From payload to export: 3 steps
Step 1: choose a type. Enter a full https:// URL; for Wi-Fi provide SSID, security (WPA/WEP/nopass) and password; for contacts supply the Chinese name and phone. Controlled payloads such as WIFI:T:WPA;S:Cafe\;VIP;P:a\;b\n;; escape semicolons, colons, backslashes and newlines.
Step 2: check parameters. Default size is 512px (even integer), quiet zone at least 4 modules, error correction L/M/Q/H defaulting to M. Overlong text shows the byte cap and is refused — no damaged file. Contrast below 4.5:1 warns you to use a dark foreground on a light background.
Step 3: export plan. The result JSON contains the exact payload, byte count, payload hash, PNG/SVG filename, render steps and a rescan-integrity rule. No image bytes are produced this round; a future real qrcode encoder consumes the same plan and a rescan must yield the byte-identical payload.
When scanning: text is displayed first; only http/https links open after your explicit click, javascript: and other unsafe schemes are refused, and a missing QR code yields a normal empty result. Camera permission is requested only on click; leaving the page releases tracks and a denial still allows image upload.