URL QR — QR Data Format standard

Overview

A URL QR code is a QR Code symbol whose entire payload is a single URI, most often an https:// web address. It is the most common kind of QR content: the symbol carries only the text of the link, and the scanning device decides what to do with it. The ZXing project's de-facto content conventions say a reader "should open the URL in the device's web browser" and recommend always including the scheme (https://) so the payload is recognised as a URL at all ¹.

The same mechanism carries any URI scheme, so mailto:, tel:, sms: and geo: codes, app and universal links, and URL-shaped payment and product codes all belong to this family. What distinguishes them is the scheme and the handler the operating system routes it to, not the symbol ¹ ⁷.

History

QR Code itself was invented in 1994 by Masahiro Hara at Denso Wave for automotive-parts tracking [qr-ref]. The URI syntax that URL codes carry was consolidated in RFC 3986 (January 2005), the generic syntax for Uniform Resource Identifiers ²; the schemes most often found in QR codes were standardised around it: tel in RFC 3966 (December 2004) ⁴, sms in RFC 5724 (January 2010) ⁵, geo in RFC 5870 (June 2010) ⁶ and mailto in RFC 6068 (October 2010) ³.

Two adoption milestones made URL codes usable without a dedicated app:

iOS 11 (2017) added QR recognition to the Camera app: it scans automatically in Photo and Square modes, including from the Lock screen, and shows a notification describing the action rather than acting on its own ⁷.
On Android, codes are read by the Camera app, Google Lens, or a Quick Settings QR-scanner shortcut, which then shows the decoded details ²⁰.

Technical specification

Carrier. A URL code is an ordinary QR Code; nothing in the symbol marks it as a URL. Recognition is purely textual: the reader looks at the scheme at the start of the decoded string ¹.

URI schemes found in QR codes

Scheme	Spec	Example payload	Reader action
`https:` / `http:`	RFC 3986 ²	`https://example.com/`	Open in the browser; ZXing suggests showing the URL and asking first ¹
`mailto:`	RFC 6068 ³	`mailto:info@example.com?subject=Hello`	Open a blank e-mail to the address ¹
`tel:`	RFC 3966 ⁴	`tel:+15105550100`	Open the dialer pre-filled; do not start the call automatically ¹
`sms:`	RFC 5724 ⁵	`sms:+15105550101?body=hello%20there`	Open a new message for the user to send ¹ ⁵
`SMSTO:`	none (observed in the wild) ¹	`SMSTO:+15105550101:hello`	iOS Camera accepts it and pre-fills the text ⁷
`geo:`	RFC 5870 ⁶	`geo:40.71872,-73.98905,100`	Open a map at the point; see geo URI ¹
`web+<name>:`	HTML `registerProtocolHandler` ⁹	`web+example:item42`	Routed to whichever website registered the handler

Notes on the less obvious rows:

sms: allows several comma-separated recipients; the same message should be sent to all of them, and the full recipient list should be shown before sending. The body field may appear only once and is percent-encoded UTF-8 ⁵. ZXing also reports mms:/MMSTO: and URLTO: prefixes "in the wild" with no official specification ¹.
tel: should use the most complete number possible, including the country code ¹.
web+ custom schemes must begin with web+, contain at least one letter after the prefix, and use only lowercase ASCII letters. Apart from those, a site may only register a handler for a safelisted scheme such as mailto, tel, sms, smsto, geo, bitcoin or webcal ⁹.

Sibling payload formats that are not URIs have their own pages: WiFi QR (WIFI:), vCard QR (BEGIN:VCARD), MeCard (MECARD:), iCal Event QR (BEGIN:VEVENT) and otpauth URI (otpauth://).

App and universal links

An https:// URL can open an installed app instead of the browser:

iOS universal links. The site serves an apple-app-site-association file over HTTPS, at the server root or under .well-known, listing the app ID and the paths the app handles; the app declares the domain in its Associated Domains entitlement. Scanning a matching URL then opens the app directly, and falls back to Safari if the app is not installed, where Apple recommends a Smart App Banner. If several apps claim the domain, the user chooses once and the choice is remembered ⁷.
Android App Links. Plain deep links work on every Android version but can trigger the system disambiguation dialog. App Links verify the association between the app and the website, so verified links open the app without the dialog. They are supported on Android 6 and later on devices with Google services; Android 15 added dynamic App Links that refine matching without an app release ⁸.

Length, version and error correction

The longer the URL, the larger the symbol. QR versions run from version 1 (21 × 21 modules) to version 40 (177 × 177), each version adding 4 modules per side ¹⁰. Of the four error-correction levels, M (15 % recovery) is the most frequently chosen; L suits clean environments with a lot of data, and Q (25 %) or H suit dirty environments, at the cost of a bigger symbol ¹¹.

Byte-mode capacity, the mode a mixed-case URL uses ¹²:

Version	Modules	L	M	Q	H
1	21 × 21	17	14	11	7
2	25 × 25	32	26	20	14
3	29 × 29	53	42	32	24
5	37 × 37	106	84	60	44
10	57 × 57	271	213	151	119
40	177 × 177	2953	2331	1663	1273

Worked examples (computed with segno 1.6.6, no error-level boost):

https://example.com/ (20 characters) needs version 2 (25 × 25) at levels L, M and Q, and version 3 at H.
The same URL in capitals, HTTPS://EXAMPLE.COM/, fits QR's denser alphanumeric mode and drops to version 1 (21 × 21) at L and M. Alphanumeric capacity at version 1 is 25 characters at L and 20 at M ¹². ZXing notes this trick but warns it only works if the server accepts uppercased URLs: "Don't try this unless you test it to know it works" ¹. RFC 3986 makes only the scheme and the host case-insensitive ².
A 102-character campaign URL with three utm_ tracking parameters needs version 5 (37 × 37) at L, version 6 at M, version 8 at Q and version 10 (57 × 57) at H. Shortening the URL is the usual way to keep the symbol small.

Use cases

Marketing and print. Posters, packaging and broadcast advertising. Coinbase's February 2022 Super Bowl advert consisted of a QR code bouncing around the screen like a DVD-player logo; it led to an offer of $15 in bitcoin, and the app crashed under the resulting traffic ¹⁹.
Product packaging. GS1 Digital Link turns a product's GS1 identifiers into a web-resolvable URL such as https://example.com/01/09521234543213/10/ABC123, so one code serves both the retail till and a phone browser [gdl-ref]. Its usual carrier is a GS1 QR Code [gdl-ref].
Payments. Several payment schemes use a plain URL as their QR payload, with routing done server-side. SnapScan in South Africa encodes a pos.snapscan.io link with the merchant code, order reference and amount [snapscan-ref]. The European standard EN 18184 defines a URL "envelope" of the form HTTPS://<Domain_name>/<Version>/<Type>/<MCT service provider ID>/<Payload> for mobile-initiated instant credit transfers [en18184-ref].
Contact actions. tel:, mailto: and sms: codes open the dialer, mail or messaging app with the recipient filled in; Apple recommends mailto: and tel: URIs so the Camera recognises them correctly ⁷.
App onboarding. With universal links or App Links, scanning a site URL opens the matching app screen directly ⁷ ⁸.

Static and dynamic codes

Static: the destination is encoded directly in the symbol, so it cannot change after printing ¹³.
Dynamic: the generator encodes a redirect link that the service controls. The destination can then be changed after printing, and the redirect also records scans ¹³.

The trade-off is dependence: a dynamic code only works for as long as the redirect service keeps resolving it, and services can expire codes by disabling the redirect ¹³. A redirecting or shortened link also hides the final address from the person scanning, which is what phishing guidance asks people to check ¹⁵ ¹⁶.

Security: QR phishing ("quishing")

Because a URL code is unreadable to people until it is scanned, it is a natural carrier for phishing:

Austin, Texas, January 2022. Fake QR stickers on city parking pay stations led to a site with no connection to the city. Austin Transportation warned that the city takes payment only at the stations or through its Park ATX app, "not through a website", and asked anyone who paid by QR code to file a police report and notify their card issuer ¹⁷.
FBI IC3 PSA I-011822-PSA (18 January 2022). It warns that criminals replace legitimate codes, physical and digital, with malicious ones that steal credentials, embed malware or redirect payments. Its advice includes checking the address after scanning for lookalike domains, inspecting physical codes for stickers, not installing apps from QR codes, and avoiding third-party scanner apps ¹⁵.
US FTC consumer alert (6 December 2023). It describes codes stuck over parking-meter codes and codes sent by text or e-mail with an invented urgent reason. It advises inspecting the URL before opening it and not scanning unexpected codes in e-mails or texts ¹⁴.
UK NCSC (8 February 2024). It reports a rise in "quishing" e-mails that use QR codes to disguise links, partly because some phishing filters don't scan images. It judges codes in pubs and restaurants probably safe, advises more care in stations and car parks, and recommends the phone's built-in scanner over a third-party app ¹⁶.
Parser mismatch. In iOS 11, the Camera notification could name one host while Safari opened another for a crafted URL containing an @ sign. Researcher Roman Mueller reported the issue, and Apple fixed it in iOS 11.3 (2018) ¹⁸.

Implementations

Project	Lang	Stars	Last active	Notes
zxing/zxing	Java	~34.2k	2026-10	Reference encoder/decoder; its "Barcode Contents" wiki is the de-facto URI-in-QR convention ¹
zxing-cpp/zxing-cpp	C++	~2.1k	2026-10	C++ port, encoder and decoder
soldair/node-qrcode	JavaScript	~8.2k	2024-08	Node and browser encoder
nayuki/QR-Code-generator	Java (multi-language)	~6.8k	2026-08	Reference encoder library
mebjas/html5-qrcode	TypeScript	~6.2k	2025-12	In-browser camera decoder
lincolnloop/python-qrcode	Python	~5.0k	2026-03	Python encoder
heuer/segno	Python	~0.8k	2026-07	Python encoder; used for the worked examples above

Comparison

URL QR vs a structured payload (WiFi QR, vCard QR, iCal Event QR). A structured payload makes the phone act offline: join a network, save a contact, add an event ⁷. A URL only points somewhere, so it needs a network and a working server, but the content behind it can change and be any size. Choose a structured format when the action is local and fixed, and a URL when the content lives on the web.
URL QR vs GS1 Digital Link. A Digital Link is a URL with a standardised path grammar for GS1 identifiers, so a till can read the GTIN out of it without fetching anything [gdl-ref]. Use Digital Link for products that also need to scan at a checkout, and a plain URL otherwise.
Static vs dynamic URL. Static codes keep working forever and reveal their destination. Dynamic codes can be edited and tracked, but depend on the redirect service ¹³.

Fun facts

Writing a URL in capitals can shrink its QR code by a whole version, because QR's alphanumeric mode can encode uppercase letters but not lowercase ones ²², and an all-capitals URL fits it (segno encodes HTTPS://EXAMPLE.COM/ in alphanumeric mode). ZXing's own wiki shows HTTP://MYSITE.COM/FOO as the example ¹. The EN 18184 envelope is written as HTTPS://… in capitals [en18184-ref].
Apple's iOS 11 Camera app recognises the unofficial SMSTO: format as well as the RFC sms: scheme, and uses it to pre-fill the message text ⁷.

Status

Active and ubiquitous. Both major mobile platforms decode URL codes in the stock camera (iOS since iOS 11 ⁷; Android through its Camera app, Google Lens and a Quick Settings scanner ²⁰). Every scheme in the table above remains a current IETF RFC or WHATWG/MDN-documented mechanism ² ³ ⁴ ⁵ ⁶ ⁹. New URI schemes are registered under RFC 7595 (June 2015) ²¹. Security agencies continue to issue quishing guidance, the most recent cited here dating from 2024 ¹⁶.

Sources

1 Barcode Contents — ZXing Wiki, accessed 2026 2 RFC 3986: Uniform Resource Identifier (URI): Generic Syntax — IETF, 2005 3 RFC 6068: The 'mailto' URI Scheme — IETF, 2010 4 RFC 3966: The tel URI for Telephone Numbers — IETF, 2004 5 RFC 5724: URI Scheme for GSM Short Message Service (SMS) — IETF, 2010 6 RFC 5870: A Uniform Resource Identifier for Geographic Locations ('geo' URI) — IETF, 2010 7 QR Code Recognition on iOS 11 — Apple Developer Tech Talks, 2017 8 About App Links — Android Developers, accessed 2026 9 Navigator: registerProtocolHandler() method — MDN Web Docs, accessed 2026 10 Information capacity and versions of QR Code — Denso Wave, accessed 2026 11 Error correction feature — Denso Wave, accessed 2026 12 Character Capacities by Version and Error Correction Level — Thonky.com, accessed 2026 22 Alphanumeric Mode Encoding — Thonky.com, accessed 2026 13 The difference between static and dynamic QR codes — Hovercode (vendor), accessed 2026 14 Scammers hide harmful links in QR codes to steal your information — US Federal Trade Commission, 2023 15 Cybercriminals Tampering with QR Codes to Steal Victim Funds (I-011822-PSA) — FBI Internet Crime Complaint Center, 2022 16 QR codes – what's the real risk? — UK National Cyber Security Centre, 2024 17 Fake QR codes found on city parking stations — Austin Monitor, 2022 18 iOS 11's Camera App Has a QR Code Vulnerability — Intego, 2018 19 Coinbase's QR code Super Bowl ad: what happened next — Deseret News, 2022 20 How do you scan QR codes on Android? — Android (Google), 2025 21 RFC 7595: Guidelines and Registration Procedures for URI Schemes — IETF, 2015

Deployments

Found in the following country reports (grep across reports/countries/):

XK — XK-kosovo.md

Regions / aggregations not mapped to a single country

Universal