The one real difference
Static and dynamic QR codes differ in exactly one thing: what is encoded in the pattern. A static code contains your content; a dynamic code contains a redirect URL.
Scan a static code and the phone reads https://example.com/menu, or a Wi-Fi string, or a contact card. The code is the content, rendered in squares.
Scan a dynamic code and the phone reads something like https://qr.vendor.com/a4f21. The vendor’s server logs the scan, looks up where you have currently pointed that code, and sends the phone onward.
Every other difference — editability, tracking, expiry, cost, privacy — follows mechanically from that.
Static vs dynamic QR codes side by side
The two differ on nine dimensions, and eight of them follow directly from what is encoded.
| Property | Static | Dynamic |
|---|---|---|
| What is encoded | Your content, directly | A short redirect URL owned by a vendor |
| Change destination after printing | No — reprint required | Yes, from a dashboard |
| Scan tracking | No per-scan data; use UTM tags and your own analytics | Yes — count, time, approximate location, device |
| Expiry | Never | Stops working if the account lapses or the vendor shuts down |
| Ongoing cost | None | Usually a subscription after a small free tier |
| Dependency | None — no server in the scan path | The vendor’s domain, servers and business must all survive |
| Who sees the scanner | Only the destination you chose | The vendor, then the destination |
| Works offline | Yes, for Wi-Fi, vCard and text payloads | No — the redirect needs a network |
| Code density | Higher with long URLs | Lower — short redirect URLs make a sparser grid |
When is a static QR code the right answer?
Whenever the thing behind the code is stable — which covers most real projects. Static is the correct default, and the bar for moving off it should be a specific, articulated need.
- Wi-Fi credentials. There is no URL to redirect to — the payload is the network details. A dynamic Wi-Fi code is not a meaningful thing.
- Contact cards (vCard). Same reasoning. The details go directly into the code, and they work with no signal at all.
- Permanent destinations. Your homepage, a product page with a stable URL, a documentation site. A redirect adds a failure point and buys nothing.
- Anything with a long print life. Engraved plaques, equipment labels, architectural signage, book pages.
- Anything where a third party should not see your users. Every dynamic scan is a data point about a person, collected by a company you chose on their behalf.
~90%
Share of startups that ultimately fail, with roughly 10% failing within the first year. A code printed on a plaque or a product label is expected to outlast the company whose redirect it depends on.
When do you genuinely need dynamic?
Dynamic is the right call when:
- The destination will definitely change during the print run. A seasonal menu, a conference agenda, a campaign landing page that rotates monthly. Reprinting costs more than the subscription.
- Per-scan analytics drive a decision. Not “it would be nice to know” — actually drive a decision, like comparing response rates across six billboard sites.
- You need A/B testing or geo-targeting behind a single printed code.
- The print run is enormous and the URL is uncertain. A million product labels printed before the destination site exists.
Three things that are not reasons: to make the code smaller, to look professional, or because the tool you found only does dynamic.
What are the hidden risks of dynamic codes?
The downside is structural, not a matter of picking a better vendor. The vendor becomes a single point of failure for printed material you cannot recall — you cannot patch a sticker that is already on ten thousand boxes.
Billing failure is downtime. Providers commonly stop redirecting when a subscription lapses. A card that expires over a holiday can take your entire printed estate offline until someone notices.
A stale redirect hostname is a security problem, not just a dead link. This is documented, not hypothetical. When a customer stops using a QR platform but leaves a DNS record pointing at it, the branded subdomain becomes unclaimed inside the vendor’s own system — and anyone with a free account on that platform can claim it and redirect every printed code to a site they control. No DNS access and no expired domain required.
Hundreds
Exposed branded subdomains found across manufacturing, healthcare, financial services and tech in the 2025 “QR Jacking” disclosure, in which researcher Farzan Karimi demonstrated takeover of a real company’s printed codes.
Every scan is disclosed to a third party. The vendor necessarily sees the scanner’s IP address, approximate location, device type and the time. Whether that is acceptable depends on your users and your jurisdiction, but it should be a decision rather than an accident.
Does a dynamic code scan better?
Slightly, and the effect is usually overstated. A short redirect URL of around 25 characters produces a sparser grid with larger modules than a 120-character URL stuffed with campaign parameters, and larger modules are easier for a camera to resolve at small print sizes. The print guide covers how content length, module size and physical dimensions interact.
You can capture nearly all of that benefit without a vendor. Point a static code at a short, clean URL on your own domain — example.com/menu — and set up the redirect on your own server. Low density, editable destination, and the dependency is your own infrastructure rather than someone else’s. What it does not give you is per-scan analytics out of the box, though your own server logs go a long way.
How to choose in under a minute
Three questions, in order:
- Will the destination change while this print run is still in use? If no, use static and stop here. This eliminates most cases.
- If yes — can I get editability from a redirect on my own domain instead? If you have a website, you almost certainly can, and it costs nothing.
- If you still need it — do you need per-scan analytics badly enough to accept a permanent vendor dependency and third-party data collection? If yes, dynamic is the right tool. Choose a provider with a credible track record, and budget the subscription as a line item on the print job rather than an afterthought.
Next: if you are worried about what a generator does with your data, are QR code generators safe? goes through what actually happens to the content you type. And for the most common static use case of all, see how to make a Wi-Fi QR code.