Case file № 004 · Product build · Verification
A QR code that outlives the free trial
- System
- StoneQR
- Client
- Free tool · open source
- Live
- stoneqr.app ↗
Most “free” QR generators make a code that points at their server, then stop serving it when the trial ends, after it has been printed on five hundred menus. StoneQR makes static codes in the browser, uploads nothing, exports true vectors at real print sizes, and decodes every code back before it lets you download it.
LiveThe evidence
Screens of the running thing
The system
How the parts connectIn
Payload link · Wi-Fi · vCard · event · seven more
Logo or photo sanitized, sized honestly
The system
Engine, in the browser encode · render · decode check
Saved designs on the device, shareable by link
Out
SVG · PDF · EPS · PNG at real print sizes
Label sheets & batches every code verified first
Before & after
The account, both columnsBefore
- The people who print QR codes are office managers, event staff, restaurants, teachers, and assistants. They search for “QR code that doesn’t expire” and “no sign up,” because they have been burned.
- The usual product is a redirect through the vendor. About two weeks later the free tier ends, the redirect stops, and the printed code is now a broken promise on a poster.
- The alternatives that don’t expire tend to hand over a blurry PNG at no particular size, with no way to know whether it will scan from across a room.
After
- The code is computed on the device. Nothing typed into the page leaves the browser, which is a contract enforced in the code, not a privacy policy.
- Ten payload types (links, Wi-Fi, contact cards, calendar events, and the rest), exported as SVG, PDF, and EPS at millimeter-accurate sizes, with a calculator that turns “scanned from three meters” into a print size, and label-sheet layouts for the standard office label formats.
- Every download is decoded back to its payload before it is handed over. An audit of the release found the ways that check could disagree with the download (a batch checked in black-on-white but rendered in the user’s colors, a raster export at the wrong physical size) and closed them.
- Logos and photos inside a code are handled honestly. The size slider steps only through widths the code can actually give up, and reports the size achieved rather than requested. A photo blend that fails to decode is retried with larger dots, then more fade, and the page tells you in plain words what it had to change.
- An uploaded SVG logo is treated as an untrusted document: scripts, links, and external references stripped, styles scoped so they can’t restyle the page, and still vector all the way into the export.
- It works offline as an installable app, and the deploy script refuses to declare success until every asset is confirmed serving on the edge, written after a release where a not-yet-replicated file was cached as missing for a year.
The verdict
The generator itself is a weekend. The product is the verification around it: a decode check on every download, printed scan sheets with a real phone, a written audit hunting for places where what you download differs from what was checked, and a list of exactly what has not been proven yet.
Bill of materials
What was used, and the job it did| 01 | SvelteKit, fully static | the site; no server, no accounts, no database |
|---|---|---|
| 02 | TypeScript engine | encode, render, export, verify: runs anywhere |
| 03 | Web Workers | batches and poster-size renders off the main thread |
| 04 | Service worker | installable and offline |
| 05 | GitHub Actions | types, 299 tests, and a size budget on every push |