Static vs Dynamic QR Codes: Which to Use and When

The print quote comes back with a line near the bottom: QR code included. The owner ticks it, approves the run, and two weeks later a box of table cards arrives with a neat black square in the corner. Nobody in that chain asked whether the code stores its destination or points to one that can be changed later.

That question decides what happens when the promotion ends, when the menu PDF is replaced, when the review page moves, or when someone sticks a label over the code with worse intentions. It decides whether a fix costs a phone call or a full reprint. It also decides whether there's any evidence at all of how many people scanned.

Owners and managers of cafés, restaurants, salons, gyms and shops meet this on menus, loyalty sign-ups, review requests, class timetables and seasonal offers. The choice between static and dynamic QR codes gets made per placement, not once for the whole business.

What follows is the working detail: how each type behaves, where each one fails, what the scan numbers really prove, and how to choose for the six placements that cover most printed material in a small venue.

Why the Choice Affects Your Printed Codes

A café orders 200 table cards in June, each carrying a code that opens a summer drinks promotion. The promotion ends in August. The cards stay out until Christmas, because they still look good and the staff stopped noticing them weeks ago. Every customer who scans one in October lands on a page advertising a drink that no longer exists.

One structural difference causes that. A static QR code stores its destination directly in the pattern, so the same printed square always opens the same page. A dynamic QR code stores a short redirect address instead, and the provider's system decides where that address sends people. The two look identical on a table card, which is why the mistake is easy to make and hard to spot afterwards.

The appetite is already there. GS1 UK's report on QR codes and consumer demand notes that more than 90% of UK adults own a smartphone, three in five use QR codes in everyday life and 79% have interacted with a product through a QR code.

Direct answer: static for destinations that never change, dynamic for offers that change or need scan data.

Not every fixed destination belongs to the business itself. A restaurant that hosts wedding receptions gets asked about photo sharing, and a QR code for wedding photos is a good example of a placement that should be set once and left alone, because the gallery is finished the moment the last guest uploads.

Before reading on, do the five-minute task: write down every code you have printed or plan to print, and mark each one fixed or changeable. That list settles most of the decisions later. It applies to loyalty material too, so when you print loyalty cards with QR codes, decide up front whether the card carries a final destination or one you'll want to move.

Static and Dynamic QR Codes Side by Side

Six criteria decide it, and the table is a starting point rather than a verdict.

Static vs dynamic QR codes compared on six criteria

The first row sets everything below it. If the destination is final, a static code is finished business: print it, forget it. If there's any chance the offer changes while the material is still on display, a dynamic code pays for itself the first time an edit replaces a reprint.

Rows two and three are where the practical difference shows. A static code has no reporting layer, so the only evidence of use is what staff happen to notice at the counter. A dynamic code routes every scan through a system that counts it, which also means the system has to be running for the customer to see anything at all.

Auditing the destination and the running cost

Row four flips the advantage, and it's the row owners underestimate. Checking where a static code goes takes one scan. Checking a dynamic code means knowing which platform holds the redirect, who has access to it, and what it points at today.

Row five is a cost line rather than a feature. Static codes carry no ongoing platform dependency. Dynamic codes usually sit inside a subscription or a platform account, and that account becomes part of whether the printed material works.

Row six is the summary: permanent menus and fixed pages on one side, changing offers and measured campaigns on the other. The context supports that split. The FCA's 2024 Financial Lives survey found that 92% of UK adults had made a contactless payment during the preceding 12 months, while only a small minority reported scanning a merchant-displayed QR code to pay. In a UK café or shop, the code on the wall is almost never the payment method. It's a doorway to information, a sign-up or a review, which makes the destination decision a content decision.

Rule of thumb: if the destination will never change, choose static. If the offer rotates or scan data matters, choose dynamic.

Accept one consequence before you order print. A printed static code can't be upgraded later, so moving a placement from static to dynamic means reprinting it with a redirect code. Label the artwork file with the choice while it's still editable.

What Happens When a Code Stops Working

A static code carries the final URL inside its own pattern. The phone decodes it and goes straight there, with nothing in between. A dynamic code carries a redirect address controlled by the provider, so the phone has to reach that service before the customer sees anything. Nottinghamshire County Council's guidance on QR codes puts the operational case plainly: static URL codes give long-term control and reliability, while dynamic links can fail or change when the redirect service is unavailable.

That difference decides what a customer sees on the worst day of the year.

Three failures worth planning for

The subscription lapses. A salon prints 100 posters for a points campaign, billing fails in month four, and every poster now opens an error page. Customers read that as the offer being cancelled. The owner can renew the redirect or reprint with a static code, and only one of those fixes it before the weekend.

The provider moves its domain. Old codes stop resolving, or resolve to a holding page. Nothing on the printed material has changed, which is exactly why nobody notices until a customer mentions it.

The destination itself breaks. A redirect can be perfectly healthy and still land on a deleted menu PDF or a page about something else entirely. This is the most common of the three, the least dramatic, and the one a monthly check catches early.

Scan every printed code on mobile data, not on shop Wi-Fi, and write down exactly where each one lands. Ten minutes, and the dead ones surface before a customer finds them.

Rebuilding resilience into a dynamic setup comes down to three habits: keep a stable fallback URL that stays under your own control, check redirect uptime monthly, and don't make essential customer access depend on a shortener you haven't verified. The redirect domain, the hosting and the subscription are all part of whether the code works, so treat them as infrastructure rather than as a line item somebody else manages.

Security Risks That Apply to Both Types

A dynamic code isn't automatically safer than a static one. Both are printed squares that someone can cover with a sticker. The dynamic version adds a second surface to attack: if the redirect account, the domain or the platform login is compromised, every scan goes wherever the attacker points it while the printed code still looks correct.

The UK numbers make this an operational problem rather than a hypothetical. BBC reporting on Report Fraud figures states that the service recorded 2,743 reports mentioning QR codes in the year to August 2026, against 341 in the year to August 2022.

Six checks cover the practical risk.

• Inspect printed codes weekly. Table tents, window stickers and poster corners are where a malicious label gets placed, and staff walk past them a hundred times a day without looking.
• Keep the destination branded. A code that opens on your own HTTPS domain can be verified by a customer in two seconds. A code that opens on an unfamiliar shortener asks for trust it hasn't earned.
• Print the destination next to the code. Plain text under the square, so people can see where it goes before the camera reads it.
• Don't route a printed code to a payment page. Card or bank details requested straight after a scan is the exact pattern QR scams use.
• Lock the platform login. Two-factor authentication on any dynamic account, plus named access for whoever can edit destinations.
• Give staff a reporting line. Anyone who scans a code and lands somewhere unexpected should say so the same day, not wait for a customer complaint to reach the manager.

Static codes are easier to audit because the destination is fixed, which makes a swap obvious to anyone who knows the right address. The trade-off is that a broken URL means a reprint, and no amount of checking brings a dead static code back.

The money makes the point. Action Fraud's guidance on QR codes recorded 784 reports of QR-code scams between April 2024 and April 2025, with reported losses of almost £3.5 million. BBC reporting on that data shows the growth: 100 reports in 2019, rising to 1,386 in 2024.

Close with an audit you can hold in one hand. For every code in circulation, write down where it points, who can change it, and how you'd find out if it changed without you. Any line you can't fill in is a placement that needs either a static replacement or a stricter account.

What QR Analytics Can and Cannot Prove

A scan count isn't a visit, a sign-up or a sale. It records that a phone's camera decoded a pattern, and nothing more.

Dynamic reporting earns its keep when you read it at the right level: scans by poster, by location, by campaign, and the hours they happen. That tells you which table card is doing the work and whether the poster by the toilets is wasting ink. It doesn't tell you what anyone did next.

The blind spot is bigger than most dashboards admit. New Local's 2025 account of community digital inclusion work describes people needing to scan a QR code just to get onto Wi-Fi or reach one-to-one support. Every scan-first journey assumes the customer has a smartphone, camera access, mobile data or Wi-Fi, a compatible browser and the confidence to use a mobile page. Anyone missing one of those is invisible in the numbers, and their absence looks like low interest rather than a barrier.

Accessibility raises the same point from a different direction. OpenQR's comparison of static and dynamic QR codes is right that static codes can't natively provide scan analytics while dynamic ones support scan counting and campaign attribution, and it flags the underlying requirement: UK public sector guidance expects digital services to meet WCAG 2.2 AA, so the page behind a code can't be the only route in. Print a short URL beside the code and keep an assisted path available.

The four-rung measurement ladder

1. Scans. Which poster, which day, which hour. Useful for spotting a dead placement, useless as a result.
2. Completed sign-ups. The first real conversion, and the point where a customer becomes contactable.
3. Redemptions. Whether the reward gets used or sits in an account forever.
4. Repeat visits. The only rung that tells you the programme is working rather than the poster.

BonusQR reports on the upper rungs. Its statistics show each month how many new customers joined and how many returning customers came back, and the dashboard shows who joined, what members redeemed and which days drive the most repeat traffic. That's outcome data, and it comes with the same caveat as any other report: it shows what happened, not proof that the code caused it. The loyalty program analytics stats are worth reading alongside the sign-up sheet, not instead of it.

For customers who won't scan, offer the same journey another way: a short URL printed beside the code, staff-assisted sign-up at the till, or a number they can text. Judge each campaign on sign-ups and repeat visits. A scan count on its own flatters everyone and teaches nothing.

Choose and Confirm Each Code Before Printing

Six placements cover most of what a café, restaurant, salon, gym or shop prints. The reason behind each fit matters more than the label.

Which QR code fits each common placement

Read the table through one rule: permanent destinations take static codes, changing offers take dynamic codes. A price list replaced twice a year sits close to permanent, because the replacement comes with a reprint anyway. A promotion that ends in six weeks does not.

Mixing both on the same counter

A café can put a static code on the counter for the permanent menu and a dynamic code on the seasonal poster beside it. The menu code survives every poster redesign, and the poster code gets repointed to a new offer without touching the print.

A salon follows the same pattern with a fixed booking page, which suits a static code because the address doesn't move, plus a dynamic code on a referral card that runs for a quarter. A gym running a six-week challenge wants the dynamic version: one printed sign, and the destination moves from sign-up to leaderboard to final results as the challenge progresses. For more placements than these six, the BonusQR small business marketing guide covers campaign ideas worth printing for.

Paper is also the most common point of tampering. Replacing a worn or over-labelled code promptly is part of maintenance, and a service for bespoke sticker printing for small businesses can run replacements in your own colours, so a swapped code stands out against the ones you printed.

The pre-print checklist

1. Test on mobile data and a second phone. Wi-Fi hides redirect delays, and one handset hides the model-specific failures. Scan, wait, confirm the landing page loads fully.
2. Check contrast, quiet zone and printed size at the actual scale. Keep the quiet zone at least four modules wide on every side and hold the card at arm's length to confirm it still reads at the size it will be printed.
3. Confirm a branded HTTPS domain and print it near the code. If the destination isn't yours, find out whose it is and what happens to it if that business stops trading.
4. Set a monthly check. One person, one calendar reminder, covering two things: stickers or damage over the printed code, and whether the redirect still lands where it should.

Ask this for every placement: will this destination change within the life of the printed material?

For most small loyalty programmes the answer is a mixed setup. A dynamic code on the counter sign, because offers rotate and you'll want the numbers. A static code for the menu, because it's permanent and nothing needs to fail in the middle of it. Sign-ups and repeat visits as the measure, rather than scans.

BonusQR supplies a ready-to-print sign with your QR code and your brand, needs no POS integration, no app to install and no extra hardware, and can be set up in a few minutes. That removes the hardest part of a first loyalty launch, which is usually getting a working code onto the counter before the offer goes stale.

The UK experience points the same way. Juniper Research's analysis of QR adoption notes that UK use accelerated during the pandemic through menus, ordering and check-in rather than payment. A code earns its place by removing a step from one journey. Choose the type that keeps removing steps, and recheck it every month.

Set up a BonusQR account before your next print run rather than after it. A ready-to-print counter sign carrying your own QR code and brand means the placement is working from the first day of the promotion, with new and returning customers visible in the dashboard each month. Print the sign, test it on mobile data, and let the next round of printed material get ordered with a fixed destination or a changeable one, chosen on purpose instead of by default.