How to Create Secure QR Codes with Lunyb: A Complete 2026 Guide

QR codes have quietly become one of the most widely used tools for sharing information, from restaurant menus and payment links to event tickets and product packaging. But as adoption has grown, so has abuse. Attackers increasingly use malicious QR codes (sometimes called "quishing") to redirect unsuspecting users to phishing sites, credential harvesters, or malware downloads. If you generate QR codes for a business, campaign, or event, security is no longer optional.

This guide walks you through how to create secure QR codes with Lunyb, step by step. You'll learn how to protect your destination URLs, add tracking without compromising privacy, use expiration and password controls, and follow best practices that make your QR codes trustworthy for the people scanning them.

What Is a Secure QR Code?

A secure QR code is a scannable code whose destination, delivery, and lifecycle are protected against tampering, hijacking, and abuse. Unlike a static QR code that encodes a raw URL and cannot be changed once printed, a secure QR code typically uses a short, controllable link that can be monitored, updated, restricted, or revoked at any time.

Security here means three things working together:

Destination integrity — the URL inside the code points where you say it does and can't be silently swapped by a third party.
Access control — you decide who can open the link, when it expires, and under what conditions.
Visibility — you can see scan activity so unusual patterns (bot traffic, geographic anomalies, scraping) are detectable.

Lunyb combines these three properties into a single workflow, which is what makes it well suited for QR codes used in marketing, logistics, healthcare, education, and events.

Why Static QR Codes Are Risky

Many free QR code generators simply encode your raw URL into a bitmap and hand it to you. That seems convenient, but it introduces several problems.

Problem 1: You Can't Change the Destination

Once a static QR code is printed on a flyer, business card, or product label, the URL is locked. If your website changes domains, your campaign ends, or the page is taken down, every scan leads to a dead end or, worse, to a domain that someone else registers after you abandon it.

Problem 2: Long URLs Create Fragile Codes

Longer URLs produce denser QR codes with more modules. Dense codes are harder for cameras to read in poor lighting or when printed small, which pushes some users to try third-party scanner apps that may inject ads or track them.

Problem 3: No Visibility, No Control

Static codes give you zero feedback. You can't tell if the code is being scanned, cloned onto fake posters (a common attack at parking meters and public venues), or scraped by bots.

Problem 4: No Revocation

If a static QR code is misused, you have no way to shut it down. Secure, link-based QR codes can be disabled instantly.

How Lunyb Makes QR Codes Secure

Lunyb approaches QR security by separating the scannable code from the destination. The code encodes a short Lunyb link, and the link resolves to your real URL on the server side. That one architectural choice unlocks every security feature that follows.

Core Security Features

HTTPS enforcement on all short links so the redirect itself cannot be intercepted on untrusted networks.
Editable destinations — update the target URL without reprinting the code.
Expiration dates for time-limited campaigns, event tickets, or temporary access.
Password protection on sensitive links so only authorized scanners proceed.
Click/scan analytics that help you detect anomalies.
Malicious destination screening at creation and redirect time.
Instant disable if a code is cloned, leaked, or misused.

If you're new to the platform, the honest review of Lunyb covers the broader feature set and trust signals.

Step-by-Step: Create a Secure QR Code with Lunyb

Here is the full process from start to finish. The whole thing takes less than two minutes once you've done it once.

Step 1: Sign In and Open the Link Creator

Log into your Lunyb dashboard. If you're generating QR codes for a brand or client, create them from a dedicated workspace so analytics stay organized.

Step 2: Paste Your Destination URL

Enter the full, final destination URL — including https://. Lunyb automatically screens the URL against known-bad domain lists at creation time. If the destination is flagged, fix it before continuing.

Step 3: Choose a Custom Slug (Recommended)

A custom slug like lunyb.com/spring-menu is easier for users to visually verify than a random string. Verifiability is a security feature — if the user can read the link preview after a scan, they can judge whether it looks legitimate.

Step 4: Enable Security Options

Depending on the use case, enable one or more of the following:

Expiration date — for event tickets, limited-time offers, or temporary document shares.
Scan limit — cap the number of times the link can resolve (useful for single-use access).
Password — require a code before the destination loads.
Geographic rules — restrict or redirect based on country when relevant.

Step 5: Generate the QR Code

Click the QR icon next to your new link. Choose your output format (PNG for digital, SVG for print, PDF for high-resolution use). Pick an error-correction level — H (30%) is recommended for print because it tolerates smudging, folding, and partial coverage from logos.

Step 6: Add Visual Branding Carefully

You can place a small logo in the center of the code. Keep it under 20% of the code's total area so scanners can still read it. Branded codes also help users trust the source, which reduces the chance they ignore your legitimate code in favor of a fake one.

Step 7: Test on Multiple Devices

Before publishing or printing, scan the code with at least two different phones (iOS and Android) under realistic lighting. Verify the preview URL shown by the camera matches what you expect.

Step 8: Monitor Scans

After deployment, check analytics regularly. Look for unexpected spikes, scans from unexpected regions, or bot-like patterns. These can indicate the code has been scraped, cloned, or shared outside its intended audience.

Secure QR Code Settings: What to Use When

Different use cases need different protections. The table below maps common scenarios to recommended settings.

Use Case	Expiration	Password	Scan Limit	Error Correction
Restaurant menu	No	No	No	M (15%)
Event ticket	Yes (event day)	Optional	1 scan	H (30%)
Marketing campaign	Yes (campaign end)	No	No	Q (25%)
Internal document share	Yes (7–30 days)	Yes	Low (5–20)	H (30%)
Product packaging	No	No	No	H (30%)
Payment or invoice link	Yes (short window)	Yes	1 scan	H (30%)
Wi-Fi guest access	Yes (rolling)	Optional	No	Q (25%)

Best Practices for Trustworthy QR Codes

1. Always Use a Branded Short Domain When Possible

Users trust what they recognize. A branded link preview reassures scanners and makes impersonation harder.

2. Place Codes in Tamper-Evident Locations

Physical codes on posters, menus, and parking meters are routinely overlaid with malicious stickers. Use laminated, under-glass, or embossed placements, and inspect them regularly.

3. Add a Human-Readable Hint

Print the short URL beneath the code (e.g., "lunyb.com/spring-menu"). Users who can't scan — or who are suspicious — can type it manually and verify.

4. Avoid Encoding Sensitive Data Directly

Never put raw credentials, personal data, or private tokens into a QR code. Always use a controlled redirect that can be revoked.

5. Rotate Codes for Long-Running Campaigns

For campaigns that run more than a few months, rotate codes periodically. This limits the window during which a leaked or cloned code remains useful to an attacker.

6. Use HTTPS Destinations Only

Any destination should be served over HTTPS. Lunyb's redirect is secured, but the final page should be too, so the full chain is encrypted.

7. Review Analytics Weekly

Treat scan analytics the way you'd treat server logs. Unusual activity is often the earliest indicator of abuse.

Common QR Code Threats and How Lunyb Helps

Quishing (QR Phishing)

Attackers print fake codes that look identical to yours and paste them over legitimate ones. Because Lunyb lets you track scans, you can detect sudden drops or geographic anomalies, and because you can disable or redirect the link instantly, you can neutralize a compromise within minutes rather than days.

Clickjacking and Redirect Chains

Some free QR generators route scans through their own ad or tracking layer. Lunyb redirects go directly from the short link to your destination without inserting intermediate ad frames.

Expired or Dead Destinations

Pages move. Domains lapse. With an editable Lunyb destination, a broken page becomes a one-click fix rather than a reprint.

Bot Scraping

Automated scanners sometimes crawl QR codes posted publicly. Scan analytics and rate limiting help you distinguish real users from bots.

Design Tips That Also Improve Security

Good design is a security feature because it reduces the chance that users scan the wrong code.

Contrast — dark modules on a light background scan most reliably. Avoid inverted codes unless you've tested extensively.
Quiet zone — leave a clear margin (at least four modules wide) around the code.
Minimum size — for print, a general rule is scan distance divided by 10. A code viewed from 1 meter should be at least 10 cm wide.
Avoid distortion — never stretch a QR code non-uniformly. Scale width and height together.
Pair with a call to action — "Scan to view today's menu" is clearer than a lone code, and clarity reduces the chance of users scanning a fraudulent nearby code by mistake.

When to Use Dynamic vs. Static Codes

Dynamic codes (what Lunyb produces) are almost always the better choice for business use. Static codes still make sense in a few narrow cases: encoding Wi-Fi credentials for a single-use kiosk, encoding a vCard for a personal business card, or embedding a plaintext message meant to be read offline. For anything that touches a URL, dynamic wins on security, flexibility, and analytics.

If you're comparing platforms more broadly, the 2026 buyer's guide to URL shorteners covers how different tools handle QR features, and the Rebrandly review looks at one of the main alternatives.

Deploying QR Codes at Scale

If you're generating hundreds or thousands of codes — for product SKUs, serialized tickets, or location-specific signage — a few extra practices apply.

Use the API. Lunyb's API supports bulk creation so each code can have its own destination, slug, and settings without manual work.
Serialize for traceability. Encode a per-item identifier in the slug (e.g., /sku-00421) so analytics tell you exactly which physical item was scanned.
Group by campaign. Tag links so you can disable or expire an entire batch in one action if something goes wrong.
Pre-test a sample. Before mass-printing, print 10 sample codes and test on multiple phones and lighting conditions.
Keep a mapping file. Maintain an export of slug-to-destination mappings in your own records so you always have ground truth independent of the platform.

FAQ

Are QR codes created with Lunyb free?

Yes, basic QR code generation is available on Lunyb's free plan. Advanced features like password protection, scan limits, custom slugs on branded domains, and bulk API access depend on your plan tier.

Can I change the destination of a QR code after I've printed it?

Yes — that's one of the main advantages of using a dynamic short link under the QR code. You update the destination in your dashboard, and every subsequent scan goes to the new URL. The printed code stays valid.

How do I know if someone has cloned my QR code?

Watch your scan analytics. Sudden spikes, scans from unexpected regions, or activity at odd hours can indicate a cloned or scraped code. If you suspect abuse, disable the link immediately and issue a new one.

What error correction level should I use?

For digital use (screens, email), level M (15%) is usually enough. For print, especially with a center logo or outdoor placement, use level H (30%). Higher error correction creates denser codes but tolerates damage, dirt, and partial coverage much better.

Can QR codes contain malware directly?

A QR code itself is just encoded text — it can't execute code. The risk is in what the encoded URL points to. By using a controlled, screened redirect through Lunyb, you reduce the chance that your users ever reach a malicious page, and you keep the ability to shut the link down if the destination is ever compromised.

Final thought: secure QR codes aren't about any single feature — they're about keeping control of the full lifecycle from creation through retirement. Create them thoughtfully, monitor them actively, and be ready to revoke them instantly. That mindset, more than any specific tool, is what separates a QR deployment users can trust from one that becomes a liability.