A QR code generator with no tracking — verify it yourself

Preset to Wi-Fi, the most sensitive thing people put in a QR code. Open your Network tab, type a password, and watch nothing leave your machine.

How to check for yourself

Open your browser's developer tools, switch to the Network tab, and use the tool above. It's preset to Wi-Fi — the most sensitive thing people routinely put in a QR code. Type a password. Watch the list: nothing appears.

Not because a policy forbids it — because there's nowhere for it to go. This site has no server, no database, no backend. Clone the repo, disconnect your Wi-Fi, open index.html: it still works. That's the difference between a privacy policy and a fact — a policy describes intentions; this describes wiring.

What our host sees, exactly

This site is served by Cloudflare, and like every web host it logs the HTTP request that fetched the page — roughly how many people arrived, and from where. That server-side count is the entirety of what exists. There is no script on this page recording anything: nothing you type or make is in any request — there is no request. The line between "the host saw a page get fetched" and "a script watched what you did on it" is exactly the line that matters, and we're drawing it out loud.

Loads anywhere, blocks nothing

A page with no third-party requests has nothing for an ad blocker to strip and nothing for a national firewall to stall on. This one loads anywhere the HTML itself can reach — including networks where common third-party script domains are blocked.

The tracking that actually matters: your scans, not your visit

Whether a generator's web page watches you is the small question. The big one is whether the code itself phones home. A dynamic code contains a link to the provider's server, which forwards each scan onward — so every person who ever scans it is logged by a company they've never heard of: when, roughly where, on what device. That's a product — it's sold as scan analytics.

You can check any code you already have: read what's inside it, decoded on your own machine. Your own link inside means static — no middleman, nothing logging the scans. A stranger's domain means every scan has been routed through that domain. (A printed dynamic code has a second problem, too: it can be switched off.)

Codes made here are static. The data sits inside the matrix and the scan goes straight to its destination, with no server of ours in the path — so not tracking your scans isn't a promise we're keeping. It's a thing the architecture can't do.

The honest case for the other side

Scan analytics are a legitimate product. If you're running a campaign and need scan counts, someone's server has to sit in the loop and count, and that costs real money to run. Buy it knowingly, from a provider whose terms you've read, and it's a fair trade. We don't offer it — and declining it is precisely why nothing on this page needs to watch you.

What this adds up to

• No analytics script, no cookies, no fingerprinting, no third-party requests of any kind — the privacy page is a description of the architecture, not a policy.
• No account either, because there's no server to keep one on — there is nothing to sign up to.
• Nothing you type leaves your machine, and the codes you make carry no middleman — and so can't be switched off later.