Security and Abuse Reporting

How the site works

The generator runs entirely in your browser. The content you type — a link, a Wi-Fi password, contact details, a wallet address — is turned into a QR code locally and is never transmitted to us or stored on a server. There is no backend to send it to: the site is a static export served from a CDN.

Because of that, we cannot see what anyone generates, and we have nothing to hand over or lose if we are asked for it.

What we never do

We never ask you to log in with a password, and never ask for a payment. The generator has no account and no login at all. The optional tracking service at track.qrcode-alligator.com signs you in with a one-time link sent to your email address — there is no login password and no payment form anywhere on this domain, so nothing here asks for the kind of secret a phishing site exists to collect. (The Wi-Fi generator does have a field for your network's password: it goes into the QR code, in your browser, and is never sent to us.)

The generator makes static QR codes only. Every code it produces encodes your own destination directly, so no scan of a code made here is ever routed through us, and this domain never appears inside one.

Tracked QR codes and short links

Tracked (dynamic) codes are a separate, opt-in service. A tracked code points at a short link on qrgo.page — a different domain, chosen so that this one never carries a destination someone else picked. The short link redirects to the destination its creator set, which is what makes the code editable and countable.

A redirector can be abused, so the service is built around that. Every destination is checked against Google Safe Browsing and our own blocklist when a link is created or changed, and periodically after that; risky links show a warning page instead of redirecting; a link without an account expires after 7 days; and creating links is rate limited. qrgo.page sets no cookies, loads no scripts and never stores a visitor's IP address.

A tracked code can also return a contact card instead of redirecting: the scan is answered with a vCard file built from details its creator entered on the tracking service, with no page in between. Those details are stored by that service and are not verified by us. The only link a card carries is its website, which passes the same destination checks; text in the card that looks like a web address is refused. A card is reported and disabled the same way as any other tracked code.

Its abuse process is published at qrgo.page/security: reports are reviewed within 48 hours, and a link we disable stops working everywhere within 5 minutes.

Reporting a vulnerability

Email [email protected] with enough detail to reproduce the issue. Please give us a reasonable window to fix it before publishing.

Our machine-readable contact details are published at /.well-known/security.txt (RFC 9116).

Reporting abuse

If a QR code leads to qrgo.page, it is one of ours and we can switch it off everywhere. Report it at qrgo.page/report/ followed by the code, or email [email protected].

Any other QR code is a container: anyone can encode a malicious link with any generator, ours included. If such a code leads somewhere harmful, the destination is what needs reporting — to the host of that destination, and to your browser vendor's safe-browsing programme. We have no record of who generated it and no way to disable it, because the code contains the destination itself rather than a link back to us.

If you believe this site itself is being misused, email [email protected] and we will look into it.

If you found this domain on a blocklist

Automated classifiers occasionally flag QR code generators, usually because a page documents a payment URI format and the sample addresses in it are read as indicators. If you are a vendor reviewing such a report, email [email protected] — we would rather answer your questions directly than have the verdict stand unexamined.