QR Code Reliability

Do Printed QR Codes Expire? Who Owns the Redirect Behind Your Code

A printed QR code has no expiry date, but the domain, account and redirect behind it do. What the evidence shows, and a checklist to run before you print.

SG
9 min read

Overview

A QR code doesn't come with an expiry date. The printed pattern is just data, and as long as the print survives, it will scan years from now as well as it does today. What wears out is everything behind it: the domain the code points to, the account that keeps a redirect running, and the page at the end. On a poster, a package, or a menu that stays in circulation for years, those decide whether a scan still lands somewhere useful.

This guide walks through what a printed code depends on, what happens when a domain lapses, how quickly printed links die, how libraries and governments keep theirs working, what QR vendors do when a subscription ends, and what to check before you send anything to print.

One number you won't find here is how many printed QR codes are broken. Nobody has measured it independently, and the figures that circulate come from companies that sell QR codes.

1. What Expires and What Doesn't

The QR code is an open ISO standard, designed by DENSO WAVE to keep working when it gets dirty or damaged[1]. Depending on its error correction level, a code can lose roughly 7% to 30% of its data and still scan, and most codes use the 15% level[2]. Nothing in that design involves time.

That resilience only covers the pattern, though. A pristine code that points to a dead page is still a dead end.

Static and Dynamic Codes

A static code stores its destination directly in the pattern. Scan it, and your phone goes straight there. A dynamic code stores a short link instead, and the service that owns that link decides where to send you. That's what lets you change a dynamic code's destination after printing, and it's also why its lifespan is tied to the service: the short link's domain is baked into the print, so the code works only as long as that domain and that service do.

Five Things a Dynamic Code Relies On

  1. The printed pattern: Fixed once printed, and built to tolerate wear.
  2. The short-link domain: Named in the pattern. Whoever holds the registration controls whether it resolves, and for most dynamic codes that's the vendor.
  3. The redirect: The record that says where the short link goes right now. It lives on the vendor's servers, tied to your account.
  4. Your account: What happens to the redirect when a plan lapses is up to the vendor (more on that in section 5).
  5. The destination: Your page, on a domain that also has to stay registered.

2. When a Domain Lapses

Domain names are rented by the year. When a registration lapses, ICANN's Expired Registration Recovery Policy gives the owner a chance to get it back: registrars have to send at least two renewal reminders, the former owner must be allowed to renew after expiry, and gTLD registries hold deleted names for a 30-day Redemption Grace Period with DNS switched off[3]. Once those windows close, the name is open to anyone.

And someone is usually waiting. A USENIX Security study found that about 10% of expired .com domains are re-registered on the same day they're deleted[4].

Three Documented Cases

Here's what that looks like in practice. Each time, a printed address outlived the registration behind it, and a stranger picked up the name.

China, 2026. A state broadcaster's investigation, reported by Sixth Tone, found public QR codes on street poles, bus stops, and other city fixtures sending people to porn and scam sites. In Beijing, the domain behind one code had expired on 27 February. In Suzhou, a code on a park shuttle bus was hijacked after it fell out of use[5].

Germany, 2015. A customer scanned the code on a Heinz ketchup bottle, left over from a personalized-label promotion that had ended, and landed on an adult website. Heinz no longer owned the contest's domain[6].

UK, 2025. No QR code this time, just a web address printed in a children's book series. After an unrelated third party took over the domain, the publisher had to win it back. The domain “has been transferred to us,” Penguin said[7]. The weak point is the printed domain, whatever format it's printed in.

Short Links Are a Business Decision

Shortened links add one more dependency: the company running the shortener. Google announced in July 2024 that goo.gl links would stop working, then “adjusted our approach” a year later, keeping active links alive and switching off ones nobody had used in late 2024[8]. If Google can change its mind about old links, so can any vendor.

4. Lasting Systems Have a Named Owner

Libraries, governments, and standards bodies have kept printed references alive for decades, and they all do it the same way. The printed address never changes, and someone is responsible for making sure it still leads somewhere.

Tim Berners-Lee made the case in “Cool URIs don't change”: a page should only vanish if the company behind its domain goes under. “Oh, and do think about your domain name,” he adds[11]. Crossref, which issues the DOIs on academic papers, makes it a condition of membership that “your DOIs always resolve to a live landing page”[12].

The US Government Publishing Office has run permanent links since 1998, and its staff update them whenever federal documents move[13]. GOV.UK asks anyone withdrawing a page to set an “Alternative URL” so visitors are redirected rather than stranded[14].

GS1, the organization behind retail barcodes, applies the same idea to QR codes on packaging. Its Digital Link gives a manufacturer “a permanent address that can then be redirected to whatever the manufacturer wants.” Without one, it warns, the code on the pack “will lead to a 404”[15].

Each of these has an owner who plans to be around for decades. When your code runs through a vendor's domain, part of that ownership sits with the vendor, so it's worth knowing exactly what they've promised.

5. What Vendors Say at Lapse

Policies vary more than you might expect. QR Code Generator says that when a free trial ends, “Dynamic QR Codes are deactivated and point to a service page rather than the original destination,” though static codes keep working and upgrading brings the dynamic ones back[16]. Uniqode disables dynamic codes when a free trial ends and reactivates them on upgrade[17]. Hovercode keeps your first three dynamic codes working after you cancel, and the rest “will become inactive but won't be deleted”[19].

The contracts themselves tend to be quieter. Uniqode's terms let it delete account data within 30 days of termination[18], and QR TIGER's keep data for up to a year after a plan expires[20], but neither says what happens to a code that's already printed. That answer lives in help pages, which can change at any time.

We didn't find a single vendor that promises a lapsed dynamic code will keep redirecting, or a US rule that requires it. The closest thing is the FTC's guidance on “free” offers, which says the conditions should be stated “clearly and conspicuously at the outset of the offer”[21]. In other words, if a free code is going to stop working, you should be told up front. Ask anyway.

6. How Kebo QR Handles It

Since we sell dynamic QR codes, here's how ours work. The full details are on our pricing page.

  • Static codes: They never route through Kebo QR, so they keep working whatever plan you're on.
  • If you cancel: Your account drops to the free plan and nothing is deleted. Any dynamic codes beyond the free limit of 2 pause until you upgrade again, and upgrading turns them straight back on.
  • If you delete your account: Your codes, landing pages, scan history, and files are removed, and printed dynamic codes stop redirecting.

One limit is worth stating plainly. Every Kebo QR dynamic code redirects through a domain we own, and we don't yet let you use your own. For a print run meant to last years, that means relying on us staying in business. If that's not a risk you want, print a static code instead.

For most print, though, the bigger risk is the one from section 3: destinations move. A static code that points at a page that's gone stays broken, and the only fix is a reprint. A dynamic code is fixed in seconds from your dashboard, without touching a single printed copy. Keeping its domain registered is our job, not yours, and it's the domain this whole site runs on. Scan analytics on paid plans show you when a code goes quiet, and if you ever cancel, nothing is deleted: your codes pause and come back as soon as you upgrade. That's the trade we think most printed codes should make: a code you can repoint over one you can never change.

7. A Checklist Before You Print

Run through these before you send anything to print.

  1. Know who owns the domain: Find out whose name is on the short link's domain registration, and whether you can use your own. As W3C puts it, “do think about your domain name”[11].
  2. Get the lapse policy in writing: Ask what happens when a trial ends, when you cancel, when a payment fails, and if the vendor closes down.
  3. Ask how you'd leave: Find out whether you could point a printed code somewhere else if you switch providers.
  4. Go static for permanent print: If the destination will never change and sits on your own domain, a static code has nothing in between to fail.
  5. Print the address too: A short, readable URL beside the code gives people a way in when the code is scuffed or stops working, and a label tells them what they'll get. Section508.gov recommends both[22].
  6. Keep your domain renewed: Register it to the organization rather than one person, turn on auto-renew, and keep the contact email current, since that's where expiry notices go[3].
  7. Test after changes: Scan a printed copy after every renewal, plan change, or migration.
  8. Keep a register: Note every code, where it's printed, where it points, and what it depends on. When you retire one, point it at a page that says so, the way GOV.UK redirects withdrawn pages[14].

8. Conclusion

A printed QR code doesn't expire. The address behind it can, and in every documented failure the cause was a domain that lapsed. Subscriptions are the gentler risk: a lapsed plan usually pauses a code, and paying again brings it back.

Every system that keeps printed links alive for decades works the same way, with a fixed address and someone responsible for it. Before you print, make sure you know who that someone is.

9. Frequently Asked Questions

References

  1. DENSO WAVE. QR Code standardization
  2. DENSO WAVE. Error correction feature
  3. ICANN. Expired Registration Recovery Policy
  4. USENIX Security Symposium 2017. Game of Registrars: An Empirical Analysis of Post-Expiration Domain Name Takeovers
  5. Sixth Tone. Scan Scam: Criminals Redirect China's Public QR Codes to Porn
  6. Ubergizmo. Expired QR Code On Heinz Bottle Leads To Porn Website
  7. Penguin Books UK. Spy Dog update
  8. Google Developers Blog. Google URL Shortener links will no longer be available
  9. Pew Research Center. When Online Content Disappears
  10. Harvard Law Review Forum. Perma: Scoping and Addressing the Problem of Link and Reference Rot in Legal Citations
  11. World Wide Web Consortium (W3C). Cool URIs don't change
  12. Crossref. Leveling up: member obligations
  13. U.S. Government Publishing Office (FDLP). Persistent Uniform Resource Locators (PURLs)
  14. GOV.UK Publishing. Withdraw or unpublish a standard content page
  15. QR Code Generator Help Center. What happens to my QR Codes when my free trial ends?
  16. Uniqode Docs. How do I disable a QR code?
  17. Uniqode. Terms of Service
  18. Hovercode Help. If you cancel
  19. QR TIGER. Terms and Conditions
  20. Code of Federal Regulations (via Cornell LII). 16 CFR §251.1: Meaning of "Free"
  21. Section508.gov (U.S. General Services Administration). Accessible QR Code Implementation