What happens when someone scans my QR code?
Updated September 14, 2026 · 2 min read
A dynamic code encodes an address like qrcodestack.com/qr/…, so the camera opens that first. We check the code is live, record the scan, and then either redirect the visitor to your destination or render a hosted page — a menu, a contact card, a gallery — depending on the type. The whole round trip is one page load, and the visitor normally never notices it. Static codes skip all of this: the phone reads the content straight out of the pattern.
The flow, step by step
- The camera opens the redirect. Most phones show the address in a preview before the visitor taps.
- We look the code up and run the checks in the table below.
- We classify the request. Recognised bots are dropped and never stored.
- We record the scan — but only for dynamic codes on an account with an active plan or trial.
- We send the visitor on. Redirect types forward straight to the destination; display types render a page on our servers.
What gets recorded on each scan
For each counted scan we store the time, device type, brand and model, operating system and version, browser and version, the raw user agent, the IP address, the country, the referring URL and its domain, all five UTM parameters, any other query parameters, and how the request was classified.
City and region are added only on plans that include location analytics — the free trial and the Business plan. Precise GPS coordinates are recorded only when GPS Tracking is switched on for that code, which is a Business feature, and only when the person scanning approves their browser's location prompt.
Nothing identifies the person. There is no name, no email and no account for the scanner — see what counts as a scan.
Types that show a page instead of redirecting
Most types forward the visitor to an address you supply. These 22 types have no external destination, so we render the content as a hosted page: Text, WiFi, Event, Phone, vCard Plus, Email, SMS, Crypto, Coupon, Menu, Images, PDF, Video, List of Links, Landing Page, Product, GS1, Payment, Feedback, Product Authentication, Game and Pet ID.
The Apps type is a third case: it reads the device the scan came from and sends iPhones, Android phones and Harmony devices to their own app stores.
Checks that can stop a scan
These run in order. The first one that matches is what the visitor sees.
| Check | Page shown |
|---|---|
| Code deleted or the address is wrong | QR Code Not Found |
| Destination flagged as unsafe | Link Disabled for Safety |
| Code archived or paused | QR Code Unavailable |
| Before the code's activation date | QR Code Not Yet Active |
| Past the code's expiry date | QR Code Expired |
| Scan limit reached | QR Code Unavailable |
| Password set on the code | Protected QR Code, with an unlock form |
| Owner's plan is no longer active | This page is taking a short break |
The last row is the one that surprises people: a lapsed subscription takes live codes offline, it does not merely stop tracking them. See what a scanner sees when a code is unavailable.
Frequently asked questions
Does the redirect slow the scan down?
Not noticeably. It is one lookup before the browser follows the redirect, and we never cache the scan page so every scan is counted accurately.
Can the person scanning see it is a QRCodeStack code?
The phone's preview shows the qrcodestack.com address unless you use a white-label scan domain on the Business plan, which replaces it with your own hostname.
Are static codes counted?
No. A static scan goes from the phone straight to the content and never reaches our servers, so there is nothing to record.
Do bots inflate my scan count?
No. Recognised bots are discarded before anything is stored, and link-preview fetches and rapid repeats are recorded but excluded from the People total.
What does a scanner see if I set a password?
A page headed Protected QR Code with a password box. Entering the right password continues to the content; a wrong one shows "Incorrect password. Please try again."
Related articles
Why does my QR code show Unavailable, Expired or Not Yet Active?
The page title tells you which setting stopped the scan: archived, paused, scan limit reached, a date schedule, a lapsed plan, a password, or a safety block.
Why are my scan numbers lower than expected? People vs Not counted
Analytics counts people by default. Bots, chat-app link previews and repeat fires within seconds go to Not counted, and known bots are never stored.
How do I password-protect a QR code?
Edit the code, open Rules & Limits and type a password in Password Protection. Scanners then see an unlock page before the content. Pro and Business only.
How do I send scanners to different destinations by country or device?
Turn on Dynamic Routing in Rules & Limits on a URL code, add If Country/Region/Device/Platform rules, and set the URL each one goes to. Pro and Business.
Still stuck?
Email support@qrcodestack.com with the email on your account and, if it is about one code, its name or short link. A person replies within one business day, usually sooner.