Security and Abuse Reporting

How the site works

The generator runs entirely in your browser. The content you type — a link, a Wi-Fi password, contact details, a wallet address — is turned into a QR code locally and is never transmitted to us or stored on a server. There is no backend to send it to: the site is a static export served from a CDN.

Because of that, we cannot see what anyone generates, and we have nothing to hand over or lose if we are asked for it.

What we never do

We never ask for credentials. There is no account, no login, no password field and no payment form anywhere on the site. Nothing on this domain accepts a secret from you, which is the behaviour a phishing site exists to perform.

We do not offer dynamic QR codes or short links. Every QR code we produce encodes your own destination directly, so this domain never appears inside a QR code generated here and no scan is ever routed through us. That is a deliberate design constraint, not an omission: a redirector would make our domain a carrier for whatever someone else pointed it at.

Reporting a vulnerability

Email [email protected] with enough detail to reproduce the issue. Please give us a reasonable window to fix it before publishing.

Our machine-readable contact details are published at /.well-known/security.txt (RFC 9116).

Reporting abuse

A QR code is a container: anyone can encode a malicious link with any generator, ours included. If you have received a QR code that leads somewhere harmful, the destination is what needs reporting — to the host of that destination, and to your browser vendor's safe-browsing programme. We have no record of who generated it and no way to disable it, because the code contains the destination itself rather than a link back to us.

If you believe this site itself is being misused, email [email protected] and we will look into it.

If you found this domain on a blocklist

Automated classifiers occasionally flag QR code generators, usually because a page documents a payment URI format and the sample addresses in it are read as indicators. If you are a vendor reviewing such a report, email [email protected] — we would rather answer your questions directly than have the verdict stand unexamined.