Dynamic QR Codes: What They Are, When to Use One, and How to Tell Yours Apart

Say you've inherited a print run. Eight thousand inserts, ordered by someone who has since left, each carrying a QR code you didn't create. Before you plan anything around them you need one answer: can the destination still be changed?

If the code is dynamic, yes. A dynamic QR code holds a short redirect URL that the platform's server resolves, so the destination can be repointed after the code is printed. A static one holds the destination inside the printed pattern, and changing where it points means printing a new code.

Order dynamic when the destination will change after printing, or when it is a destination you do not control. Order static when the URL will outlive the campaign and your own server logs are enough.

Either way the code depends on something continuing to answer. For a static code that is your own domain. For a dynamic one it is a company you are paying.

Which one you want

Cost is wider than the table suggests. Hovercode puts dynamic pricing at about $6 per month for a small business and "up to hundreds per month" at high volume. Scanova gives a public range of "~$5–$100/month depending on volume and features".

Both are vendor estimates read in October 2026, not measured prices. Static codes are usually free to generate.

One row needs unpacking, because it is where several vendor guides mislead you. A static code cannot be edited in place, but that is not the same as being permanent. If the URL you print points at your own server, you can redirect it there whenever you like. That is a self-hosted dynamic code, and what you give up is the platform: you build and maintain the routing and the reporting yourself.

The rest of the decision comes down to three questions.

Will the destination change after printing? Then dynamic saves you a reprint. On the inserts, the landing page changes with each campaign, so the printed code has to keep working long after the page it was printed for has gone.

Do you need scans counted when the destination is not yours? Both types record a scan the same way: the phone requests the encoded URL, and whichever server answers logs the hit. A static code aimed at your own domain is counted in your server logs, and giving each placement its own URL is how you tell the insert apart from the shelf talker.

A scan that ends at an app store listing or somebody else's site is the problem case, because it leaves you no log of your own. A redirect gives you one, and it still counts the hit when the destination's own analytics never fire. Build the tagged URLs with our UTM builder.

Does the code have to route by device? Sending iOS and Android scanners to different stores, or different languages to different countries, needs a redirect in the middle. A static code can only do it if the URL it holds is on a server you run that makes the decision.

A longer encoded string makes a busier pattern, which is what Denso Wave's version tables show: the symbol gains modules as the data grows. So a short redirect scans more easily than a long tagged URL. Keep your static URLs short and most of that advantage disappears.

How to tell which one you have

These steps come from how redirects and QR platforms work. We haven't run them against a set of printed codes, and we haven't measured how any platform handles query parameters or redirect delay.

Do them in this order. The first one is about your safety, and the last is the one that settles the question.

1. Decode it without opening it. Use a QR reader that shows the raw text, or upload a photo to a desktop decoder. You want the string before anything loads. A dynamic code's destination can change after the last person checked it, so a code you didn't create should be read before it is opened.

The FBI's 2022 notice on tampered QR codes covers the related risk: criminals replace or alter codes, physical ones included, to send scanners to pages that harvest logins and payment details.

2. Read the string. A static code gives you the destination in full, usually with a path and often a query string. A dynamic code gives you a short host and a short token, like the qrco.de/… form QR Code Generator's own help page gives as its example, or the invented yourbrand.link/s/9d41.

Two traps. A static code pointing at a shortener somebody else set up looks identical to a dynamic one. And a dynamic code on a branded domain can look like any other URL, so step 3 is what shows the redirect.

3. Read the redirect chain. Paste the string into a redirect checker, or run curl -sSL -D - -o /dev/null '<the decoded URL>'. Every line starting with HTTP/ is a hop and every Location: header is where the request goes next.

Three things to take from the output. A hop through a domain you don't recognize means a redirect service sits in the path and somebody else holds the account. The first status code, 301 or 302, along with any Cache-Control header, decides whether a change of destination reaches people who have scanned before.

And if the first status line is 200, that response carried no redirect hop at all, which usually means the platform moves you inside the page rather than in a header, or routes by device. The second case you can check by adding -A and a phone user-agent. Requesting the URL also counts as a scan for whoever owns the code.

4. Repoint it, if you hold the account. Change the destination in the dashboard, then scan it on a phone that has never scanned it, or in a private window, so a cached redirect does not hide the change. If it goes somewhere new, the code is dynamic and the dashboard is yours. That test settles it.

If nobody holds the account. This is the situation for the inserts, and step 4 cannot help you.

• Take the decoded host to whoever ordered the print run: the agency, the printer, or the invoice.
• If the host names a platform you recognize, tell that platform the code exists and ask who owns the account.
• Otherwise treat the code as fixed. Leave it, cover it with a corrected sticker, or reprint.

What the string tells you. A short vendor-style host with a hop is dynamic. A full destination with no foreign hop is static, or a redirect you control. A short token on a custom branded host is a dynamic code that looks like a static one.

The answer most platforms give is account-scoped. QR Code Generator's support article explains that its dynamic codes show a short URL and a scan count in your account, while its static codes are labeled Static/Non-trackable. That answers the question for a code you made on that platform, and not for the inserts.

What goes wrong after you print

The two situations are different and vendors describe them separately. QR Code Generator's support docs cover the free trial: dynamic codes "expire once your free trial ends", while static codes "don't expire and remain active permanently". Hovercode describes the paid case: a lot of providers "only keep your dynamic codes active if you continue to pay for their service. They do this by disabling the redirect links used in the QR codes you create".

A dynamic code's reliability is dependent on the continued operation of the provider.

Put the redirect on a domain you control, so the host printed on the material stays yours, and confirm that the next provider can serve the same paths. Where a placement allows it, print a static code to a permanent URL beside the dynamic one as a fallback with no plan to lapse.

Two failures sit outside the plan. Free tiers often limit how many codes you can create even where scans are unlimited. And if the domain a static code points at stops resolving, that code stops with it, which is the one expiry a static code does have.

Caching is the third. RFC 9110 §15.4.2 states that "A 301 response is heuristically cacheable", and MDN's example response carries a cache-control: max-age=2592000,public header, thirty days. Any response with explicit freshness information can be cached, so a 302 with a long lifetime has the same effect.

A repoint can therefore fail to reach a returning visitor while a cached redirect is still fresh, and their second scan goes uncounted. That risk applies to people who scan the same code twice, which for a printed insert is a minority. It comes from the specifications, not from testing.

Two more things are worth asking about before you print. Ask whether the platform forwards query parameters to your destination; if it strips them, your campaign tags never arrive and scans can show up as direct traffic. Ask also how long the first hop takes on a weak connection, since the redirect is one more step that has to complete before the page loads.

Four questions are worth putting to any vendor.

• Does the platform return a 302 or a 301?
• Does it forward query parameters to your destination?
• Does the free tier have a time limit?
• What does a lapsed code show a scanner?

For our own platform, one of those four has a direct answer as of October 2026: there is no trial and no time limit on the free plan, and QR codes and scans are unlimited on every plan including the free one, with links that can route to an app, a web page, or a store (our QR feature page lists what is included). Our public pages do not state which status our redirect returns, whether it forwards query parameters, or what a scanner sees when a plan lapses, so ask us before you print. See pricing for plan detail.

Print and scanning problems hit both types. Bitly's print guidance gives a minimum of 0.8 inches (2 cm) for a code scanned at close range and about one inch of code side length per foot of scanning distance for signage, on dark ink over a light background with nothing busy behind the symbol.

If the code points at your app

One case does not follow the pattern above. If a scan is meant to end in an install, a count of scans is not enough, because the person may not have the app and may install days later with nothing connecting the two.

Two different jobs get bundled together here. Attributing a download to a campaign works without deep linking, and the two stores report it differently. Apple's campaign links carry campaign, provider and media-type tokens, and App Store Connect Analytics reports downloads tied to each campaign token.

Android works per install instead. The Play Install Referrer API returns the referral content for that one install, available for 90 days and unchanged unless the app is reinstalled, and your app reads it once on first run. Turning those individual referrers into campaign totals is your job rather than the store's.

Matching one specific scan to one specific install, and opening the right screen after the app finishes installing, is what deferred deep linking adds on top of either.

Every ChottuLink link includes a dynamic QR code you can edit after printing, and QR codes and scans are unlimited on every plan including the free one. A scan from a phone without the app sends the person to the App Store or Google Play. Our guide to QR code deep links covers that routing, and our post on QR code tracking covers what the scan data can and cannot support.

FAQ

Do dynamic QR codes expire?

By plan. A vendor that runs your redirect on a subscription stops serving it when you stop paying, and QR Code Generator's help page says its dynamic codes expire when the free trial ends. A static code has no plan to expire, so it lasts as long as the domain it points at. There's more on this in the section above.

How much does a dynamic QR code cost?

Vendor estimates put it around $5 to $100 a month for most small businesses, and into the hundreds at high volume. Static codes are usually free to generate. On our own platform the free plan has no time limit; see pricing.

Can I change a dynamic QR code to a static one?

Not in place. The pattern holds the redirect URL, so making the code static means generating and printing a new one. The reverse is easier: a static code pointing at a URL on your own domain can be repointed whenever you change that URL.

Do dynamic QR codes work offline?

No, because the redirect server has to answer.

Before you print

1. If the code is already printed, run the four steps and sort out who owns the redirect account.
2. Decide against the three questions above.
3. Ask the four questions, and get the expiry policy in writing.
4. If the encoded host is on a domain you don't control, confirm the platform can serve the paths you are about to print.
5. Test at the real size, on the real material, in the real light. If you are on a trial, put a reminder in your calendar for the day before it ends.