How can we help?

Create a free account, open Links and choose New link. Pick a domain, add a store address for each device you support, and save. Then open the link to see its QR code and stats.

Try the live demo at https://qr.tipeer.com/demo to see how one link behaves on different devices.

Related: Create an account

The slug is the last part of the address, such as demo in qr.tipeer.com/demo. A custom slug uses 3 to 40 characters: letters a to z, numbers and hyphens. On the shared domain qr.tipeer.com it needs at least 4. It cannot start or end with a hyphen or hold two hyphens in a row, and capital letters are saved as lowercase.

Leave the slug empty and tipeerQR picks a random 6-character slug from the letters a to z and the numbers 2 to 9, skipping 0, o, 1, l and i so nobody mistakes one for another.

A slug is unique on its domain. The same slug can exist on two different domains.

These words are reserved on every domain, so a link cannot use them: api, admin, app, r, wk, report, login, signin, signup, demo, .well-known, favicon.ico, robots.txt.

Within 60 seconds. Each Cloudflare location keeps the last answer for a link for 60 seconds, or 10 seconds for an address that has no link. A new destination, an archive or a disable therefore reaches every location within a minute.

A visitor who scans during that minute can still get the old destination. The visitor's own browser never keeps the redirect, so a second scan after the minute is always fresh.

Each account can have 50 active links. Archived links do not count, so archive one to make room for another. You can also create or edit up to 100 links per hour.

iPhone and iPad take App Store addresses from apps.apple.com or itunes.apple.com. Android takes a Google Play address (play.google.com/store/apps/details?id=...) or a market://details?id=... address. Huawei takes an AppGallery address. Windows, Mac and the fallback take any http or https address.

If you put an address in a store slot and it does not look like that store, the editor warns you and saves it anyway. Addresses that start with javascript:, data: or file: are refused, and an address can hold up to 2,048 characters.

No. tipeerQR rejects addresses on other link shorteners, such as bit.ly, tinyurl.com and t.co, and addresses on tipeerQR's own hosts. Use the final destination instead.

Every destination is also checked against Google Safe Browsing. A link whose destination Google flags stops redirecting.

Related: Abuse policy

It is on by default. Query parameters on the link you share are added to the destination, so qr.tipeer.com/launch?utm_source=flyer sends utm_source=flyer to the store page. A parameter the destination already has keeps its own value.

For Google Play destinations, any utm_ parameters are also packed into the referrer parameter that Google Play reads. Turn forwarding off to send every visitor to the destination exactly as you saved it.

tipeerQR checks the device in this order: iPad, iPhone, Huawei (including HarmonyOS), Android, Windows, then Mac. An iPad gets its own link, then your iPhone link, then the fallback. An iPhone gets its iPhone link, then the fallback. A Huawei phone gets its Huawei link, then your Android link, then the fallback. Android, Windows and Mac get their own link, then the fallback.

Linux, ChromeOS and any device tipeerQR does not recognise go to the fallback. When nothing matches and there is no fallback, the visitor sees the notice "This link isn't set up yet".

Newer iPads send the same identification as a Mac, so the device name alone cannot tell them apart. When a link has an iPad or iPhone address and the visitor looks like a Mac, tipeerQR shows a small page that checks for a touch screen. Touch devices go to your iPad link, or your iPhone link when the iPad slot is empty. Everything else goes to your Mac link.

Older iPads that say they are iPads skip that page and go straight to the iPad link.

Chat apps and crawlers that fetch a link are detected as bots. They get the first destination you set, checking the fallback, iPhone, iPad, Android, Huawei, Windows and Mac slots in that order, so a preview shows your fallback page when you have one.

Bot visits are counted separately and stay out of your scan counters. A HEAD request, which only asks for headers, records nothing.

Yes, but the old address stops working at once. A printed QR code holds the address it was made with, so changing the slug or the domain breaks every code you already printed. The editor warns you before you save.

Changing the destinations is different. The address stays the same, so printed codes keep working.

An archived link stops redirecting within a minute and its address behaves like any unknown slug on that domain. It frees one of your active slots, and you can unarchive it when you have a free slot and its domain is still available.

Deleting a link removes it together with its scan history. You cannot undo that.

tipeerQR checks every http or https destination against Google Safe Browsing when you save a link, and again once a day. If Google flags a destination, the link stops redirecting and visitors see a notice that the destination was flagged as unsafe.

An administrator can also disable a link, and then visitors see "This link was disabled for violating the abuse policy". Links on a disabled account show a notice too. If you think this was a mistake, email us with the link.

Related: Abuse policy, support@tipeer.com

It is free and needs no account. The code is drawn in your browser, and what you type never leaves it. You download a PNG or an SVG straight from the page.

Related: QR code generator

The generator makes a static code. It holds exactly what you typed, so it cannot change later and it records no scans.

A link's QR code holds the short link, so you can change the destination at any time and see scan stats. In the generator, choose Make it trackable to start an account with your address and style already filled in.

Yes. Choose Business card in the generator and enter a first or last name. You can add an organisation, job title, mobile and work phone numbers, email, website, address and a note. Empty fields are left out, and a website without https:// gets it added.

The code holds a vCard 3.0 contact, so most phone cameras offer to add it to your contacts. It is a static code, so to change a detail you make a new one.

Related: QR code generator

Yes. Choose Wi-Fi in the generator, enter the network name and password, and pick the security type: WPA (which covers WPA2 and WPA3), WEP or none. Tick Hidden network if the network does not broadcast its name. A phone camera then offers to join the network.

A WPA password needs 8 to 63 characters. A WEP key needs 5 or 13 characters, or 10 or 26 hex digits. The password sits in the code as plain text, so anyone who scans or photographs it can join. Print it where only people you trust can see it.

Related: QR code generator

You can pick the pattern (filled, smooth, square, rounded or circle), the code, corner and background colours, or a transparent background. You can add a border with its own width, shape and colour, a logo (PNG, JPG or SVG, small, medium or large, rectangular or round) and a text label with its own size, weight and colour.

The advanced options set the error correction level (L, M, Q or H) and the quiet zone, the blank margin around the code, at 1, 2 or 4 modules.

The editor warns you when the code is lighter than its background, because most scanners need a dark code on a light background. Keep the contrast high, keep the quiet zone at 2 modules or more, and test the code with a phone before you print it.

A logo covers part of the code, so a code with a logo needs error correction level Q or H. The editor turns off L and M when you add one.

SVG stays sharp at any size, so use it for print. A link's QR code also comes as a small PNG at 8 pixels per module for screens and a large PNG at 24 pixels per module for print.

In the generator you set the PNG size yourself, from 4 to 48 pixels per module.

Yes. Each account can save 3 styles and apply any of them to any link. A logo can be a PNG, JPG or SVG file of up to 1 MB.

Yes. The code holds the short link, not the destination, so a new destination reaches scanners within 60 seconds. The code stops working only if you change the slug or the domain, or delete or archive the link.

Open a link to see live counters for scans, matched devices, sent to store, sent to fallback and the time of the last scan. The numbers update as people scan.

A chart shows scans per day for 7, 30, 90 or 365 days, or for a custom range of up to 366 days. Days run on UTC. Breakdowns show device, outcome, country, referrer and the UTM source, medium and campaign.

Matched devices counts scans that reached the destination you set for that visitor's own device, such as an iPhone that went to your iPhone link. A scan that fell back to the fallback address is not matched.

Sent to store counts scans whose destination is an App Store, Google Play, AppGallery or Microsoft Store address. Sent to fallback counts scans that went to any other address, such as your website, even when a Windows or Mac slot chose it.

Each individual scan is kept for 365 days, and a daily job then deletes it. The daily totals and the counters stay for as long as the link exists. Deleting a link deletes its scan history and totals.

Related: Privacy policy

The time, the link, the device type, which slot answered, the outcome, the country, region and city that Cloudflare reports for the visit, the referrer's host name, any utm_source, utm_medium and utm_campaign values, and whether the visit looked like a bot.

tipeerQR never stores IP addresses or full user agent strings.

Related: Privacy policy

Not yet. When custom domains open, you will connect a Cloudflare account that holds your domain, then serve links from a subdomain such as qr.yourbrand.com. Each free account will be able to connect 1 custom domain.

Apex domains such as yourbrand.com will not be supported at first, so use a subdomain. A domain whose DNS is not on Cloudflare can be added by hand. tipeerQR shows the DNS records to create at your DNS provider, and the domain goes active after tipeerQR reads the ownership record.

tipeerQR has room for 100 custom domains in total. When they are all in use, a new domain joins a waitlist and we email you when there is room.

Related: Domains

Open Domains and choose Add domain. Connect your Cloudflare account when asked, pick the zone, and type the subdomain you want. tipeerQR then creates the DNS records for you and shows progress until the domain is active.

You approve the connection on Cloudflare's own page. tipeerQR asks to read your zones and edit DNS records, never sees your Cloudflare password, and you can remove the connection in Settings at any time.

Two records in your zone. A TXT record proves you own the domain, using the name and value Cloudflare gives tipeerQR for your hostname. A CNAME record points your subdomain to customers.tipeer.com.

tipeerQR creates the CNAME as DNS only, which Cloudflare shows as a grey cloud. Leave it that way.

If a record already exists at that address, tipeerQR stops and shows it to you instead of overwriting it.

Connecting means tipeerQR is adding the DNS records to your Cloudflare account. Verifying DNS means it is waiting for Cloudflare to see them, which usually takes a few minutes and can take up to 48 hours. Issuing certificate means Cloudflare is issuing the certificate, which usually takes a few minutes. Active means links on the domain are live.

Active also needs tipeerQR to fetch https://your-domain/.well-known/tipeerqr-check and read back its token. Until that works, the status stays on Issuing certificate, even after Cloudflare has issued the certificate.

tipeerQR checks every minute for the first 15 minutes, then every hour, for up to 48 hours. You can also choose Check now, and you can use it again after 30 seconds. We email you when the domain becomes active or fails.

Open the domain to read the reason and the next step.

If a DNS record already exists at the address, delete it in Cloudflare and try again. If a CAA record blocks the certificate, allow Google Trust Services, Let's Encrypt and SSL.com or remove the CAA records, then check again. If Cloudflare access was revoked, remove the domain, add it again and reconnect Cloudflare. If the domain did not become active within 48 hours, check the DNS records in Cloudflare and check again.

You choose a root action and a not-found action for each domain. Each can show the tipeerQR page, redirect to an address you choose, or open one of your links on that domain. A redirect can keep the path and query that the visitor asked for.

tipeerQR removes the domain's custom hostname and asks whether to delete the DNS records it created in your Cloudflare zone or keep them. You also choose whether to archive the links on the domain or move them to another domain.

QR codes you printed with that domain stop working as soon as it is removed, even when you move the links.

When a link is attached to an app, a phone that has the app installed opens it directly. A phone without the app still goes to the store address you set for that device.

It relies on Apple's associated domains and Android App Links, which only work on a domain you control. For that reason it is available on custom domains and not on the shared qr.tipeer.com domain. tipeerQR serves /.well-known/apple-app-site-association and /.well-known/assetlinks.json on your domain for you.

Open Settings, then Apps, and add an app. For iOS, enter your App ID Prefix (Team ID) and Bundle ID. For Android, enter the package name and the SHA-256 fingerprints of your signing certificates. You can add up to 10 apps, or paste a raw association file instead.

In your iOS app, add the Associated Domains entitlement applinks:your-domain. In your Android app, add an intent filter with android:autoVerify="true". Then open a link on your custom domain and pick the app under Open in app. The Apps section has the exact entries to copy.

With Play App Signing, copy the fingerprint from Play Console, App integrity, App signing key certificate. Add your upload key and debug key too if you test with them.

Apple fetches the association file through its own content network and caches it, so a change can take up to a day to reach new installs. To test sooner, add ?mode=developer to the entry, as in applinks:your-domain?mode=developer, and turn on Associated Domains Development in Settings, Developer on the device. Remove it before you ship.

Check that the link is attached to the app, that the link is on a custom domain with the status Active, and that the host in your entitlement or intent filter matches the domain exactly. On Android, check that the fingerprint belongs to the key that signed the build you installed.

You can test the files with Apple's App Search validation tool and Google's Digital Asset Links tester. App opening works when someone taps a link, scans a code with the camera or follows a link from another app. Typing the address into a browser's address bar usually stays in the browser.

You can use an email address and a password of at least 8 characters, or sign in with Google. For email sign-ups, tipeerQR sends a 8-character code made of letters and numbers without look-alikes. Enter it within 15 minutes to verify your address.

A password sign-in and a Google sign-in with the same verified email address share one account.

To protect the service, each network can make 20 sign-up attempts per hour. If you hit the limit, try again later.

Related: Create an account

Choose Forgot password on the sign-in page and enter your email address. tipeerQR emails you a code, and you use it to set a new password.

Related: Reset your password

Open Settings and use Login security. To change your password, enter your current password and a new one. To change your email address, enter the new address and your current password. tipeerQR then emails a code to the new address, and the change applies only after you enter that code. The code expires after 15 minutes.

If you sign in with Google, there is no password to set in tipeerQR and your email comes from your Google account, so change either one in your Google account settings.

Related: Settings

Open Settings and choose Delete account, then type your account email to confirm. tipeerQR removes your links, click history, saved QR styles, apps and API keys. It also removes the custom hostnames and the DNS records it created for your domains. Your links stop working right away, and you cannot undo this.

Related: Privacy policy

Open Settings and create a key in API keys. tipeerQR shows the key once, so copy it then. It stores only a SHA-256 hash of the key and its first characters, so it cannot show the key again. You can keep up to 10 keys and revoke any of them.

The API is read only and returns stats for your own links with GET https://links.tipeer.com/api/v1/stats and an Authorization: Bearer header. Each key can make 1,000 requests per day. When you pass that, the API answers 429 with a Retry-After header.

Related: API reference

Use the report form. You do not need an account. Enter the link, choose a reason (malware, phishing, spam, illegal content or something else) and add details if you can. Your email address is optional and only an administrator sees it.

An administrator reviews every report and can disable a link, a domain or an account. To limit abuse of the form, each network can send 5 reports per hour.

Related: Report a link, Abuse policy

Email support@tipeer.com. Include the link or domain you are asking about and what you expected to happen.

Related: support@tipeer.com