Coupon QR codes — how they work

Three shapes, three risk levels

Plain text code. The payload is just SAVE20. Simple, works offline, and instantly shareable — treat it as public the moment it is printed.

Link to an offer page. example.com/offer/spring — you control the page, so you can end the offer, measure scans and change terms. Still shared as easily as any link.

Unique per-code token. example.com/c/7f3a91b2 with one row per token in your database. The only shape that supports genuine one-per-customer limits, and the only one that needs bulk generation.

Enforce limits where they can be enforced

Nothing inside a QR code can limit its own use. No expiry field, no counter, no "single use" flag exists in the QR standard, and anything you put in the payload can be read and reused. Expiry and redemption limits live in your system, checked at the moment of redemption. A code that says EXPIRES-2026-09-01 in its text expires exactly when your till says it does, and not before.

Bulk unique coupons

For per-customer codes, generate a CSV of tokens and run it through a bulk generator. Practical notes:

• Use non-sequential tokens. c/0001, c/0002 invites guessing.
• 8–10 characters of base32 is plenty and keeps codes coarse and scannable.
• Avoid ambiguous characters if humans might type it as a fallback: no 0/O, no 1/l/I.
• Print the token as text next to the code so a failed scan is not a lost sale.

UseQR's bulk tool takes a CSV and returns a ZIP, a grid PDF, or Avery-format label sheets, and decode-verifies every code before you print a thousand of them.

Fraud in the physical world

The realistic attacks are dull: a customer photographs the coupon and shares it, or someone pastes their own sticker over your code. Defences that work — server-side redemption limits, staff who read the confirmation screen rather than the sticker, and printing the offer terms in text so a substituted code is visibly wrong.

FAQ

Can a QR code expire on its own?

No. The QR standard has no expiry field and nothing inside the payload can enforce anything. Expiry and redemption limits are enforced by your system when the code is presented.

How do I make a single-use coupon?

Generate one unique token per customer, print one code each, and mark the token redeemed in your database at the till. That is the only shape that supports a real limit.

Should the coupon code also be printed as text?

Yes. A failed scan then costs nothing — the customer reads the code aloud instead of walking away. Use characters that are unambiguous when read.

How do I make thousands of unique coupon codes?

Generate a CSV of non-sequential tokens and run it through a bulk generator that returns a ZIP or a label-sheet PDF. UseQR's bulk tool also decode-verifies every code before you print.