QR Code Generator is designed with privacy-first, zero-data-collection principles. We take the security of your data seriously. This document outlines our security practices and how to report vulnerabilities.
Your Browser → QR Code Generated Locally → Downloaded to Your Device
↓
Nothing leaves your browser. Ever.
| Principle | Implementation |
|---|---|
| No Server | The app has NO backend. Everything runs in your browser. |
| No Data Collection | Zero analytics, no cookies, no tracking of any kind. |
| No Storage | Nothing is saved to any server or database. |
| Works Offline | Once loaded, the app works without internet. |
| No Third-Party APIs | No external API calls. The QR library is loaded from CDN on first visit only. |
- Background image uploads are processed entirely in your browser
- Images are never uploaded to any server
- SVG files are blocked to prevent inline script injection
- 5MB file size limit to prevent memory issues
- Only PNG, JPG, WebP, GIF formats are accepted
- The app encodes your exact raw input — no URL shortening, no redirects, no modifications
- Always verify the QR code destination before scanning unknown codes
- The QR generation library (
qrcode-generator) is loaded from CDN on first visit - After initial load, it's cached and works offline
- If you prefer full offline use, you can inline the library into the HTML
If you discover a security vulnerability, please do NOT open a public issue.
Instead, report it privately:
- Go to the Security tab on GitHub
- Click Report a vulnerability
- Provide detailed information about the issue
We aim to:
- Acknowledge receipt within 48 hours
- Provide an initial assessment within 5 business days
- Release a fix as quickly as possible
| Version | Supported |
|---|---|
| Latest (main branch) | ✅ Yes |
| Older versions | ❌ No |
Only the latest version receives security updates. Please keep your deployment up to date.
- Verify URLs — Always check the QR content before scanning from untrusted sources
- Use HTTPS — Deploy behind HTTPS for secure delivery
- Keep Updated — Use the latest version for security fixes
- Offline Use — For maximum privacy, download and use the file locally
Your privacy is the #1 priority. This tool will always be free, ad-free, and tracker-free.