Two random QR code generators in one
People mean two different things by a random QR code. Some want a code with a surprise inside, to scan for fun, to try out a phone's camera, or to hand out in a game. Others need many codes that are all different, so each voucher or ticket can be told apart and checked once. This page does both.
In both cases the random part is the content. The black and white pattern is not random at all: the same text always makes the same pattern, in any generator. What changes from code to code is the text inside.
Random QR codes to scan
Pick what you want inside and press the button. Each press makes a new code. Scan it with your phone camera, or open Show what is inside if you want to check the answer first.
- A surprise message picks one short, friendly line from a list. It is fine for a classroom, a party game or a treasure hunt clue.
- A random word, number, coin flip or dice roll turns the code into a small game. Print a few and let people scan to find out who goes first.
- A random password or ID is useful when you want to test a scanner app with text that has no meaning, or give someone a one off code to type.
These codes hold plain text, not links, so scanning one never opens a website. That also makes them a safe way to check that a phone can read QR codes at all.
A random password in a QR code is only as private as the paper it is on. Anyone who scans it can read it. Use it for one off codes, not for an account you care about.
Unique random codes for vouchers and tickets
The batch tool makes as many as 1,000 codes at once, each holding a different random token such as K7fwQm2xTe. Put your own web address in front, for example https://example.com/v/, and each code opens that address with its own token on the end. Your website looks the token up and decides what happens: show a ticket, apply a discount, or say the voucher was already used.
- Choose how many codes you need, and how many characters each token gets.
- Add your web address if the codes should open a page. Leave it empty for plain tokens that your own app reads.
- Make the batch, then download the list as a CSV for your records and the codes as PNG images in a ZIP.
- Need SVG or a PDF sheet? Press Copy list, open the Bulk QR code generator and paste it in. Each code keeps its token as its label.
The codes on their own are only half of a voucher system. Something has to remember which tokens exist and which have been used. Our guide on how random QR codes work covers that part, and measures how token length affects duplicates and guessing.
Which settings to choose
Longer tokens are harder to guess, and they cost almost nothing in print size, because a few extra characters barely change the code. The tool shows the exact numbers for your settings after you make a batch.
| Use | Characters | Why |
|---|---|---|
| Raffle or game among friends | 6 | Nobody is trying to cheat |
| Discount vouchers | 10 | Guessing one is impractical |
| Event tickets, warranty labels | 12 or more | Worth money, so make guessing hopeless |
| Codes people may type by hand | 8 to 10, easy to read set | No 0 and O, or 1, I and l, to mix up |
How random is it?
Every random choice on this page comes from crypto.getRandomValues, the browser's random number source built for security. It does not use Math.random, which browser documentation says is not suitable for anything security related. Each character is picked so that every character in the set is equally likely, with no bias towards the start of the alphabet.
Nothing is sent anywhere. The tokens are made on your device, the codes are drawn on your device, and we never see them. That also means we cannot recover a batch for you, so download the CSV before you close the page.
How long the random part should be
How long the random part has to be
Two different things go wrong when the token is too short, and they go wrong at different sizes.
Collisions: two codes come out the same
Pick random tokens often enough and eventually you pick the same one twice. Two vouchers with the same code means one customer redeems the other's. The chance is far higher than intuition suggests, and it climbs with the square of the batch size.
Here is the probability that a batch contains at least one duplicate, using the 62 character alphabet:
| Codes in the batch | 4 chars | 6 chars | 8 chars | 10 chars | 12 chars |
|---|---|---|---|---|---|
| 1,000 | 3.3% | 1 in 114,000 | 1 in 430 million | negligible | negligible |
| 10,000 | 97% | 1 in 1,100 | 1 in 4.3 million | negligible | negligible |
| 100,000 | certain | 8.4% | 1 in 44,000 | 1 in 170 million | negligible |
| 1,000,000 | certain | certain | 1 in 430 | 1 in 1.7 million | negligible |
Look at the four character column. At ten thousand codes a duplicate is not a risk, it is close to a certainty. Four characters of base 62 gives 14.8 million possible values, which sounds like plenty until you remember that every code has to differ from every other code, not just from one of them.
Guessing: someone works out a live code
The second problem only matters when the code is worth something. If a discount voucher is a short random string, what stops a person typing addresses until one works?
With ten thousand codes issued, here is roughly how many attempts it takes before hitting a live one:
| Token length | Entropy | Attempts to hit a live code |
|---|---|---|
| 4 characters | 23.8 bits | about 1,477 |
| 6 characters | 35.7 bits | about 5.7 million |
| 8 characters | 47.6 bits | about 21.8 billion |
| 10 characters | 59.5 bits | about 83.9 trillion |
| 12 characters | 71.5 bits | about 322 quadrillion |
1,477 attempts is not an attack, it is an afternoon with a basic script. Four characters protects nothing. At eight characters the number is already large enough that a casual attempt is hopeless, and at twelve it stops being worth anyone's time.
What we measured: length is free
Here is the part that changes what you should actually do. We took a normal address, https://example.com/v/, appended random tokens of increasing length, encoded each one at error correction level M, and measured the grid it produced. Then we decoded every code back to confirm it matched.
| Token length | Full address | Grid | Smallest usable print |
|---|---|---|---|
| 1 to 4 characters | 23 to 26 chars | 25 x 25 | 13.2 mm |
| 5 to 20 characters | 27 to 42 chars | 29 x 29 | 14.8 mm |
| 21 characters and up | 43 chars and up | 33 x 33 | 16.4 mm |
The print sizes above are technical minimums for each grid. In print, never go below about 2 cm, the floor our sizing guide sets for any code.
Every one of those decoded correctly when we scanned it back.
A token of 5 characters and a token of 20 characters produce the identical code size. QR codes grow in fixed steps rather than character by character, so once you are inside a step, extra characters cost nothing at all. Going from 8 to 12 characters multiplies the work of guessing a live code by about fifteen million, and adds zero millimetres to what you print.
So use 10 to 12 characters. There is no tradeoff to weigh here, which is unusual. The only reason short tokens exist is that someone assumed shorter meant smaller, and on a QR code that assumption is wrong most of the time.
One caveat worth knowing. The step boundaries move with the length of the rest of the address. On a short domain such as https://qr.to/ the first step runs all the way to 12 characters, and the second to 28. The principle holds either way: find your step and use the whole of it.
Common uses for random QR codes
Event tickets and passes
The most common use by far. Each ticket carries a unique token, the scanner at the door checks it against the guest list, and the system refuses it on the second scan. Without randomness, one photographed ticket admits everybody who saw the photo.
Discount vouchers and promo codes
Single use codes for a campaign. Random tokens stop the code being shared on a deals forum and redeemed ten thousand times, which is precisely what happens to predictable ones. This is a case where the guessing table above matters directly, because there is money on the other side.
Raffles, prize draws and competitions
Each entry form or product label carries one code. Someone scans it to enter, and you can see which codes have been used without collecting anything personal at the point of entry.
Product authenticity labels
A unique code inside the packaging that a buyer scans to confirm the item is genuine. The value comes entirely from the code being unguessable. A counterfeiter who can work out valid codes can print them on the fakes, which is why this is the use case that most deserves 12 characters.
Inventory, asset and equipment tags
Every laptop, tool or shelf gets its own code. Here the codes do not need to resist attack at all, since nobody gains anything from guessing your shelf numbers. They only need to be unique, so collision resistance is the only column that matters and eight characters is plenty.
Attendance, check in and access
Unique codes handed to staff, students or delegates, scanned at the door. Random tokens stop one person's code being copied and reused, provided your system actually logs the scans.
Testing and quality control
A quieter use, but a real one. If you are building anything that reads QR codes, you need batches of varied codes to test with. Random data gives you the range of lengths and densities that real use will produce, rather than the one tidy code you have been testing against all week.
When random is the wrong choice
Random codes carry real costs, and plenty of jobs do not need them.
If every code does the same thing, do not make them different. A menu, a WiFi code, a review link, a contact card. One code, printed as many times as you like. Making a thousand different codes for a thousand table cards gives you a thousand things to track and nothing in return.
If you have nothing on the other end, random codes do nothing. This is the most common mistake. A unique code only has meaning if a system somewhere can look it up and record that it was used. Random tokens pointing at a page that treats everyone identically are just a longer link.
If the codes are not worth anything, do not over engineer. Shelf labels do not need cryptographic randomness. A simple numbered sequence is easier to read out loud, easier to sort, and easier to debug when one goes missing.
And a reminder that applies to all of these: a printed code cannot be changed. Whatever the token points at needs to keep working for as long as the print exists, which is the argument for pointing them at a path on a domain you own. Our guide to static and dynamic codes covers that tradeoff properly.
Frequently asked questions
Is it safe to scan a random QR code?
The codes from this page are safe: they hold plain text, or the web address you typed yourself. A random code you find on a poster or in a message is a different matter, because it can point anywhere. Read it first with our QR code scanner, which shows the contents before anything opens.
Can I make one QR code that opens a random website each time?
Not with a static code. A static code always holds the same content, so it opens the same address every time. To get a different result on each scan, the code has to point at a web page that picks something at random, and that page has to live on a server you run.
Can two codes in a batch be the same?
No. If the random draw ever repeats a token, the tool throws the copy away and draws again, so every code in the batch is different. Separate batches are not checked against each other, so keep your CSV and use long tokens if you make more than one batch.
Do these codes expire?
No. They are static codes, so the content is inside the code itself and there is nothing to expire. A code with a web address keeps working for as long as that address does.
How big should I print them?
The scan check under each code gives the smallest safe print width. For most batches that is about 2 cm (0.8 in). Our guide to QR code size for print explains the rule.
Related tools
For many codes with your own content, use the Bulk QR code generator. For a single message, the Text QR code generator is simpler. To read a code before you trust it, use the QR code scanner.