# How to Make a Trackable QR Code for a Website Link > A QR code can't tell you who scanned it. Learn how to make a trackable QR code that turns an offline scan into a measurable, alertable website visit. - **Author**: Caius Hayes - **Published**: 2026-09-04 - **Category**: Marketing - **URL**: https://heyzinc.com/blog/make-a-trackable-qr-code --- ```tldr A QR code is a printed barcode that encodes a URL. It cannot tell you who scanned it, when, or whether the scan became a real visit. To make a trackable QR code, point it at a tracked destination URL -- a short link whose server records the visit and its source context -- so an offline scan becomes a measurable, alertable website visit instead of a mystery click. ``` You print a QR code on a flyer. You hand cards out at an event. You stick one on the back of a direct-mail postcard. Then nothing you can see. The QR code did not call you, did not log into your analytics, did not text you that someone scanned it at 2:14pm in front of your booth. That is the whole problem. A QR code is useful print, and by itself it is a black box. ## A QR code is a printed link, not a tracking device A QR code is a two-dimensional matrix barcode -- a square grid of black and white modules with finder patterns in the corners. It was invented in 1994 to track auto parts, and the format is specified by [ISO/IEC 18004](https://en.wikipedia.org/wiki/QR_code). It uses Reed-Solomon error correction with four levels, which is a fancy way of saying a smudged or partially torn code can still scan. Modern iOS and Android cameras read QR codes natively; nobody needs a separate app anymore. What a QR code does, mechanically, is encode a piece of text. Usually that text is a URL. When someone scans it, their phone opens the URL. That is the entire trick. Notice what is not in that description: any reporting. The QR image has no network connection. It cannot phone home. So if you want to know a scan happened, the tracking has to live somewhere else -- in the URL the QR points to. This is the part most "trackable QR" vendor pages glide over. The QR format does not have a trackable mode. What makes a QR trackable is pointing it at a destination that measures the visit. ## Static vs. trackable: the distinction is the URL, not the format There are two practical ways to use a QR code, and the difference is what URL you encode. A **static QR code** encodes the final destination directly. You put `https://yoursite.com/pricing` into the code, print it, and that is where every scan goes forever. To change the destination, you reprint. Nothing about a static QR reports scans, because the QR is just a picture of a URL. A **trackable QR code** -- what the industry also calls a "dynamic" QR -- encodes a short URL hosted on a server you control. When someone scans, their phone opens that short URL, the server records the request, and then it forwards the visitor to the real destination. Because the destination is resolved at scan time, you can change where the QR points without reprinting, and the server can count and contextualize the visits. HeyZinc's framing is "tracked QR codes": a dynamic QR that points to a [tracked link](https://heyzinc.com/blog/tracked-links-versus-utm-parameters). The free QR generator's own FAQ says it plainly: a plain QR image cannot report scans by itself, and to track campaign QR performance you create a tracked link and use that URL in the QR code. When does each make sense? Static is enough when the destination is stable and you do not need scan measurement: a Wi-Fi network label, a menu, an internal note, a plain-text code. Tracked earns its place when a URL open should mean something to your team -- flyers, event signage, direct mail, packaging, an offer where you actually want to follow up. One founder caveat: do not track what you will not act on. If nobody is going to look at the dashboard or respond to a live scan, a tracked QR is overhead with no payoff. ## How to make a trackable QR code The workflow is short. The tracking is in the link, not the image. 1. **Pick the destination.** Decide the real page you want people to land on -- a landing page, an offer, a booking page, a specific guide. This is where every scan should ultimately arrive. 2. **Create a tracked link for that destination.** This is the URL you are going to encode. A tracked link carries a short first-party token and keeps the richer context -- what the link was for, where it was placed -- server-side with the link record, rather than depending on a campaign-name spreadsheet. For the longer version of how tracked links work and how they differ from UTM parameters, that is a separate post; for QR purposes, the point is that the link itself is the measurement layer. 3. **Put that tracked URL into a QR generator.** Drop the tracked URL into the [free QR code generator](https://heyzinc.com/tools/qr-code-generator), preview it, and download the PNG. The generator normalizes a bare domain to HTTPS and renders the code in your browser, so the image is yours to print. 4. **Test it the way a real scanner would.** Scan the printed proof with your phone camera. Confirm it reaches the tracked URL, not just the final destination, and that the visit shows up where you expect. This matters more than people think -- a mis-encoded URL prints fine and scans into a dead end. 5. **Print and place it.** Flyers, signage, packaging, cards. Because the QR points at the tracked link, every scan from that asset carries the same source context, and you can change the final destination later without reprinting. That is the whole thing. The QR is static art; the link is the dynamic, measured part. ## What a scan can actually tell you (and what it can't) Once a trackable QR is scanned, the visit shows up under that link's record. You can see that a visit happened, the source context attached to the link, whether the visitor is active on the site right now, and breakdowns like country, device, and referrer. Here is the honest boundary, and I want to be clear about it because a lot of QR marketing implies otherwise. A scan is an anonymous visit. You can see that someone opened the URL. You can see the context the link was created with -- "this was the flyer from the Q3 event." You can see that they are on your pricing page at this moment. What you cannot see is who they are. A QR scan does not hand you a name, an email, a company, or a LinkedIn profile. If you want identity, the visitor has to give it to you -- by starting a conversation, filling a form, or otherwise identifying themselves. Keep three things separate in your head: the **identity** of the visitor (usually unknown from a scan), the **behavioral intent** (what they do on the site once they arrive), and the **attribution context** (which QR, which placement, which campaign created the visit). A trackable QR gives you the third and a window onto the second. It does not give you the first. Anyone selling a QR code that "identifies every scanner" is selling something the format does not do. ## Preview and bot considerations There is a quieter issue that bites people who run QR campaigns: not everything that opens the destination URL is a human with a phone. When a URL gets shared into a messaging app, a social platform, or an email, those services often send a bot to fetch the page so they can render a preview card. Security scanners do the same thing, checking links for threats. For a trackable QR, those automated fetches can look like scans and inflate your counts if they are not filtered. HeyZinc's tracking-links product page states that bot and scraper traffic is filtered out automatically. I have not independently tested that filtering, so I will state it as the product's claimed behavior rather than a verified result. The practical takeaway does not depend on the tool: when you read your scan numbers, expect some noise, and test the destination the way a real scanner would click it before you trust the counts. The error correction built into QR codes helps on the print side: a code that smudges or tears can often still scan, because the format is designed to recover from partial damage. That is print resilience, not tracking -- but it is the reason a trackable QR on a weathered flyer can still do its job. ## Offline use cases where a trackable QR earns its place Trackable QR codes make sense when an offline touch is intentional enough that you want to know whether it produced a visit. - **Event signage and conference badges.** A scan from your booth sign or a badge sticker carries the event as its source context. If the visitor is active on your site ten minutes later, you have a reason to follow up. - **Direct mail.** A QR on a postcard tells you the mailer worked, not just that it was sent. Each mailing can get its own tracked link so you know which list produced the visit. - **Packaging and inserts.** A QR on a box or a thank-you insert connects a physical purchase to a website visit, with the product line as context. - **Flyers and table tents.** Cheap to print, and the scan tells you the placement earned its keep. - **Business cards.** A card that scans to a tracked link turns a stack of handouts into something measurable. When is static enough? Wi-Fi labels, menus, internal asset tags, plain-text codes. If the destination never changes and nobody will act on a scan, do not bother tracking it. ## Privacy: what a scan reveals, and to whom A scan is an anonymous visit, and the right posture is to act on what you can actually see rather than pretend you know more. If you lean on generic campaign parameters instead of a tracked link, there is a real wrinkle. The well-known parameter names -- `utm_source`, `utm_medium`, and friends -- are exactly the names that privacy tooling targets. [MDN's web privacy documentation](https://developer.mozilla.org/en-US/docs/Web/Privacy) notes that several browsers strip known tracking parameters, and [WebKit blocks known tracking query parameters](https://webkit.org/blog/14445/) in Safari. Extensions can add their own rules on top. If you need a conventional campaign URL for broad analytics reporting, HeyZinc has a [UTM link builder](https://heyzinc.com/tools/utm-link-builder) for that. A first-party token is a narrower target for those rules because it is not a recognized advertising or analytics name, and the richer context lives server-side where parameter stripping cannot reach it. That is a real, if narrow, advantage. It is not a guarantee -- a determined privacy tool can still remove, rewrite, or block any parameter. The accurate claim is that a custom token sidesteps the rules aimed specifically at the well-known names, while the attribution context stays on the server. The broader privacy point stands regardless of link format: a scan reveals that a visit happened and what context it carried. It does not reveal who the person is. Build your follow-up around that boundary. ## Live alerts without overpromising The part that actually changes the workflow is timing. With a static QR, you find out a scan might have happened when you look at analytics, eventually, maybe, if the parameters survived. With a trackable QR, the visit shows up under the link's record, and HeyZinc can push a notification to the mobile or desktop companion app and flag the visitor as active now. That is the difference between finding out tomorrow and knowing someone is on your pricing page right now. I want to qualify this honestly. Those alerts are a configured workflow -- they depend on your notification setup and your device -- not a universal guarantee that every scan pings your phone. Treat mobile alerts as a workflow you set up on purpose, not a magic beam from the QR. And the value is visibility and timing, not identity. Knowing a visitor is active right now, and which tracked link -- which flyer, which event, which mailing -- brought them, gives you a choice: [reach visitors while they are still active on your site](https://heyzinc.com/blog/proactive-outreach), or let them explore. The point is to make the moment visible when acting on it still matters. It is not a license to pretend you know who scanned. ## The bottom line A trackable QR code is not a special kind of QR. It is a static QR pointed at a tracked destination URL. Use the [free QR code generator](https://heyzinc.com/tools/qr-code-generator) to make the image. Use a tracked link to make the scan measurable -- so an offline scan becomes a visit you can see, contextualize, and act on while the person is still on your site. Test it the way a real scanner would. Expect some bot noise. And keep the honesty line firm: a scan tells you a visit happened and what context created it. It does not tell you who the visitor is. That is the whole deal. Turn offline touches into visits you can see and respond to, without pretending a printed code tells you someone's name. --- - [More Marketing articles](https://heyzinc.com/blog/category/marketing) - [All articles](https://heyzinc.com/blog)