QR Code Generator & Reader
Turn URLs, Wi-Fi and contact details into validated QR payloads; scan results show text first and open only when you choose.Processed locally · static payloads
Operations
URL QR code
Build a static payload from a plain https:// URL and validate export parameters; no redirect wrapper, no tracking.
Wi-Fi QR code
Build WIFI:T:WPA;S:…;P:…;; payloads with exact escaping/round trip for Chinese SSIDs and special-character passwords; passwords are never persisted.
Contact QR code (vCard)
Build vCard 3.0 payloads with Chinese names, phone, email and notes; escaping and CRLF lines round-trip exactly.
QR reader (policy & empty state)
Scan results show text first; only http/https opens after an explicit click, unsafe schemes are refused, a missing code is a normal empty result, and leaving the page releases camera tracks.
Real examples and limits
This round delivers testable controlled payload builders and escaping, capacity/quiet-zone/error-correction/contrast validation, PNG/SVG export PLANS, scan-result policy and a camera state machine. Zero third-party dependencies and no browser: soldair/node-qrcode and mebjas/html5-qrcode are NOT bundled, so no QR image bytes are produced and no camera/image decoding occurs. Payloads are static: no tracking, redirects or uploads; Wi-Fi passwords are never saved, put in URLs or analytics. Chinese SSIDs and passwords containing semicolons, colons, backslashes or newlines are escaped per WIFI: and vCard 3.0 rules and round-trip exactly. Overlong text is refused with a hint — no damaged file is produced.
FAQ
Why do I download a JSON plan instead of a PNG?
This is a zero-dependency static slice without a real encoder, so it must not fabricate image bytes. The JSON contains the validated payload, size, 4-module quiet zone, error-correction level, contrast and render steps for a future encoder.
Are Wi-Fi passwords saved or uploaded?
No. The password is used in memory to build the WIFI: payload only; URLs carry just public lang/tool, analytics is whitelist-only, no draft is persisted, and switching payload type drops sensitive fields.
Does a scanned link open automatically?
No. The decoded text is shown first; only http/https URLs pass the whitelist and open in a new tab after your explicit click. javascript:, data: and file: are refused.
Can I still scan without camera permission?
Permission is requested only on click; a denied state keeps the upload fallback. Leaving the scan page stops the stream and releases every track via a testable state machine. Browsers/devices are untested this round.
Are coloured QR codes supported?
Foreground/background are planned parameters, defaulting to black on white (21:1). Ratios below 4.5:1 or light-on-light choices raise a warning; scanner compatibility is not promised.