# URL QR > Source: https://docs.barcoder.ai/docs/standards/url-qr > research date 2026-10-27 · extracted at 2026-10-27 > Publisher: Barcoder — encyclopedia of QR, barcode and payment-code standards Specifications: - [RFC 3986 — Uniform Resource Identifier (URI): Generic Syntax](https://www.rfc-editor.org/rfc/rfc3986) - [Barcode Contents — ZXing Wiki](https://github.com/zxing/zxing/wiki/Barcode-Contents) - [RFC 6068 — The 'mailto' URI Scheme](https://www.rfc-editor.org/rfc/rfc6068) - [RFC 3966 — The tel URI for Telephone Numbers](https://www.rfc-editor.org/rfc/rfc3966) - [RFC 5724 — URI Scheme for GSM Short Message Service (SMS)](https://www.rfc-editor.org/rfc/rfc5724) - [RFC 5870 — A Uniform Resource Identifier for Geographic Locations ('geo' URI)](https://www.rfc-editor.org/rfc/rfc5870) ## Overview A **URL QR code** is a [QR Code](https://docs.barcoder.ai/docs/standards/qr-code) symbol whose entire payload is a single URI, most often an `https://` web address. It is the most common kind of QR content: the symbol carries only the text of the link, and the scanning device decides what to do with it. The ZXing project's de-facto content conventions say a reader "should open the URL in the device's web browser" and recommend always including the scheme (`https://`) so the payload is recognised as a URL at all [1][1]. The same mechanism carries any URI scheme, so `mailto:`, `tel:`, `sms:` and `geo:` codes, app and universal links, and URL-shaped payment and product codes all belong to this family. What distinguishes them is the scheme and the handler the operating system routes it to, not the symbol [1][1] [7][7]. ## History QR Code itself was invented in **1994 by Masahiro Hara at Denso Wave** for automotive-parts tracking [[qr-ref]]. The URI syntax that URL codes carry was consolidated in **RFC 3986 (January 2005)**, the generic syntax for Uniform Resource Identifiers [2][2]; the schemes most often found in QR codes were standardised around it: `tel` in RFC 3966 (December 2004) [4][4], `sms` in RFC 5724 (January 2010) [5][5], `geo` in RFC 5870 (June 2010) [6][6] and `mailto` in RFC 6068 (October 2010) [3][3]. Two adoption milestones made URL codes usable without a dedicated app: - **iOS 11 (2017)** added QR recognition to the Camera app: it scans automatically in Photo and Square modes, including from the Lock screen, and shows a notification describing the action rather than acting on its own [7][7]. - On Android, codes are read by the Camera app, Google Lens, or a Quick Settings QR-scanner shortcut, which then shows the decoded details [20][20]. ## Technical specification **Carrier.** A URL code is an ordinary [QR Code](https://docs.barcoder.ai/docs/standards/qr-code); nothing in the symbol marks it as a URL. Recognition is purely textual: the reader looks at the scheme at the start of the decoded string [1][1]. ### URI schemes found in QR codes | Scheme | Spec | Example payload | Reader action | |---|---|---|---| | `https:` / `http:` | RFC 3986 [2][2] | `https://example.com/` | Open in the browser; ZXing suggests showing the URL and asking first [1][1] | | `mailto:` | RFC 6068 [3][3] | `mailto:info@example.com?subject=Hello` | Open a blank e-mail to the address [1][1] | | `tel:` | RFC 3966 [4][4] | `tel:+15105550100` | Open the dialer pre-filled; do not start the call automatically [1][1] | | `sms:` | RFC 5724 [5][5] | `sms:+15105550101?body=hello%20there` | Open a new message for the user to send [1][1] [5][5] | | `SMSTO:` | none (observed in the wild) [1][1] | `SMSTO:+15105550101:hello` | iOS Camera accepts it and pre-fills the text [7][7] | | `geo:` | RFC 5870 [6][6] | `geo:40.71872,-73.98905,100` | Open a map at the point; see [geo URI](https://docs.barcoder.ai/docs/standards/geo-uri) [1][1] | | `web+:` | HTML `registerProtocolHandler` [9][9] | `web+example:item42` | Routed to whichever website registered the handler | Notes on the less obvious rows: - **`sms:`** allows several comma-separated recipients; the same message should be sent to all of them, and the full recipient list should be shown before sending. The `body` field may appear only once and is percent-encoded UTF-8 [5][5]. ZXing also reports `mms:`/`MMSTO:` and `URLTO:` prefixes "in the wild" with no official specification [1][1]. - **`tel:`** should use the most complete number possible, including the country code [1][1]. - **`web+` custom schemes** must begin with `web+`, contain at least one letter after the prefix, and use only lowercase ASCII letters. Apart from those, a site may only register a handler for a safelisted scheme such as `mailto`, `tel`, `sms`, `smsto`, `geo`, `bitcoin` or `webcal` [9][9]. Sibling payload formats that are not URIs have their own pages: [WiFi QR](https://docs.barcoder.ai/docs/standards/wifi-qr) (`WIFI:`), [vCard QR](https://docs.barcoder.ai/docs/standards/vcard-qr) (`BEGIN:VCARD`), [MeCard](https://docs.barcoder.ai/docs/standards/mecard) (`MECARD:`), [iCal Event QR](https://docs.barcoder.ai/docs/standards/ical-event-qr) (`BEGIN:VEVENT`) and [otpauth URI](https://docs.barcoder.ai/docs/standards/otpauth-uri) (`otpauth://`). ### App and universal links An `https://` URL can open an installed app instead of the browser: - **iOS universal links.** The site serves an `apple-app-site-association` file over HTTPS, at the server root or under `.well-known`, listing the app ID and the paths the app handles; the app declares the domain in its Associated Domains entitlement. Scanning a matching URL then opens the app directly, and falls back to Safari if the app is not installed, where Apple recommends a Smart App Banner. If several apps claim the domain, the user chooses once and the choice is remembered [7][7]. - **Android App Links.** Plain deep links work on every Android version but can trigger the system disambiguation dialog. App Links verify the association between the app and the website, so verified links open the app without the dialog. They are supported on Android 6 and later on devices with Google services; Android 15 added dynamic App Links that refine matching without an app release [8][8]. ### Length, version and error correction The longer the URL, the larger the symbol. QR versions run from **version 1 (21 × 21 modules) to version 40 (177 × 177)**, each version adding 4 modules per side [10][10]. Of the four error-correction levels, M (15 % recovery) is the most frequently chosen; L suits clean environments with a lot of data, and Q (25 %) or H suit dirty environments, at the cost of a bigger symbol [11][11]. Byte-mode capacity, the mode a mixed-case URL uses [12][12]: | Version | Modules | L | M | Q | H | |---|---|---|---|---|---| | 1 | 21 × 21 | 17 | 14 | 11 | 7 | | 2 | 25 × 25 | 32 | 26 | 20 | 14 | | 3 | 29 × 29 | 53 | 42 | 32 | 24 | | 5 | 37 × 37 | 106 | 84 | 60 | 44 | | 10 | 57 × 57 | 271 | 213 | 151 | 119 | | 40 | 177 × 177 | 2953 | 2331 | 1663 | 1273 | **Worked examples** (computed with segno 1.6.6, no error-level boost): - `https://example.com/` (20 characters) needs version 2 (25 × 25) at levels L, M and Q, and version 3 at H. - The same URL in capitals, `HTTPS://EXAMPLE.COM/`, fits QR's denser alphanumeric mode and drops to **version 1 (21 × 21)** at L and M. Alphanumeric capacity at version 1 is 25 characters at L and 20 at M [12][12]. ZXing notes this trick but warns it only works if the server accepts uppercased URLs: "Don't try this unless you test it to know it works" [1][1]. RFC 3986 makes only the scheme and the host case-insensitive [2][2]. - A 102-character campaign URL with three `utm_` tracking parameters needs version 5 (37 × 37) at L, version 6 at M, version 8 at Q and version 10 (57 × 57) at H. Shortening the URL is the usual way to keep the symbol small. ## Use cases - **Marketing and print.** Posters, packaging and broadcast advertising. Coinbase's February 2022 Super Bowl advert consisted of a QR code bouncing around the screen like a DVD-player logo; it led to an offer of $15 in bitcoin, and the app crashed under the resulting traffic [19][19]. - **Product packaging.** [GS1 Digital Link](https://docs.barcoder.ai/docs/standards/gs1-digital-link) turns a product's GS1 identifiers into a web-resolvable URL such as `https://example.com/01/09521234543213/10/ABC123`, so one code serves both the retail till and a phone browser [[gdl-ref]]. Its usual carrier is a [GS1 QR Code](https://docs.barcoder.ai/docs/standards/gs1-qr-code) [[gdl-ref]]. - **Payments.** Several payment schemes use a plain URL as their QR payload, with routing done server-side. [SnapScan](https://docs.barcoder.ai/docs/standards/snapscan) in South Africa encodes a `pos.snapscan.io` link with the merchant code, order reference and amount [[snapscan-ref]]. The European standard [EN 18184](https://docs.barcoder.ai/docs/standards/en-18184) defines a URL "envelope" of the form `HTTPS://////` for mobile-initiated instant credit transfers [[en18184-ref]]. - **Contact actions.** `tel:`, `mailto:` and `sms:` codes open the dialer, mail or messaging app with the recipient filled in; Apple recommends `mailto:` and `tel:` URIs so the Camera recognises them correctly [7][7]. - **App onboarding.** With universal links or App Links, scanning a site URL opens the matching app screen directly [7][7] [8][8]. ## Static and dynamic codes - **Static:** the destination is encoded directly in the symbol, so it cannot change after printing [13][13]. - **Dynamic:** the generator encodes a redirect link that the service controls. The destination can then be changed after printing, and the redirect also records scans [13][13]. The trade-off is dependence: a dynamic code only works for as long as the redirect service keeps resolving it, and services can expire codes by disabling the redirect [13][13]. A redirecting or shortened link also hides the final address from the person scanning, which is what phishing guidance asks people to check [15][15] [16][16]. ## Security: QR phishing ("quishing") Because a URL code is unreadable to people until it is scanned, it is a natural carrier for phishing: - **Austin, Texas, January 2022.** Fake QR stickers on city parking pay stations led to a site with no connection to the city. Austin Transportation warned that the city takes payment only at the stations or through its Park ATX app, "not through a website", and asked anyone who paid by QR code to file a police report and notify their card issuer [17][17]. - **FBI IC3 PSA I-011822-PSA (18 January 2022).** It warns that criminals replace legitimate codes, physical and digital, with malicious ones that steal credentials, embed malware or redirect payments. Its advice includes checking the address after scanning for lookalike domains, inspecting physical codes for stickers, not installing apps from QR codes, and avoiding third-party scanner apps [15][15]. - **US FTC consumer alert (6 December 2023).** It describes codes stuck over parking-meter codes and codes sent by text or e-mail with an invented urgent reason. It advises inspecting the URL before opening it and not scanning unexpected codes in e-mails or texts [14][14]. - **UK NCSC (8 February 2024).** It reports a rise in "quishing" e-mails that use QR codes to disguise links, partly because some phishing filters don't scan images. It judges codes in pubs and restaurants probably safe, advises more care in stations and car parks, and recommends the phone's built-in scanner over a third-party app [16][16]. - **Parser mismatch.** In iOS 11, the Camera notification could name one host while Safari opened another for a crafted URL containing an `@` sign. Researcher Roman Mueller reported the issue, and Apple fixed it in iOS 11.3 (2018) [18][18]. ## Implementations | Project | Lang | Stars | Last active | Notes | |---|---|---|---|---| | [zxing/zxing](https://github.com/zxing/zxing) | Java | ~34.2k | 2026-10 | Reference encoder/decoder; its "Barcode Contents" wiki is the de-facto URI-in-QR convention [1][1] | | [zxing-cpp/zxing-cpp](https://github.com/zxing-cpp/zxing-cpp) | C++ | ~2.1k | 2026-10 | C++ port, encoder and decoder | | [soldair/node-qrcode](https://github.com/soldair/node-qrcode) | JavaScript | ~8.2k | 2024-08 | Node and browser encoder | | [nayuki/QR-Code-generator](https://github.com/nayuki/QR-Code-generator) | Java (multi-language) | ~6.8k | 2026-08 | Reference encoder library | | [mebjas/html5-qrcode](https://github.com/mebjas/html5-qrcode) | TypeScript | ~6.2k | 2025-12 | In-browser camera decoder | | [lincolnloop/python-qrcode](https://github.com/lincolnloop/python-qrcode) | Python | ~5.0k | 2026-03 | Python encoder | | [heuer/segno](https://github.com/heuer/segno) | Python | ~0.8k | 2026-07 | Python encoder; used for the worked examples above | ## Comparison - **URL QR vs a structured payload ([WiFi QR](https://docs.barcoder.ai/docs/standards/wifi-qr), [vCard QR](https://docs.barcoder.ai/docs/standards/vcard-qr), [iCal Event QR](https://docs.barcoder.ai/docs/standards/ical-event-qr)).** A structured payload makes the phone act offline: join a network, save a contact, add an event [7][7]. A URL only points somewhere, so it needs a network and a working server, but the content behind it can change and be any size. Choose a structured format when the action is local and fixed, and a URL when the content lives on the web. - **URL QR vs [GS1 Digital Link](https://docs.barcoder.ai/docs/standards/gs1-digital-link).** A Digital Link is a URL with a standardised path grammar for GS1 identifiers, so a till can read the GTIN out of it without fetching anything [[gdl-ref]]. Use Digital Link for products that also need to scan at a checkout, and a plain URL otherwise. - **Static vs dynamic URL.** Static codes keep working forever and reveal their destination. Dynamic codes can be edited and tracked, but depend on the redirect service [13][13]. ## Fun facts - Writing a URL in capitals can shrink its QR code by a whole version, because QR's alphanumeric mode can encode uppercase letters but not lowercase ones [22][22], and an all-capitals URL fits it (segno encodes `HTTPS://EXAMPLE.COM/` in alphanumeric mode). ZXing's own wiki shows `HTTP://MYSITE.COM/FOO` as the example [1][1]. The [EN 18184](https://docs.barcoder.ai/docs/standards/en-18184) envelope is written as `HTTPS://…` in capitals [[en18184-ref]]. - Apple's iOS 11 Camera app recognises the unofficial `SMSTO:` format as well as the RFC `sms:` scheme, and uses it to pre-fill the message text [7][7]. ## Status **Active and ubiquitous.** Both major mobile platforms decode URL codes in the stock camera (iOS since iOS 11 [7][7]; Android through its Camera app, Google Lens and a Quick Settings scanner [20][20]). Every scheme in the table above remains a current IETF RFC or WHATWG/MDN-documented mechanism [2][2] [3][3] [4][4] [5][5] [6][6] [9][9]. New URI schemes are registered under RFC 7595 (June 2015) [21][21]. Security agencies continue to issue quishing guidance, the most recent cited here dating from 2024 [16][16]. ## Sources [1]: https://github.com/zxing/zxing/wiki/Barcode-Contents [2]: https://www.rfc-editor.org/rfc/rfc3986 [3]: https://www.rfc-editor.org/rfc/rfc6068 [4]: https://www.rfc-editor.org/rfc/rfc3966 [5]: https://www.rfc-editor.org/rfc/rfc5724 [6]: https://www.rfc-editor.org/rfc/rfc5870 [7]: https://developer.apple.com/videos/play/fall2017/206/ [8]: https://developer.android.com/training/app-links [9]: https://developer.mozilla.org/en-US/docs/Web/API/Navigator/registerProtocolHandler [10]: https://www.qrcode.com/en/about/version.html [11]: https://www.qrcode.com/en/about/error_correction.html [12]: https://www.thonky.com/qr-code-tutorial/character-capacities [13]: https://hovercode.com/help/article/7-static-vs-dynamic-qr-codes [14]: https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information [15]: https://www.ic3.gov/PSA/2022/PSA220118 [16]: https://www.ncsc.gov.uk/blog-post/qr-codes-whats-real-risk [17]: https://austinmonitor.com/stories/2022/01/fake-qr-codes-found-on-city-parking-stations [18]: https://www.intego.com/mac-security-blog/ios-11s-camera-app-has-a-qr-code-vulnerability/ [19]: https://www.deseret.com/2022/2/14/22933090/coinbase-qr-code-ad-super-bowl-what-happened-next [20]: https://www.android.com/articles/how-do-you-scan-qr-codes-on-android [21]: https://www.rfc-editor.org/rfc/rfc7595 [22]: https://www.thonky.com/qr-code-tutorial/alphanumeric-mode-encoding [qr-ref]: https://docs.barcoder.ai/source/standards/qr-code [gdl-ref]: https://docs.barcoder.ai/source/standards/gs1-digital-link [snapscan-ref]: https://docs.barcoder.ai/source/standards/snapscan [en18184-ref]: https://docs.barcoder.ai/source/standards/en-18184 [1] [Barcode Contents](https://github.com/zxing/zxing/wiki/Barcode-Contents) — ZXing Wiki, accessed 2026 [2] [RFC 3986: Uniform Resource Identifier (URI): Generic Syntax](https://www.rfc-editor.org/rfc/rfc3986) — IETF, 2005 [3] [RFC 6068: The 'mailto' URI Scheme](https://www.rfc-editor.org/rfc/rfc6068) — IETF, 2010 [4] [RFC 3966: The tel URI for Telephone Numbers](https://www.rfc-editor.org/rfc/rfc3966) — IETF, 2004 [5] [RFC 5724: URI Scheme for GSM Short Message Service (SMS)](https://www.rfc-editor.org/rfc/rfc5724) — IETF, 2010 [6] [RFC 5870: A Uniform Resource Identifier for Geographic Locations ('geo' URI)](https://www.rfc-editor.org/rfc/rfc5870) — IETF, 2010 [7] [QR Code Recognition on iOS 11](https://developer.apple.com/videos/play/fall2017/206/) — Apple Developer Tech Talks, 2017 [8] [About App Links](https://developer.android.com/training/app-links) — Android Developers, accessed 2026 [9] [Navigator: registerProtocolHandler() method](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/registerProtocolHandler) — MDN Web Docs, accessed 2026 [10] [Information capacity and versions of QR Code](https://www.qrcode.com/en/about/version.html) — Denso Wave, accessed 2026 [11] [Error correction feature](https://www.qrcode.com/en/about/error_correction.html) — Denso Wave, accessed 2026 [12] [Character Capacities by Version and Error Correction Level](https://www.thonky.com/qr-code-tutorial/character-capacities) — Thonky.com, accessed 2026 [22] [Alphanumeric Mode Encoding](https://www.thonky.com/qr-code-tutorial/alphanumeric-mode-encoding) — Thonky.com, accessed 2026 [13] [The difference between static and dynamic QR codes](https://hovercode.com/help/article/7-static-vs-dynamic-qr-codes) — Hovercode (vendor), accessed 2026 [14] [Scammers hide harmful links in QR codes to steal your information](https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information) — US Federal Trade Commission, 2023 [15] [Cybercriminals Tampering with QR Codes to Steal Victim Funds (I-011822-PSA)](https://www.ic3.gov/PSA/2022/PSA220118) — FBI Internet Crime Complaint Center, 2022 [16] [QR codes – what's the real risk?](https://www.ncsc.gov.uk/blog-post/qr-codes-whats-real-risk) — UK National Cyber Security Centre, 2024 [17] [Fake QR codes found on city parking stations](https://austinmonitor.com/stories/2022/01/fake-qr-codes-found-on-city-parking-stations) — Austin Monitor, 2022 [18] [iOS 11's Camera App Has a QR Code Vulnerability](https://www.intego.com/mac-security-blog/ios-11s-camera-app-has-a-qr-code-vulnerability/) — Intego, 2018 [19] [Coinbase's QR code Super Bowl ad: what happened next](https://www.deseret.com/2022/2/14/22933090/coinbase-qr-code-ad-super-bowl-what-happened-next) — Deseret News, 2022 [20] [How do you scan QR codes on Android?](https://www.android.com/articles/how-do-you-scan-qr-codes-on-android) — Android (Google), 2025 [21] [RFC 7595: Guidelines and Registration Procedures for URI Schemes](https://www.rfc-editor.org/rfc/rfc7595) — IETF, 2015 ## Deployments Found in the following country reports (grep across `reports/countries/`): - **XK** — [XK-kosovo.md](https://docs.barcoder.ai/docs/payments/XK) ## Regions / aggregations not mapped to a single country - Universal