows a QR company's domain or a short link, it routes through a redirect.
Can I change a QR code's destination after printing?
Only with a redirect-based ("dynamic") code, because the destination lives on the middleman's server. A direct code's destination is baked into the printed pattern, so a changed address means reprinting — the price of independence from the middleman.
Should I use PNG or SVG for a QR code?
PNG suits most print and screen uses at a fixed size. SVG suits cases where the code must scale — a large poster, for example — because it stays sharp at any size. Choose based on where the code will be printed, and test the final size.
Related reading: Tag the destination URL first.
human review pending client designation