Two separate questions get mixed together whenever someone asks whether a generator is safe: is the tool itself trustworthy with what you type into it, and is the QR code it produces safe for whoever scans it later. A WiFi password or a personal phone number typed into a generator is only as private as that generator's own handling of it. Some build the code entirely in the browser and never see the data; others send it to a server first.
Separately, a code that looks static but is quietly routed through the generator's own tracking link carries a different risk. It can be redirected, paywalled or broken later, even though nothing about the printed pattern changed.
What to check before trusting a generator
Look for a claim about where the data is processed
A generator that says the code is built in the browser, on your device, isn't sending a WiFi password or contact card to a server to do it. If that isn't stated anywhere, assume the data is sent to a server unless proven otherwise.
Test whether a 'free' code depends on the generator staying online
Make a static code, then check months later whether it still opens the exact same destination without any sign-in prompt appearing. A code that suddenly requires an account, or shows an ad page instead, was never a plain static code to begin with.
Read what a browser extension version asks for
A generator offered as a browser extension that requests permission to read and change data on every site visited is asking for far more access than generating a QR code requires.
Check the domain the code actually opens before printing anything at volume
Preview the code with a scanner that shows the destination clearly before opening it, catching a generator that inserts its own redirect domain instead of the address you typed.
Where a generator's own safety risk actually lives
The risk isn't in the QR code format itself, which is just a way of encoding text; it's in what a specific generator does with the content before turning it into a pattern. A WiFi password or a personal contact card typed into a form that sends the data to a server before generating the image means that server operator had a copy of it, even briefly. MakeQR's static codes are built entirely in the browser for exactly this reason: the content never has a reason to leave the device.
A code labeled free that isn't actually static
Some generators route every code, including ones presented as free and permanent, through their own short link, which means the generator's server decides where the code points at scan time, not the pattern itself. That's functionally a dynamic code without saying so, and it can break, get paywalled, or start showing ads if the company changes its policy or shuts down, none of which happens to a genuinely static code with the destination written directly into the pattern.
Safety of the code once it's out in the world is a separate problem
A generator can be entirely trustworthy and the resulting code can still be misused later, most commonly by someone placing a sticker with a fake code over a real one in a public place. That's a scanning-side risk, not a generator-side one, and it's addressed by checking a code's destination before opening it, not by choosing a different generator.
What a generator has access to versus what it actually needs
Generating a QR code needs only the text being encoded, nothing about the person doing it. A generator asking for an account, an email address, or payment information before producing a single free static code is asking for more than the task requires.
https://example.comChecking a code before it goes to print at scale
Before a large print run, scan the generated code with a phone or MakeQR's own scanner and confirm it opens exactly the intended address, not a redirect through an unfamiliar domain. This costs a minute and catches a generator quietly substituting its own link before hundreds of copies are printed.
Print it at least 20 mm (2.0 cm) wide
Assumptions that lead to a bad surprise later
Assuming 'free' means the same thing everywhere
Free sometimes means the code is genuinely static and permanent, and sometimes means free for now, with a server quietly in the loop that could change terms later.
Typing sensitive data into a generator with no stated privacy handling
A WiFi password or personal phone number deserves a generator that states plainly whether the data is processed locally, not one silent on the question.
Never testing the code before distributing it
A code that looks right in a preview thumbnail can still route through an unexpected domain. Scan it yourself first.
The static-versus-dynamic distinction matters more here than usual
A genuinely static code has no server in the loop after it's generated, which is the safest option when privacy of the content matters most, like a WiFi password. A dynamic code, by design, does route through a server so the destination can be changed later, which is a reasonable tradeoff only when made knowingly, with a free account and a stated privacy approach, not as a hidden default.
How dynamic QR codes workSituations where checking a generator's approach matters most
- Generating a code for a home or office WiFi password meant to stay private.
- Making a contact card code with a personal phone number for a business card.
- Printing a large batch of codes for a public event, where a broken redirect later affects everyone who scanned one.
- Choosing a generator for a business's ongoing use rather than a single one-off code.