Avoid Costly Reprints: QR Code Best Practices for Marketers

Make QR codes big enough, dark on light, with a 4-module quiet zone and a mobile-optimised destination, and use dynamic codes for anything you print. These rules come straight from the ISO/IEC 18004 symbology specification and GS1’s print guidance, and getting them right is what separates a code that converts from one that just sits on a poster looking clever.

TL;DR:

• QR codes should follow the 10:1 size rule, with at least four modules of quiet zone space, and contrast dark on light to ensure reliable scanning.
• Use vector formats like SVG or PDF for print to maintain clarity, and always test codes at actual size on the chosen substrate under real lighting conditions before launching.
• Dynamic QR codes are essential for printed or long-term displays because they allow real-time updates, fixing broken links without reprinting.
• Secure your links by serving over HTTPS, vetting redirects beforehand, and printing a short URL beside the code for user verification.
• Most failures stem from static codes being printed too early; implementing a strict workflow with sign-off and real-device testing prevents costly mistakes.

Table of Contents

• Quick checklist: essential QR code best practices for immediate QA
• Design and technical rules: quiet zone, contrast, size and error correction
• Content and destination: dynamic codes, deep links and landing pages
• Placement and production: substrate, finish and lighting
• Testing and validation before you print anything
• Measurement and privacy: tracking scans without overstepping
• Security: reducing phishing risk and protecting user trust
• How we think about operationalising these rules
• Where QRlytics fits into your QA checklist
• Sources
• FAQ

Quick checklist: essential QR code best practices for immediate QA

Before anything goes to print or live on a screen, run it against this list:

1. Sizing — follow the 10:1 rule (code width at least a tenth of the scan distance).
2. Quiet zone — leave four clear modules of blank space around the code, no exceptions.
3. Contrast — dark modules on a light background; avoid inverted colour schemes.
4. File format — export as SVG or PDF for print, PNG for screens.
5. Error correction — set level M as the default; use H only with a logo overlay.
6. Dynamic vs static — anything printed, mailed, or displayed long-term gets a dynamic code.
7. CTA copy — tell people what happens when they scan, in plain language.
8. Analytics — attach UTM parameters or a tracked redirect before launch.
9. Accessibility — print the destination URL in readable text beside the code.
10. Security — only point codes at domains you control or fully trust.

Pro Tip: Never send a printed campaign live with a static code. If the offer changes, the venue moves, or the link breaks, a dynamic code lets you fix it in seconds instead of reprinting thousands of leaflets.

Design and technical rules: quiet zone, contrast, size and error correction

The quiet zone is not decorative padding, it is a functional requirement of the ISO/IEC 18004 specification, and scanners genuinely cannot read a code reliably without it. A gap of at least four modules on every side stops nearby text, logos, or borders from being misread as part of the symbol, which is why cropping a code tight to save space on a flyer is one of the fastest ways to kill a scan rate.

Contrast matters just as much. Dark modules on a light background remain the safest choice, and practitioner guidance generally points to a contrast ratio of roughly 4:1 as a sensible working minimum. Inverting the palette, light modules on dark, looks striking in a mock-up but degrades scan reliability on many camera apps, so treat it as a decision to test hard, not a default.

Size follows the 10:1 rule: divide the expected scan distance by ten to get a minimum code width. A poster read from two metres (200cm) needs a code at least 20cm wide; a shelf-edge label read from 20cm away needs roughly 2cm, which most guides treat as the practical baseline for close-range retail use.

On error correction:

• Level L — maximum data capacity, minimal redundancy; fine for pristine digital-only use.
• Level M — the sensible default for most campaigns, balancing capacity and resilience.
• Level Q — a step up for codes exposed to wear, like outdoor signage.
• Level H — required when overlaying a logo, since it rebuilds more of the pattern if part is obscured, though it increases symbol density so the printed size needs to grow to compensate.

For export, use SVG or PDF for anything going to print, since vector formats stay sharp at any size. Use PNG for screens and digital assets. Avoid JPEG entirely; its compression introduces artefacts that blur module edges and can push a marginal code past the point of scanning at all.

Content and destination: dynamic codes, deep links and landing pages

A static code hardcodes the destination directly into the pattern, permanently. A dynamic code points to a redirect you control, so the underlying URL can change after the code is printed. The core rule for marketers is simple: static is fine for one-off digital use, but anything printed, mailed, or displayed for more than a few days should be dynamic, because you will eventually want to fix a link, swap an offer, or redirect a dead campaign to something live.

Deep links push scanners into a specific action rather than a generic homepage: opening a map app at a location, launching a ticket in a wallet app, or starting a file download immediately. Nielsen Norman Group’s usability research found that codes performing a single, obvious action convert better than ones dumping users on a general site and expecting them to find their own way.

Once someone lands, the checklist that decides whether the scan was worth it includes:

• A fully responsive layout that renders correctly on the small screen it will actually be viewed on.
• One clear call to action, not three competing offers.
• A tight performance budget, since a slow-loading page loses attention within seconds.
• UTM tagging or analytics events fired on load, so the scan is attributable to the specific campaign asset.

Public link shorteners save a few characters but cost you trust and analytics ownership. A brand-controlled short domain keeps the destination visible and consistent with your other marketing, and it puts you in control of redirect speed rather than depending on a third party’s infrastructure.

Placement and production: substrate, finish and lighting

Physical production breaks more codes than bad design does. GS1’s print quality guidance treats substrate and finish as critical variables, not afterthoughts.

• Choose matt over gloss laminate wherever possible; glare on a shiny finish confuses autofocus in bright environments.
• On curved surfaces or flexible packaging, test the actual production sample, not a flat proof, since distortion changes module proportions.
• Keep the code away from busy artwork or competing text, and position it at a comfortable scanning height for posters and point-of-sale, following corporate event signage best practices.
• Check lighting conditions on site; dim retail lighting or reflective shop windows both demand a larger, higher-contrast code than a well-lit office.
• Before full print runs, export vector files, proof on the real press and substrate, and physically measure module size and contrast on that proof, not on a screen mock-up.

Testing and validation before you print anything

A code that scans perfectly on your desk can fail completely at real size, in a real store, under real lighting. Run this sequence every time:

1. Build a device matrix: at least one recent iPhone, one older Android handset, and a budget Android device where you can get one.
2. Test with the phone’s built-in camera and at least one dedicated scanning app, since behaviour differs between them.
3. Scan the final exported asset at its actual printed size on the actual substrate, under the lighting the code will face in the field.
4. Walk the entire post-scan flow yourself: redirect latency, landing-page layout on a small screen, and confirmation that tracking events actually fire.
5. Confirm the accessibility fallback is legible: a short human-readable URL printed beside the code for anyone who cannot or will not scan.

Measurement and privacy: tracking scans without overstepping

Useful campaign data does not require invasive tracking. The metrics worth capturing are timestamp, an aggregated location heat map, device class, and UTM-based campaign attribution, which Digital frames around campaign URL builders paired with QR deployment.

• Route scans through a dynamic redirect or server-side endpoint so events are logged reliably, keeping the landing page itself free of tracking clutter.
• Never collect personally identifiable information at the point of scan; a scan event is not consent to build a profile.
• Show a short, clear privacy notice on the landing page wherever data is captured beyond a basic redirect.
• Aggregate or anonymise location data rather than storing precise coordinates per scan.

A brand-controlled short domain also improves analytics accuracy, since every redirect stays inside infrastructure you own rather than a third party’s black box, which matters when you need to reconcile scan counts against campaign spend.

Security: reducing phishing risk and protecting user trust

QR phishing follows familiar patterns: malicious redirects swapped in after printing, or lookalike short domains designed to imitate a trusted brand. IC3 advisories document exactly this rise in QR-based scams and recommend both user education and technical safeguards.

• Vet every redirect target before launch and recheck it periodically for a dynamic code’s lifetime.
• Serve landing pages over HTTPS and avoid public shorteners where brand trust matters.
• Print a readable short URL beside the code so a wary user can verify the destination before scanning.
• Test how major phone camera apps preview the link, since a suspicious-looking preview domain will suppress scans even from people who trust your brand.

How we think about operationalising these rules

Most of the failures marketers see in the field trace back to one decision made too early: printing a static code before the campaign is finalised. Permanent-code guarantees and dynamic redirects exist precisely because campaign details change after the print run ships, and a code that can be repointed after the fact turns a costly mistake into a five-minute fix. Real-time analytics and heat maps matter for the same reason contrast ratios matter: they turn a guess into a measurement.

A workable pre-flight process looks like this: design against the numeric rules, test on the device matrix, then have one named owner, usually the campaign manager, sign off on the final proof before it goes to press. That single accountability step catches more errors than any design checklist alone.

— The

Where QRlytics fits into your QA checklist

Every rule above assumes you can act on it after the code is already in the world, and that is exactly where most free generators fall short. QRlytics builds dynamic redirects, permanent code functionality, and real-time scan analytics directly into the platform, so a code created during an active subscription keeps working regardless of billing status, rather than quietly dying the moment a free trial lapses or a payment fails.

That matters most for anything printed: posters, packaging, event signage, all the assets you cannot reprint on a whim. If you need to update a destination, check a heat map of where scans are actually coming from, or export analytics for a campaign report, the dynamic QR code generator handles the whole workflow without a credit card required to start. For a quick first test, the free QR code generator is the fastest way to see the difference a permanent, trackable code makes before you commit a full campaign to it.

Sources

• GS1 2D barcode creation and printing playbook
• IC3 public safety advisories on QR-code scams

FAQ

What is a recommended practice regarding QR codes?

Use a dynamic code for anything printed, keep a 4-module quiet zone intact, and test the finished code at real size on the actual substrate before mass production.

What is a best practice when scanning QR codes?

Check the readable URL shown in your camera’s preview before tapping through, and avoid scanning codes on unofficial stickers placed over existing signage.

What are the rules for QR codes?

The ISO/IEC 18004 specification governs quiet zone, module sizing, and error correction levels, while GS1 adds print-quality and placement guidance for real-world retail and packaging use.

What makes a good QR code?

Strong contrast, adequate size for its viewing distance, a clean quiet zone, an appropriate error-correction level, and a mobile-optimised destination that loads fast and does one clear thing.

Should I use a static or dynamic QR code for a print campaign?

Dynamic, almost always. A dynamic code lets you fix a broken link or update a destination without reprinting anything, which static codes cannot do once they are on paper.

Recommended

• Reduce print waste with QR codes: the marketer’s guide
• QR codes for catalogs: a marketer’s campaign playbook
• Avoiding QR code mistakes: a marketer’s guide
• How to update QR code links without reprinting