Static vs Dynamic QR Codes
What the redirect actually buys you, measured on real encoded codes, and which payloads are worse off for it.
16 min readA code on a collection tin, an appeal poster or an order of service, so people can give without carrying cash.
This one moves money, so read the checks below before you print anything. They take five minutes and they are the difference between a collection and somebody else's collection.
✓ Scan-tested: this code reads back correctly.
Contrast 21:1, Strong
Version 2 · 33 modules · print at least 13.2 mm wide
Somebody prints their own code and puts it over yours. Every donation goes to them, the poster looks exactly right, and nothing tells you until the money does not arrive. It works because a QR code is unreadable to a human, so nobody looks at it, and because a collection point is often unattended for hours.
Three habits handle most of it. Laminate or fix the code down so a sticker over the top is visible. Print the destination in text beside the code, so a donor can compare what appears on their screen against what is printed. And scan your own codes when you walk past them, on a phone that is not the one you designed them on.
Tell donors what to check, too: the name on the payment screen before they confirm. That single check defeats the whole attack, and it is the reason to put your organisation's name on the receiving account rather than an individual's.
A donation code is an ordinary web link, so there is no special payment format involved and nothing here talks to your bank. What differs between the options is how large the printed code has to be, and whether you can change where it goes afterwards.
| What you enter | What the scanner reads | Version | Modules | Print at least |
|---|---|---|---|---|
| Your own donation pageSmallest, and the only one you can repoint or take down yourself. | https://example.org/donate26 characters | 3 | 37 | 14.8 mm |
| PayPal.Me linkAn ordinary link. The recipient name shows before anybody pays. | https://paypal.me/examplecharity32 characters | 3 | 37 | 14.8 mm |
| PayPal with an amountPrefills a suggested amount, which the donor can still change. | https://paypal.me/examplecharity/1035 characters | 4 | 41 | 16.4 mm |
| A fundraising pageLong. Compare its print width against the first row. | https://www.justgiving.com/fundraising/example-campaign-202660 characters | 5 | 45 | 18 mm |
Your own page is the best answer on both counts. It is the smallest code, so it survives on a tin or a leaflet, and it is the only one you can repoint when a campaign ends or a payment provider changes. It also lets you say what the money funds, which a payment screen cannot.
If you are collecting through a specific service, the PayPal and Venmo pages cover the link forms for each, with the same safety rules.
Because a collection code often outlives the campaign that created it, it is worth reading what actually makes a printed code last before you commit it to a thousand leaflets. If you are collecting at a specific occasion, an event code beside it puts the date in people's calendars at the same time. On a counter or a receipt, the code most often printed next to a donation one is a review code, and the two have very different risk profiles.
Put your donation page or payment link in the tool above and print the code. The link is an ordinary web address, so no special payment format is involved. What matters is verifying the printed code before it goes out.
It is safe for the donor if they check the name on the payment screen before confirming, and it is safe for you if the printed code is one you can see and has not been tampered with. Swapped stickers on unattended collection points are a known and simple attack.
Your own page, if you have one. It encodes smaller, you can change what it does without reprinting, and it can explain what the money funds. A payment link is quicker to set up and fixes you to that provider once printed.
Yes, if your payment provider supports an amount in the link, as PayPal.Me does. The donor can still change it. A suggested amount usually raises the average and it also makes the code slightly larger.
The code does not. It is ink, and it will decode to the same address in twenty years. What expires is the page it points at, which is the argument for pointing it at an address you own rather than a campaign URL on somebody else's platform.
Payment links and product pages, with the safety checks a printed payment code needs.
What the redirect actually buys you, measured on real encoded codes, and which payloads are worse off for it.
16 min readThe usable square inside a round sticker is 70% of its diameter. Measured minimum sizes for real links, against every common sticker size.
8 min readWhat each platform already ships, the measured cost of each payload type, and how to check an offline claim yourself.
26 min read