Back to Blog

The Host Locked the Cards

September 16, 2026
Share:
The Host Locked the Cards

I printed a QR on a stack of cards. The square still looked the same a month later. The phone opened a paywall.

The generator had not drawn the URL I typed. It had drawn a pointer to a row they kept. When the trial ended, the pointer still worked. It just worked for them.

That is the product. A page that draws a static symbol in this tab, shows the payload in full, paints a logo in a band that leaves the finders alone, then reads the finished pixels with a decoder that did not write the grid. You download PNG or SVG. Nobody here hosts a redirect.

I shipped it as the thirty-second free tool on Softery.io. Rank 26 of 1,761 on the research card I had open, editorial score 9.2. That score is an opinion from the ranking file, not a forecast of how many phones will point at it tomorrow.

The Square Was a Pointer

A lot of free QR pages give you a picture that looks like a code. It is not. The modules encode a short address on their server. Their software looks that address up and sends the phone wherever the dashboard says today.

You cannot see that from the print. The square on the card is the same on day one and on day ninety. The thing that moved is a row you do not own.

I have watched this shape on invoice tools and on fax pages. The file you wanted was never the file. The file was a ticket. This sitting I did not sit through a paid QR dashboard. I did not need to. Once the square points at someone else's row, they can lock it.

A printer will print whatever you hand it. It will not warn you that the bytes in the modules are a login wall.


What Static Means Here

Static, on this page, means the bytes in the PNG or the SVG are the payload. Close the tab. Delete the account you never made. The file still encodes the same string.

It does not mean the site at the other end lives forever. A shop can move. A domain can expire. A human can take a page down. A picture cannot keep a URL alive, and I will not write that it can.

What this page can promise is smaller. Softery.io does not host a hop between the camera and the address you typed. There is no mapping I can meter or sell back to you.

KindWhat the phone opensWho can switch the square off
A PNG or SVG of a QRThe bytes you typedNobody who does not have the file
A square that hits a hostWhatever that host maps todayThe host
A dashboard QR productA short link they keepThe subscription

I will take the first row. The other two are fine products for people who want scan counts and a button that changes the destination after the cards are printed. They are a bad fit for a mark you cannot reprint.


The Payload Is Visible

The box above the download names the payload in full. If you typed a tracking parameter, it is still there. If you typed a Wi-Fi string, it is still there. I do not rewrite it into a host I control.

The URL in the modules is the URL you typed.

Believe that line. A preview can lie with anti-aliasing. A pretty logo can lie by covering a finder. The encoded line is the contract.

The sample is https://softery.io. That URL already lives on this site, so a first visit still produces a real code. You can replace it. The page trims spaces and then stops. It does not shorten. It does not wrap. Version 40 at level H will take 1,273 bytes. That number is the capacity table this encoder already ships, the same table the barcode tool uses.

If you paste more than that, the page refuses. It does not silently drop the tail.


A Logo Is a Hole

A logo in a QR is missing modules you chose. You cover them on purpose and you hope the error correction fills them back in.

This page will draw a mark between 8 and 20 percent of the symbol width. The default is 12. Those bounds are in the planner this sitting, not a taste I made up for the copy. A two module pad sits around the mark so the ink of the logo does not bleed into the data next to it.

The planner refuses a box that would sit on a finder. If a version 1 symbol cannot hold the mark, the page grows the version until the corners are clear, or it stops. A tiny URL with a huge mark is the case that fails first. Make the payload longer, or shrink the logo.

I do not let you type 40 percent and call the result branded. I have seen those files. They look great in a slide. A camera in a parking lot does not care about the slide.


The Finders Stay Clear

The three big squares in the corners are how a scanner finds the symbol. Cover one and a lot of phones give up before error correction even starts.

Each finder plus its separator is 8 modules. The pad is 2. The planner will not start the logo closer than that. That is a geometry check, not a vibe.

The barcode tool on this site already draws a plain QR. Use that one when you do not want a mark in the middle. This page exists because people do want a mark, and because the usual way to get one is to hand the URL to a host.

I reused the encoder the barcode page already had. I did not pull in a styling library that paints a logo and calls it done. The difference is the second decoder, which reads the raster after the logo is down.


Level H Is a Band, Not a Camera

Level H is on for every code here. The ISO QR spec treats that level as a band where about 30 percent of the codewords can be lost and still recovered. That is the room the logo spends.

It costs density. A long URL makes a tighter grid. A short URL on a small version cannot hold a 20 percent mark without eating a finder, which is why the page bumps the version instead of hoping.

After the logo is painted, a second decoder reads the pixels. That decoder was written from the same standard as the encoder, not by walking the encoder backwards. If the read matches what you typed, you see it. If it does not, you see that instead of a green check.

That check is the export, not the grid from before the logo. A pass on the clean modules would have been cheaper and would have lied.

It is still not a promise about every camera, every printer, every laminate, or every phone in a pocket. A smudge, a curl, a flash, a dirty lens, a mark that printed too light: any of those can fail a code this page already read back. I will not write "scans everywhere."


Ink a Lens Can Split

Yellow on white looks fine on a monitor. A camera sees two lights. This page measures the contrast of the pair and stops below 3 to 1, which is the WCAG floor for graphics. Black on white is above 20 to 1 on the same formula. Yellow on white is the fixture that fails.

You can still pick a brand color. You cannot pick one the paper swallows. Six digit hex only. Named CSS colors and transparency are not ink a printer can hold.

I stole that floor from the contrast checker already on this site. The math is the same WCAG 2.1 ratio. The difference is the refusal. A contrast page can show you a fail. A QR page that ships a fail will print.


Millimetres on the Desk

Pixels are a screen unit. A shop wants millimetres.

The buttons are 20, 25, 30, 40 and 50 mm. You can type 15 to 80. The preview is that wide on screen, CSS millimetres, so a card laid next to the monitor is a rough check, not a photograph of a scan. 30 mm is the default. It is a common card mark. 50 mm is a poster.

The page also names the module size in millimetres, quiet zone included. A print shop can check that number against their own minimum. I will not invent a millimetre that every press on earth can hold. Ask the shop. Hand them the SVG.

Settings stay in this browser: ink, paper, logo percent, print width, the caption checkbox. The URL does not. The logo file does not. Close the tab and the picture is gone. Open it tomorrow and the last colors you picked are still there.

I stored the knobs on purpose. I did not store the payload. A generator that writes your destination into localStorage is a product I will not ship.


SVG and PNG

Download the SVG for print. It is vectors. A shop can scale it. The caption, if you asked for one, sits under the modules as text, not as extra pixels inside the code.

Download the PNG when you need a raster for a chat or a slide. The PNG is the same grid the decoder just read. It is an uncompressed file this tab wrote. It will be larger than a compressed export from a photo app. That is the trade for a decoder that can see the same bytes you will send.

I did not put a watermark across the modules. The optional caption is Softery.io under the quiet zone. It is off by default. Turn it on if you want the credit. Leave it off if the card already has a mark.

The file name, if the payload is a URL, is the host with dots turned into dashes, then -qr.svg or -qr.png. Anything else is qr-code.svg. That is a download name, not a redirect.


The Caption Stays Outside

A lot of "free" generators print their own URL into the payload so every scan is a visit they can count. That is the lock, with their name on it.

The caption on this page, when you turn it on, is outside the modules. A decoder that reads the export does not see Softery.io unless you typed Softery.io. The read-back line will show you.

I wanted a way to sign the work without becoming the destination. A line under the square does that. A hop through my server would not.

If you need scan counts, this is the wrong page. I do not have them. A static file cannot phone home. That is the point.


What I Will Not Count

I will not count scans. I will not tell you how many phones opened the square. Those numbers live on a host. This page is not a host.

I will not promise the destination site is up next year. I will not promise every camera. I will not promise a cheap laminate. I will not promise a phone in a dark pocket.

I will tell you what this tab encoded, and what the second decoder recovered from the export with the logo on it. I will tell you the version, the module count, the millimetre size, and the read-back. That is the whole report.

Mixpanel and Google Analytics load with Softery.io. They see that someone opened the tool, which setting moved, and whether a download was SVG or PNG. They do not get the URL, the logo, or the file. If you came here because a privacy page promised zero third-party scripts, that is not this site.


Nearby Tools

A number that has to print as EAN-13, UPC, Code 128, or a plain QR without a logo belongs on Barcode and QR Code Generator. That page already draws the symbol, reads it back, and lays a column onto Avery stock.

A phone photo in HEIC that you want as the mark belongs on HEIC to JPG first. This page will not open HEIC. It says so and stops.

The generator is at QR Code with Logo. Paste the address and read both lines before you download. Use the SVG if a shop will print it.


What to do next

  1. Open the page and leave the sample URL alone until you have seen a real square.
  2. Paste the address you actually want on the card. Read the encoded line. If it is not what you typed, stop.
  3. Drop a PNG or a JPEG if you want a mark. Keep it in the band. If the read-back fails, shrink the logo or darken the ink.
  4. Pick a millimetre width the shop can hold. Download the SVG. Hold a card next to the preview if you need a sanity check.

That is the whole tool. A square that is the code. A logo that this tab already tried to read. A file you can take to a printer without renting the destination.


Last updated: September 15, 2026 | Reading time: 11 minutes

Written by Softery.io, which draws the square and hosts none of the destinations.