Honest QRCode

A genuinely free QR code generator. Static codes that never expire, no account, no watermark, no tracking redirect. Everything runs in the visitor's browser.

Live: https://honest-qrcode.pp.ua

• English: /
• Ukrainian: /uk/

What makes it different

Most "free" QR generators hand you a dynamic code: the pattern encodes their short URL, which redirects to yours. That means the code works only while their service exists and the plan is paid, they see every scan, and they can switch it off. This tool only makes static codes — your data is encoded directly into the pattern, so a downloaded code has no dependency on this site at all.

The privacy claim is enforced, not just promised. The page ships a Content-Security-Policy with default-src 'none' and connect-src 'none' (see site/_headers), so the browser itself refuses any outbound request. The QR library and the fonts are served from the same origin. There is no analytics, no cookies and no third-party request of any kind.

Features

• Static QR codes, any length, no limits
• Module shapes: squares, rounded, dots
• Corner-marker (finder pattern) shapes: squares, rounded, circles
• Solid colour or gradient (linear in three directions, or radial)
• Transparent background
• Centre logo, with the size ceiling enforced per error-correction level so the code cannot become unreadable (see docs/SCANNABILITY.md)
• Caption bar above or below the code
• Quiet-zone and corner-rounding control
• Error correction L / M / Q / H
• WCAG contrast warnings when a colour choice would defeat a camera
• Export PNG, SVG, JPG; copy PNG to clipboard
• Correct UTF-8 encoding (Cyrillic, accents, emoji)
• Light and dark theme
• Two languages on separate, individually indexable URLs

Local development

No build step, no dependencies, no package.json. Requires Node only for the dev server and the checks.

git clone https://github.com/DmitriyLeaf/Honest-QRCode.git
cd Honest-QRCode
node tools/serve.mjs

Then open http://localhost:8788. The dev server applies the same CSP as production, so anything the live policy would block also breaks locally, where you will actually notice it.

Opening site/index.html straight from the filesystem will not work: the pages use root-absolute asset paths (/assets/...). Use the dev server.

Checks

node tools/validate.mjs
node tools/decode-test.mjs

validate.mjs — structural, for both language pages: every DOM id app.js looks up exists, no duplicate ids, the JSON-LD parses, exactly one <h1>, every referenced local asset is on disk, no external subresource is loaded, all outbound links carry rel="noopener", the hreflang set is complete, and app.js contains no network primitives.

decode-test.mjs — the one that matters. Generates codes through the real UI across 46 configurations per language, rasterises them, decodes them back, and fails on any mismatch. Three defects in this project produced codes that looked perfect and could not be decoded; none was visible to inspection. Rendering is not the thing to verify — decoding is. See docs/SCANNABILITY.md.

It drives headless Chrome over the DevTools Protocol using Node's built-in WebSocket, so it needs no packages. Set CHROME_PATH if Chrome is somewhere unusual. Flags: --en or --uk for a single page.

Layout

site/                     ← this is the deploy root
├── index.html            English page
├── uk/index.html         Ukrainian page
├── _headers              Cloudflare Pages headers (CSP, caching)
├── robots.txt
├── sitemap.xml
└── assets/
    ├── style.css         all styles, both themes
    ├── favicon.svg
    ├── apple-touch-icon.png
    ├── og.png            1200×630 social preview
    ├── fonts/            IBM Plex Mono, latin + cyrillic subsets (SIL OFL 1.1)
    └── js/
        ├── qrcode.min.js qrcode-generator 1.4.4 (MIT), vendored
        ├── jsQR.min.js   jsQR 1.4.0 (Apache-2.0), vendored — used by the tests
        └── app.js        all application logic
docs/                     architecture, deployment, SEO, findings, progress
tools/                    dev server and checks
qr_generator.html         the original single-file prototype, kept for reference

Documentation index: docs/ — start with ARCHITECTURE.md and PROGRESS.md.

Deploying

See docs/DEPLOY.md. Short version: Cloudflare Pages, no build command, output directory site.

Authors

Dmytro Kruhlov — the tool: the original generator, the SVG rendering, the masked corner markers, the logo knockout, the contrast checks.

Claude (Anthropic) — the site: the split into shared assets, the second language, the SEO and security layers, the tooling, and the two scannability fixes in docs/SCANNABILITY.md.

Licence

Code: MIT — see LICENSE.

Third-party, vendored unmodified:

Component	Licence
qrcode-generator 1.4.4	MIT
jsQR 1.4.0	Apache-2.0
IBM Plex Mono	SIL OFL 1.1 (site/assets/fonts/LICENSE-IBM-Plex.txt)

QR Code is a registered trademark of Denso Wave Incorporated. Denso Wave does not charge for use of the standard.