I work as a freelance developer, I kept running into the same issue with QR codes — once they’re printed, they’re effectively immutable. If the destination URL changes, you’re into reprints, workarounds, or just living with broken links. I’ve tried various solutions, but they were either too expensive, or filled with adverts and a pain to use.
So I’ve built this small tool that sits in front of the destination URL — essentially a redirect layer you can update later. The QR code encodes a short, permanent URL (a 10-character alphanumeric code),and a 302 redirect sends the user to whatever the current destination is. The QR code never changes, just where it points.
A few things I had to think through on the technical side:
302 vs 301 redirects. This matters more than you’d think. A 301 tells browsers and crawlers “this has permanently moved” — which means they cache the destination aggressively. If you later change where the QR code points, some users will never see the update because their browser cached the old redirect. 302 (temporary) avoids that entirely. The trade-off is a marginal latency hit on every scan since the browser always checks back, but for QR codes that’s the correct behaviour — the whole point is that the destination can change.
Scan analytics and bot filtering. Once you have a redirect layer, you naturally get visibility into scan events — referrer, user agent, timestamp, geo (if you want it). The tricky part is that a surprising amount of QR scan traffic isn’t human. Link preview bots, security scanners, messaging app prefetchers — they all hit the URL when someone shares or scans it. If you don’t classify these, your analytics are basically useless. I ended up building a classifier that flags known bot user agents and suspicious patterns (like bursts of scans from the same IP within a short window) so the dashboard numbers actually mean something.
Edge/CDN considerations. My first instinct was to stick Cloudflare in front and cache aggressively. But with 302 redirects, you need to be careful — CDN caching can turn your “temporary” redirect into a de facto permanent one if the cache TTL is too long. I ended up keeping the redirect path thin and uncached, since the lookup is just an indexed database hit on a short string. The latency is low enough that caching would add complexity without meaningful improvement. Static assets (the dashboard, QR images, etc.) are cached normally — it’s only the redirect path that needs to stay dynamic.
URL safety. Because users control the destination URL, you have to think about what happens when someone points a QR code at something malicious. I added a validation layer that checks destination URLs before allowing the redirect — you don’t want to be the open redirect sitting between a printed QR code and a phishing page.
Custom domains
I’m in two minds on custom domains, I can see the value add, but I’m not sure that adding this support is going to be worth the effort in the long run?
Nothing here is particularly novel individually, but the combination turned out to be more useful than I expected — especially for anyone dealing with printed materials where changes are inevitable.
This is also my first step away from purely client work into building small, self-serve tools. Still figuring out distribution, pricing, and what actually sticks. The hardest part hasn’t been the technical work — it’s been deciding what’s worth charging for vs. what should just be free.
Curious if others have run into this problem or solved it differently. Particularly interested in how people handle the analytics side — bot detection in particular feels like an arms race.
(If anyone wants to see what I built: <a href="https://agileqr.agilepixel.io" target="_blank" rel="noopener nofollow">https://agileqr.agilepixel.io</a>)

Dave

A freelance developer built a dynamic QR code redirect service to solve the immutability problem of static QR codes. The tool encodes a permanent short URL that points to a redirect layer, allowing the destination to be updated without reprinting. Key technical decisions covered include using 302 over 301 redirects to prevent browser caching of destinations, building a bot classifier to filter non-human scan traffic from analytics, keeping the redirect path uncached at the CDN layer to preserve dynamic behavior, and adding URL safety validation to prevent open redirect abuse. The author is also weighing custom domain support and exploring monetization as a first step into self-serve product development.

Why static QR codes are a hidden liability (and what I built instead)