Automated tests: what we observed, not what vendors say
Three tests a script can run against any vendor without an account, each dated and repeatable.
- 10 of 13generators produced a pattern we could decode (4 only as an on-screen preview)
- 10redirect domains identified
- 14vendor sites scanned
Test 1: what a free static code actually contains
We typed the same address, https://example.com/qr-test-2026, into each generator, downloaded the free static code without signing in where that was possible, and decoded the image with an open-source QR reader. "Your URL, directly" means the pattern holds your address and no vendor sits between the scan and your page.
| Vendor | Free static code without an account | Decoded content | Image size | Tested |
|---|---|---|---|---|
| The QR Code Generator | Yes | Your URL, directly | 1000x1000 | 2026-10-09 |
| Hovercode | Yes | Your URL, directly | 1100x1100 (PNG) | 2026-10-09 |
| QR TIGER | No | Download needs an account (on-screen preview encodes your URL directly) | 2026-10-09 | |
| Flowcode | No | Download needs an account (on-screen preview encodes a vendor link) | 2026-10-09 | |
| Scanova | Yes | Your URL, directly | 256x256 | 2026-10-09 |
| ME-QR | No (static codes are a paid feature) | Vendor link (q.me-qr.com); the free download is a dynamic code | 1000x1000 | 2026-10-09 |
| QRStuff | Yes | Your URL, directly | 405x405 | 2026-10-09 |
| QRFY | No | Download needs an account | 2026-10-09 | |
| QR.io | No | Download needs an account (on-screen preview encodes your URL directly) | 2026-10-09 | |
| Uniqode | Not tested | Not tested: the generator widget did not load in our browser | 2026-10-09 | |
| QRCodeKIT | No | Download needs an account | 2026-10-09 | |
| QR Planet | Yes | Your URL, directly | 1584x1584 (PNG) | 2026-10-09 |
| Adobe Express | No | Download needs an account (on-screen preview encodes your URL directly) | 2026-10-09 |
The QR Code Generator, Hovercode, QRStuff, Scanova and QR Planet produced a direct static code without an account. QR TIGER, Adobe Express, QRFY, QR.io, Flowcode and QRCodeKIT required an account before any download. QRStuff defaults both "Update later" and "Enable analytics" to on, which makes a dynamic code unless you switch them off. ME-QR's free download is a dynamic code through its own domain; its static option is Premium only. Uniqode's generator widget did not load in our headless browser in four of five attempts, so it is marked for a manual re-test.
Test 2: which domain your dynamic code points to
A dynamic code never holds your address. It holds a short link on a domain the vendor controls, and that domain is the single point of failure. We decoded sample codes on each vendor's own site and help pages to find the domain, then requested each one over HTTPS on the test date and recorded the response and whether it sent an HSTS header. Whether plain HTTP is redirected to HTTPS was not tested.
| Vendor | Redirect domain | How sure | Response | HSTS | HTTP redirects to HTTPS |
|---|---|---|---|---|---|
| The QR Code Generator | qr-codes.io | medium-high | 200 in 795 ms | Yes | Not tested |
| Hovercode | scango.to | high | 200 in 539 ms | No | Not tested |
| QR TIGER | qr1.be | high | 200 in 950 ms | Yes | Not tested |
| Flowcode | flowcode.com | high | 301 in 483 ms | Yes | Not tested |
| Scanova | scnv.io | high | 200 in 668 ms | Yes | Not tested |
| ME-QR | q.me-qr.com | high | 301 in 524 ms | Yes | Not tested |
| QRStuff | qrs.ly | high | 302 in 1234 ms | No | Not tested |
| QRFY | Not found without an account | ||||
| QR.io | Not found without an account | ||||
| Uniqode | qrcodes.pro | high | 301 in 594 ms | Yes | Not tested |
| QRCodeKIT | qrkit.co | medium-high | 200 in 501 ms | No | Not tested |
| QR Planet | qrplanet.com | medium-high | 200 in 862 ms | Yes | Not tested |
| Adobe Express | Static codes only; no redirect domain |
Some vendors use more than one redirect domain. Hovercode's pricing FAQ also names qrgo.is and hov.to; its help centre names scango.to. Sample codes on ME-QR's homepage decode to me-qr.com links, QRCodeKIT also uses uqr.to, and QR Planet also uses qrd.by, qr.vc and qr1.at. The HSTS value on qr-codes.io and qrcodes.pro is 300 seconds.
Test 3: security headers on each vendor's website
What the vendor's main site sends to a browser. HSTS tells browsers to use HTTPS only; a header sent with max-age=0 switches it off, so we count it as not enabled. X-Frame-Options stops the site being embedded in an invisible frame for clickjacking. These are observed facts about the public site, not an audit of the product.
| Vendor | Host | HSTS | X-Frame-Options | Checked |
|---|---|---|---|---|
| The QR Code Generator | www.the-qrcode-generator.com | Yes | SAMEORIGIN | 2026-10-11 |
| Hovercode | hovercode.com | Yes | DENY | 2026-10-11 |
| QR TIGER | www.qrcode-tiger.com | Sent with max-age=0 (disabled) | Not set | 2026-10-11 |
| Flowcode | www.flowcode.com | Yes | SAMEORIGIN | 2026-10-11 |
| Scanova | scanova.io | Yes | Not set | 2026-10-11 |
| Canva | www.canva.com | Yes | SAMEORIGIN | 2026-10-11 |
| ME-QR | me-qr.com | Yes | SAMEORIGIN | 2026-10-11 |
| QRStuff | www.qrstuff.com | No | Not set | 2026-10-11 |
| QRFY | qrfy.com | Sent with max-age=0 (disabled) | SAMEORIGIN | 2026-10-11 |
| QR.io | qr.io | No | Not set | 2026-10-11 |
| Uniqode | www.uniqode.com | Yes | SAMEORIGIN | 2026-10-11 |
| QRCodeKIT | qrcodekit.com | Yes | SAMEORIGIN | 2026-10-11 |
| QR Planet | qrplanet.com | Yes | SAMEORIGIN | 2026-10-11 |
| Adobe Express | www.adobe.com | Yes | Not set | 2026-10-11 |
How these tests run
- The decode test uses a headless desktop browser, types the address with keystrokes, downloads the file, and reads it with jsQR, falling back to ZXing. Every step is screenshotted.
- Redirect domains come only from first-party evidence: sample codes on the vendor's own pages or a help article naming the domain. Where neither exists, the row says so instead of guessing.
- The security scan reads each vendor's homepage response headers on every run; the date of the last run is shown above.
- Prices are checked monthly against each vendor's live page; see how our dates work.