Can a QR Code Be Changed After It's Printed?

Search for this question and you will find a dozen pages that all say the same thing: yes, if you use a dynamic QR code, you can change where it goes without reprinting. They are correct, and every one of them is published by a company that sells dynamic QR codes.

What none of them cover is the other side of the transaction. If the owner of a printed code can repoint it at any moment, then the person scanning it is not reading an address — they are following a pointer that someone else controls. That is a genuinely different thing, and it changes what "I checked the link before I scanned it" is worth.

This guide answers the question properly for both readers: the marketer who wants to know whether the poster can be salvaged, and the scanner who wants to know what they are agreeing to. The mechanics are the same; the conclusions are not.

The Short Answer

• The printed pattern can never change. Ink on paper is ink on paper. The black and white squares are the data.
• The text encoded in those squares can never change either. A QR code that encodes https://example.com/menu will decode to that exact string forever.
• Where that text sends you absolutely can change — if the encoded text is a link whose destination is decided by a server rather than by the link itself.

So "can a QR code be changed after printing" is really two questions wearing one coat. The symbol is immutable. The outcome is not. Everything below follows from keeping those apart.

What Is Physically in the Symbol

A QR code is a picture of its own data. Under ISO/IEC 18004, the international standard that defines the symbology, the message is encoded into modules — the individual black and white cells — along with error-correction codewords and fixed patterns that let a scanner find and orient the symbol. There is no header field pointing at a record somewhere, no identifier a server resolves, no version of the symbol that gets looked up at scan time.

A scanner does not phone home. It reads the modules, reconstructs the bytes, applies error correction, and hands back a string. That process is entirely offline and entirely local. If you scan the same printed code in a basement with aeroplane mode on, you get the same string you got last year.

This is why the standard contains no mechanism for editing a symbol, and why it never will: there is nothing to edit but the picture. Our introduction to how QR codes work walks through the encoding in more detail.

Then what are people actually changing?

The URL's destination — not the URL. A dynamic QR code encodes a short link belonging to the QR platform, something on the order of https://qr.example-provider.com/aB3xY. That string is burned into the printed symbol permanently, exactly like any other string.

What sits behind it is a database row. Scanning sends a request to the provider's server, which looks up aB3xY, finds whatever destination is currently recorded against it, and issues an HTTP redirect to that address. Editing the code means editing that row. The symbol is untouched; the answer the server gives has changed.

Our comparison of static versus dynamic QR codes covers the trade-off from the publisher's point of view. What follows is what that architecture means for everyone else.

How to Tell Whether a Code Can Be Repointed

You can work this out before you open anything, because the answer is visible in the decoded text. Read the payload — most scanner apps and every phone camera preview will show it to you — and look at the domain immediately before the first single slash.

The useful rule: if the decoded link is on a domain that is not the destination you expected, the destination is somebody's editable setting. That is not automatically sinister — it is how a restaurant changes its menu without reprinting every table tent — but it means the link is a promise rather than a fact.

Our QR code link checker will name the real registrable domain in a decoded link and flag the disguises people use to make one domain look like another. It deliberately does not follow the link, which brings us to the part everybody gets wrong.

Why "Check the Link Before You Scan" Is Weaker Than It Sounds

Almost every piece of QR safety advice — including, in its simplest form, ours — tells you to preview the link before you open it. That advice is worth following, and it is not the guarantee it reads as, for a reason that falls straight out of the architecture above.

A preview tells you the payload. The payload is stable. But if the payload is a redirect, the preview tells you nothing about the destination, because the destination is decided at the moment of the request, not at the moment you looked. Checking a redirect and then following it are two separate lookups, and nothing forces the server to answer them the same way.

This is not a theoretical gap. It is the operating principle of a whole class of email attack: send a message containing a code that points somewhere harmless, let the security scanner fetch it and find nothing wrong, then change the destination once the message has cleared filtering. The scanner's verdict was accurate when it was made and worthless by the time a human acted on it.

The volume behind this is substantial. Microsoft's Q1 2026 email threat report, drawn from roughly 8.3 billion analysed phishing threats, recorded QR code phishing rising from 7.6 million detections in January to 18.7 million in March — a 146% increase in a quarter, after growing 59% in February and a further 55% in March. Codes embedded directly in message bodies, rather than in attachments, surged 336% in March, though they remained about 5% of the total; PDF attachments carried 70% of QR code phishing by March, up from 65% in January.

The second structural problem is where the decision happens. The email arrives on a monitored corporate machine; the scan happens on a phone that may have no filtering at all. Our guide to spotting fake QR codes covers the physical side of this — stickers over legitimate codes, fake parking meters, and the rest.

What this does not mean

It does not mean previewing is pointless. A preview catches the large, common category of attack where the payload itself is the tell: a lookalike domain, an @-sign trick, a raw IP address, an unexpected file download. Those are visible immediately and they are most of what you will meet.

What a preview cannot do is certify a redirect. So the correct mental model is: a preview can prove a link is bad. It cannot prove a link is good.

What Actually Reduces the Risk

1. Read the payload before anything opens. This is the one step that is always available and always informative. If your scanner opens links automatically, change that setting or change the scanner.
2. Treat an unfamiliar redirect domain as an unknown destination, not as a mildly suspicious one. You genuinely do not know where it goes, and neither does any tool that checks it before you do.
3. Judge the code by its context, not only its link. A shortener on a printed poster in a shop you are standing in is ordinary. The same shortener in an unexpected email about a parcel is not — see the unexpected-package scam.
4. Never enter credentials or card details on a page you arrived at by scanning. Navigate to the service yourself and sign in there. This single rule defeats the entire quishing category regardless of how the redirect behaved.
5. Check the address bar after the page loads, not just before. The redirect chain's last hop is the only one that matters, and it is the only one you can see once you are there.

The Other Half: If You Print It, Somebody Else Owns the Redirect

Now the publisher's side, where the same architecture creates a different problem. When you print a dynamic QR code from a third-party platform, the string physically committed to ten thousand leaflets is their domain. Your leaflets now depend on a company you do not control continuing to resolve a short link.

Providers' own support documentation is clear about what happens when that relationship ends: dynamic codes are deactivated when a trial or subscription lapses, and scanning one lands on a service page or an error rather than your content. Trial lengths and scan caps vary by provider, so read the specific terms before anything goes to print. The symbol keeps working perfectly — it decodes to the same short link it always did. The link simply stops meaning anything.

The failure modes worth planning for:

• Trial expiry. A code created to test the product, printed because it worked, dead a fortnight later.
• Subscription lapse. A card expires, a team member leaves, an invoice is missed — and the campaign in the field goes dark.
• Scan caps. Some plans stop resolving past a monthly scan allowance, which means the code fails precisely when it is working best.
• Provider shutdown or acquisition. The one you cannot mitigate from inside the product, and the reason the whole arrangement deserves thought before a print run.

The middle path: your domain, your redirect

You do not have to choose between a permanent code you can never edit and a rented one you do not control. Encode a URL on a domain you own and redirect it yourself:

1. Pick a clean, short path on your own site — yourdomain.com/menu.
2. Generate a plain static QR code for that URL. No account, no subscription, no expiry.
3. Configure a server-side redirect from that path to wherever the content currently lives.
4. To "edit the code" later, change the redirect target. The printed symbol never needs to change.

This gives you the editability that dynamic codes are sold for, while the thing committed to print is a name you control in perpetuity. It also reads better on the poster, because the domain is yours rather than a stranger's.

The one thing it does not give you for free is scan analytics — which is the honest reason most people pay. That gap is smaller than it looks: add UTM parameters to the redirect target and your existing analytics will attribute the traffic. Our guide to tracking QR scans without a subscription sets it up step by step, and the UTM link builder assembles the parameters correctly.

A Worked Comparison

The last row is worth a moment. Every one of these decodes offline, because decoding is local. What differs is how many parties have to still be online and still be cooperating for the decoded string to reach the content.

Frequently Asked Questions

Can someone else change my QR code without my permission?

They cannot change the printed symbol or the text encoded in it. They can change where it leads if they gain access to the account that owns the redirect, or to the server or domain the link points at. A static code pointing at your own site can only be repointed by someone who controls that site. A dynamic code can be repointed by anyone who can sign in to the QR platform account — which makes that account worth protecting with the same care as your website login.

Does a static QR code ever expire?

The symbol does not. It will decode to the same string in twenty years. What can expire is whatever the string points at — a page that gets deleted, a domain that lapses, a Wi-Fi password that gets rotated. The code is not the thing that breaks; the destination is.

Can I convert a printed static QR code into a dynamic one?

Not by editing the printed code, no. But you can often get the same outcome without reprinting, if the static code points at a URL on a domain you control: add a server-side redirect at that path and every future scan follows it. If the static code points somewhere you do not control, you are out of options short of reprinting.

How can I tell if a QR code is dynamic just by looking at it?

Not from the picture. Dynamic codes often look visually simpler because a short redirect URL needs fewer modules than a long destination URL, but that is a tendency, not a test — a short static link produces an equally sparse code. The only reliable check is to decode it and read the payload: a link on a QR platform's or shortener's domain is dynamic, a link on the destination's own domain is not.

Is a dynamic QR code less safe to scan than a static one?

It is less verifiable, which is a narrower claim. A static code tells you its destination; a dynamic one tells you only who decides the destination. Neither is safe or unsafe by itself — what matters is whether you trust whoever holds that decision, and whether the page you eventually land on asks you for anything sensitive.

If I scan a code twice, can it send me to two different places?

Yes, when it is a redirect. This is used legitimately — a code that shows a lunch menu before three and a dinner menu after, or routes by country — and it is also the mechanism behind delayed-activation phishing. The symbol is identical both times; the server answered differently.

Do QR codes work without an internet connection?

Decoding always works offline, because the data is in the pattern. Whether anything useful happens next depends on the payload: Wi-Fi credentials, contact cards and plain text are complete in themselves and need no network, while any link — static or dynamic — needs a connection to load the page.

The Short Version

The ink cannot change and the decoded text cannot change. What can change is the destination a redirect resolves to, and both useful properties of dynamic QR codes and the nastiest QR-based attacks come from that single fact.

If you are printing: encode a URL on a domain you own and redirect it yourself, so that the only thing committed permanently to paper is a name nobody can take away or switch off.

If you are scanning: read the payload first, treat an unfamiliar redirect as an unknown destination, and never type a password into a page you reached by pointing your camera at something.