QR code API

A free HTTP API that draws QR codes as small SVG images. No key, no account, nothing stored: the text to encode is in the URL, and the image is drawn from it on every request. The QR code generator and the browser extension make its links for you.

Base URL: https://qr.clx.cx

Quick start

<img src="https://qr.clx.cx/qr.inline?data=https%3A%2F%2Fexample.com" width="250" height="250" alt="QR code">

Percent-encode the text (encodeURIComponent; for Markdown also ! ' ( ) *), or &, # and the like cut it short.

Parameters

Endpoints

All are GET; any other method, and any other path, answers 404.

GET /qr.inline — the image

Answers 200 with the SVG (image/svg+xml; charset=utf-8). Cached at Cloudflare's edge by the full URL for 24 hours (Cache-Control: public, max-age=86400; X-QR-Cache: HIT or MISS).

GET /qr.svg — a permanent link

Answers 302 to the canonical URL of the same image (the redirect may be cached for an hour):

GET https://qr.clx.cx/qr.svg?data=https%3A%2F%2Fexample.com&ecc=H
→ 302 Location: /qr/sq250/<sha256>.svg?data=https%3A%2F%2Fexample.com&ecc=H&q=2

GET /qr/<preset>/<sha256>.svg?data=…&ecc=…&q=… — canonical URL

The same parameters always give the same URL. data, ecc and q are all required, and the hash in the path must be SHA-256 (hex) of the UTF-8 string

${data}|p=${preset}|ecc=${ecc}|q=${q}|fg=000|bg=fff|r=v1

with data trimmed and ecc in upper case. Otherwise the answer is 400, and so is a URL without its query: links handed out by extension versions before 1.1.0 had none and no longer work. A matching request is drawn afresh, nothing is cached on the server, and the answer may be kept by browsers for a year:

Content-Type: image/svg+xml; charset=utf-8
Cache-Control: public, max-age=31536000, immutable
ETag: "<sha256>"

Cloudflare sends the ETag as weak (W/"<sha256>") when it compresses the answer; the hash is the same. In JavaScript:

const payload = `${data}|p=${preset}|ecc=${ecc}|q=${q}|fg=000|bg=fff|r=v1`;
const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(payload));
const hash = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
const url = `https://qr.clx.cx/qr/${preset}/${hash}.svg?data=${encodeURIComponent(data)}&ecc=${ecc}&q=${q}`;

Limits and errors

• More than 2,048 characters: 413.
• One QR code holds at most 2,953 bytes of UTF-8 at ecc=L, less at higher levels: a Latin letter is one byte, a Cyrillic one two, € or a Chinese character three. Text that does not fit answers 500. The longest URL that still gives an image is about 9 KB, well under what Cloudflare accepts.
• A missing or wrong parameter, or a hash that does not match: 400.
• Errors are JSON: {"error": "Hash does not match the parameters"}.

No key and no account. There is no rate limit; one may come if the service is abused.

The SVG

One <svg> with shape-rendering="crispEdges", a white <rect> and one black <path> on whole-number coordinates — about 3 KB for a short URL at 250 px. The generator page draws it with @spintax/qr-svg byte for byte the same as the API.

Embedding

<!-- HTML -->
<img src="https://qr.clx.cx/qr.inline?data=YOUR_TEXT" width="250" height="250" alt="QR code">

<!-- Markdown -->
![QR code](https://qr.clx.cx/qr.inline?data=YOUR_TEXT)

Inside HTML, write & between parameters as &.

Privacy

The API keeps no logs and stores nothing; only /qr.inline answers stay in Cloudflare's cache for 24 hours. A page that shows a QR image sends its visitor's request — address, browser, the page as referrer — to Cloudflare, which runs qr.clx.cx. A QR code is not a secret: anyone with the link reads its text. The details: privacy of the QR tools.

The API is open source under MIT: github.com/investblog/qr-generator.