Audit a QR code payload before printing it
The black-and-white symbol is only a container. Decode the final candidate, inspect its exact text and action, and verify the destination before print production makes a mistake expensive to replace.
Decode the final QR image without automatically opening it. Record the exact payload. For a website, require the complete intended HTTPS URL and inspect the hostname character by character. Treat shorteners as unresolved until the final destination is independently verified. Remove tokens, API keys, passwords, and other values that should not be public. Validate structured Wi-Fi, mailto, or contact forms against the scanner apps you support. Then test the live action and the physical proof separately, with a human-readable fallback printed beside the code.
Pre-print path
1. Decode the final candidate, not the generator form
Inspect the exact image or proof file that will be printed. A correct URL in the generator UI does not prove that the exported QR encodes the same value. Use a decoder that shows the text before opening it, then save the payload in the approval record.
- Preserve capitalization, punctuation, query parameters, and terminators exactly.
- Compare the decoded text with the approved destination or action.
- Regenerate and repeat after every design, data, or export change.
- Keep image decoding separate from destination opening so reviewers can inspect first.
The FTC advises people to inspect a QR code's URL before opening it and check for misspellings or switched characters. A publisher should make that inspection easy by using a recognizable destination and printing a fallback URL.
2. Make the intended action explicit
RFC 3986 distinguishes an absolute URI by its scheme. For a website, encode the full https:// URL instead of a bare domain or relative path. ZXing's barcode-content guidance gives the same practical recommendation so readers recognize the payload as a URL.
| Payload | Expected action | Review point |
|---|---|---|
https: | Open a named web destination. | Exact hostname, path, query, redirect chain, TLS, and ownership. |
mailto: | Compose an email. | Valid address plus any prefilled subject or body; RFC 6068 defines the scheme. |
WIFI: | Offer network configuration in supporting readers. | SSID, authentication type, escaping, terminators, and intentional password disclosure. |
MECARD: | Offer a contact record in supporting readers. | Name, fields, escaping, terminators, and scanner compatibility. |
| Plain text | Display text. | Confirm that no scanner is expected to infer a URL or application action. |
Do not label every unfamiliar scheme malicious. Decide which actions the campaign intentionally supports, block clearly dangerous forms, and route any other scheme to review.
3. Make the destination recognizable and durable
Read the hostname, not the surrounding copy
Compare the decoded hostname with the domain the organization actually controls. Look for switched characters, extra labels, unexpected country-code endings, and user-info text before an @.
Treat a shortener as an unresolved dependency
A short URL can be legitimate, but the printed payload does not reveal the final hostname and may depend on an account or provider that can expire. Resolve and document it separately. Prefer a short route on a domain you control when practical.
Follow the production redirect chain
Record the final URL and confirm that locale, consent, authentication, and tracking redirects still end at the approved destination. Recheck after launch because dynamic routes can change while the printed symbol cannot.
Print a fallback
Put a short human-readable domain or action beside the symbol. It helps users inspect the destination and preserves a path when a camera, app, network, or printed code fails.
4. Assume anyone can read the payload
A QR code is not an encrypted envelope. Anyone with a decoder can recover the text. Review the payload as public material before approving it.
- Remove API keys, bearer tokens, passwords, session identifiers, signed URLs, and account-reset links.
- Decide explicitly whether a Wi-Fi password is intended for everyone who can see or photograph the code.
- Avoid personal contact data the subject did not approve for publication.
- Keep analytics identifiers non-secret and document their retention and purpose.
- Do not encode credentials merely because the destination later asks for authentication.
RFC 3986 warns that user-information fields can be misleading and that URIs can contain sensitive data. The safest printed payload contains only the public identifier needed for the intended action.
5. Test the payload and the physical proof as separate gates
A text audit can prove that the decoded candidate matches the approved value. It cannot prove that the final printed symbol will scan or that the destination is safe.
- Audit the decoded text and approve the intended action.
- Open the live destination in a controlled test and record the final URL and observable result.
- Print at actual size and material, then scan the proof with representative devices, angles, lighting, and distance.
- Confirm the symbol's quiet zone, contrast, module integrity, and placement are not damaged by artwork, folds, glare, or trimming.
- Verify the human-readable fallback without using the QR code.
- Assign an owner and date for recurring destination checks after distribution.
A fixed 180-character warning is not a QR capacity or printability standard. Data length matters, but the resulting symbol also depends on encoding, version, error correction, and physical presentation.
6. Automate the decoded-text preflight
QR Payload AuditorA local, read-only SKILL.md workflow that checks already-decoded text for incomplete URL forms, listed shorteners, javascript/data/file schemes, a configurable length review threshold, narrow Wi-Fi/MECARD/mailto format problems, and explicit credential-like fields. It does not decode images, resolve destinations, or prove safety.See the QR payload skill →Common questions
How do I check what a QR code actually contains?
Decode the final exported or proofed QR image without automatically opening it, copy the exact text payload, and compare it with the approved destination or action. Audit the text separately from image and print quality.
Should a website QR code include https?
Yes. Include the complete intended URL, including the scheme and hostname, rather than relying on a scanner to guess that a bare domain or relative value should open in a browser.
Are shortened URLs safe in printed QR codes?
A shortener is not automatically malicious, but the printed payload hides the final hostname and adds an external dependency. Resolve and document the destination separately, verify control and longevity, and prefer a short URL on a domain you control when possible.
Can a QR payload contain a Wi-Fi password?
Yes. Common WIFI payload syntax can contain a P password field. Anyone who can decode the symbol can read that value, so treat the code as a disclosed credential and decide whether that exposure is acceptable.
Does a clean payload audit prove the printed QR code will scan?
No. Payload correctness and physical scanability are different checks. A print proof still needs image, size, quiet-zone, contrast, material, lighting, distance, device, and fallback testing.