< back to resources

The Risks of Using a Free QR Code Generator Online

July 6, 2020
QR Code Menu

Thinking of using an online QR code generator for free?

Not so fast.

QR codes themselves are an inherently secure technology. There is nothing particularly risky about using a QR code format to communicate information. The risk comes into play when you depend on an online third party to create QR for you. For free.

The “for free” part is important, because payments obligate companies to provide some level of security and support. Not to mention official terms of service and rigorous privacy policies. Contractual obligations generate reliability and protection. Using free QR code generators online gives you none of that, and it invites unnecessary risk into your business. 

If it’s too good to be true, it probably is. Here’s why.

How QR Code Generator Websites Work

An online QR code generator encodes information into a QR code. You upload information onto the website, and the website spits out a QR code. That QR code links out to a URL, a PDF, or other basic information. Most free QR code generators online can be used to create static or dynamic QR codes.

A static QR code is a machine-readable code that has information encoded directly into it. The information communicated by a static QR code cannot be changed after it’s created, unless the QR code itself is changed.

A dynamic QR code’s information, on the other hand, can be changed after the QR code is created. Usually a dynamic QR code achieves this by redirecting the user to a URL with the information. If it’s a PDF QR code generator, that information is a PDF document. That information can also be HTML, an image, or really any information that can be published on a website. And that information can be changed on the URL without having to physically change the QR code.

But what if the URL changes? Great question. Often, free QR code generator websites will use their own shortened URLs to redirect to the URL with your information on it. Let’s say you’re a restaurant with a QR code-based digital wine list. The URL of your QR code menu can change, but the QR code wouldn’t have to. Because the third party’s shortened URL—the one that redirects to the URL with the published menu—remains the same.

And that’s the important part. What makes using a free online QR code generator risky isn’t the QR code itself. What makes using a free QR code generator website risky is having to rely on a third party to redirect users to the information you want to surface. 

Let’s look at the different ways that can play out.

QR Code Generators Online Can Be Used Maliciously

As we mentioned, there is nothing inherently risky about QR codes. QR codes are a square matrix of pixelated modules (squares). QR code uses are numerous, and QR codes are a remarkably safe and universal tool. To change, hack, or otherwise affect the performance of that matrix itself, you’d have to physically change it.

The security issues involve the information associated with QR codes. It’s just like email, text, or any other online environment. Bad actors use the tools maliciously. And there are two primary ways that happens.

QR Code Phishing

Phishing is when someone online poses as a trusted entity to illegally acquire sensitive information. When a QR code generator website creates a QR code for your business, this is a possibility. It can happen in three ways.

  1. Whoever runs that website will have access to the content you’ve linked to the QR code. They could recreate that content and masquerade as you, all while encouraging users to provide information upon scanning. It would look like your business is asking for information, but it wouldn’t be your business.
  1. The third-party website can change the destination URL of your QR code at any time, at their discretion. Imagine a free QR code generator online that spends months ranking in Google and churning out countless QR codes for businesses. They could change every one of those QR code redirection links to a phishing website. They’d be found out, but it’d be too late. They’d disappear with reams of sensitive personal information.
  1. This third one isn’t directly related to the risks of QR code generator websites, but it’s worth mentioning. Once you print out your QR code template and fix your QR code onto it, people can cover your QR code with a different QR code. It’s a common phishing strategy that, while not very refined, is effective.

Check the destination URL for your dynamic QR code often and verify that it is, in fact, your page. Then you’ll be able to avoid any phishing schemes. It’s a possibility.

QR Code Malware

Malware, or malicious software, is harmful software that’s downloaded to your device. When someone scans your QR code, a go-between URL can be inserted before the URL that contains your published content. Usually this is go-between URL is a shortened address meant solely for redirecting to your published content. But it can be used for evil.

But the fact remains that anyone who scans your code is going to a website that’s not yours. And that URL can actually push a download to your device. A user doesn’t have to be on the page associated with the address for more than a second to activate it. They’re known as “drive-by downloads.” And because you’re using an unverified third-party link as part of your QR code process, you’re opening up the door to automatically downloaded malware.

QR Code Generator Websites Can Monitor, Use, and Sell Your Data

Sometimes when a third party QR code generator website redirects to or replaces your full URL, they’re doing it for tracking purposes. Tracking data isn’t as baldly malicious as phishing and malware, but it’s nevertheless invasive. If you trust the service and you trust that they’re tracking data to improve their product, great. But one of the reasons that popular online QR code generators for free can remain free is by generating loads of user data. And selling it to marketing companies.

Ideally, you’re using a dynamic QR code to do your own tracking, using insights to boost profits through menu engineering. If you value your business’s and your users’ privacy, you should avoid online QR code generators for free.

The Online QR Code Generator Can Go Under

If you use a free QR code generator online, you’re asking a third-party site to be a required part of the process. You’re putting them between you and your customers. There may be QR code scanning problems. That means you and your customers are affected any time they’re affected. That could be the entire website going down permanently, or it could be a temporary outage. Either way, you’ll be at their mercy.

So, What’s the Solution?

If you’re committed to using a free QR code generator website online, there are some things you can do to mitigate risk. You can:

  • Try to find QR code generators online that give you the option to encode what you want without shortening the URL. You can also host your own URL shortener if you’re familiar with using self-hosted tools online. You’ll need to register a short domain name, though.
  • Think about using a menu app instead. Because they’re internally developed, they’re more secure. But, because they’re internally developed, they’re also multitudes more difficult, expensive, and time-consuming.
  • Use static QR codes instead of dynamic QR codes. That will remove the ability for you to update and edit the information associated with your QR code, though. Any time you change the encoded in a static QR code, you’ll need a new QR code. And the more data you encode in a static QR code, the bigger the QR code is, and the harder it may be to scan. Learning how to scan a QR code on iPhone properly can often solve that problem, though. That’s obviously not sustainable for businesses like bars, restaurants, hotels, or retailers. It’ll also prohibit you from tracking user data with your QR code, which can be leveraged to great effect in your QR code marketing.
  • Keep all the online security advice you’ve ever accumulated in mind as you navigate the world of free QR code generators online. Don’t click live links you’re unfamiliar with. Don’t provide information to an untrusted source. Don’t interact with unsecure websites. QR codes are tools, just like texts and email. The tool itself isn’t bad, it’s the way it's used. Be ever watchful.

But the easiest, most reliable solution is to partner with a company that creates professional QR codes for businesses. BinWise, for example, helps bars, restaurants, and hotels across the country generate reliable, iron-clad dynamic, QR code-based contactless menus. All types of menus. We provide secure QR codes backed by the service, maintenance, and operation of a reputable restaurant technology company. And the best part? All you have to do is provide a spreadsheet of raw information. Our QR code menus are pre-formatted, mobile optimized, and incredibly simple to create and deploy.

Book a demo and we’ll walk you through just how easy it is to create the touchless restaurant experience required to thrive today.