To track QR code scans, generate the QR code for a short link instead of your final URL. The short link counts every scan and redirects instantly, so you get analytics — scans over time, locations, devices — without the person scanning noticing anything. That's the whole trick, and it's free.
A QR code on its own is just a URL printed as pixels. It has no memory and no analytics. If your code points straight at example.com/menu, every scan goes directly there and no one counts it. Putting a short link in the middle is what turns a dumb image into something you can measure — and, as a bonus, edit later.
How QR scan tracking works
The mechanism is three steps:
- Shorten your destination.
example.com/menubecomes something likein.bio/cafe-menu. - Generate the QR code for the short link, not the destination.
- Every scan hits the short link first, gets counted, and redirects to the real page in milliseconds.
The person scanning notices nothing — it opens the page they expected. You get scans over time, countries and cities, and device breakdowns. If you're new to the first step, our step-by-step guide to shortening a URL covers it.
Why you should encode the short link, not the destination
Encoding the short link instead of the final URL gives you two things a plain QR code can never have:
- Analytics. The redirect hop is where the scan gets recorded. No hop, no data.
- An editable destination. Because the printed code points at the short link, you can change where that link goes after the code is printed. Menu moved to a new page? Campaign over? Repoint the link and every poster, sticker, and business card already out in the world follows along — no reprinting.
There's a smaller, practical reason too: short URLs make simpler QR codes. A 140-character link produces a dense, fragile pattern; in.bio/cafe-menu produces a sparse one that scans faster and survives being printed small.
"Dynamic QR codes" are just this — with a price tag
A dynamic QR code is exactly the mechanism above: a QR pointing at a redirect you can edit, which most platforms sell as a premium upsell even though nothing about it is proprietary. With a good link shortener every code is dynamic by default — the full explanation is in dynamic QR codes explained.
Set it up in two minutes
- Open the QR code generator (or shorten a link first and grab its QR from the dashboard).
- Paste your URL — the code renders instantly.
- Style it if you want: switch dots to circles or connected lines, reshape the corner markers, set your brand colors, or make the background transparent. Every design stays machine-verified as scannable.
- Download a PNG for screens or an SVG for print — SVG stays crisp at any size, which matters when your code ends up on a banner instead of a business card.
Making a batch for a print run? The bulk URL shortener shortens up to 50 links at once, each with its own QR.
What QR code analytics actually tell you — and what they don't
Scan analytics are more honest than most people expect, in both directions, and it is worth being precise about the line.
What you can know: the total number of scans, a close approximation of unique scans, when they happened down to the hour, the city and country they came from, and the device and operating system that opened the link. Where a scan arrives with a referrer — because the code was shared online rather than scanned off paper — you see that too.
What you cannot know: who the person was, whether they bought anything without extra instrumentation on your own site, or whether one enthusiast scanned your poster five times while four other people walked past. Scan counts measure events, not people, and a report that pretends otherwise is misleading you.
One more limit worth stating plainly: this only works for codes that encode a link. A Wi-Fi QR code or a vCard QR code carries its data directly, with no redirect in the middle, so there is nothing to count — they are convenient, but invisible to analytics by design.
Reading your scan data
Once scans start coming in, three dimensions tell you the most:
- Scans over time — did the spike land when your campaign went live?
- Devices — print audiences skew heavily mobile, so a sudden desktop cluster usually means your link leaked online rather than off a poster.
- Location — invaluable for multi-city or multi-market print runs.
One caveat worth knowing: preview crawlers and scanners will "scan" your link automatically when the short URL gets shared in a chat or email, inflating counts. Good analytics filter those bots out — we cover why in bot traffic and click analytics.
Reading a scan report: a worked example
Numbers mean little until you read their shape. Take a restaurant that prints one code on its table tents and gets 400 scans in a month.
If the scans cluster hard around noon and 7pm, the table tents are working — people are scanning while they wait for a table. If a quarter of the scans are on desktop, the link has leaked online: someone photographed the menu and shared it in a chat, and those are not diners. If a spike of scans appears from a city three hundred miles away, the code was reposted somewhere — a food blog, a forum thread — and that traffic, while flattering, is not someone deciding where to eat tonight.
None of that requires more data than a short link already gives you. It just requires reading time-of-day, device, and location together rather than staring at a single total. The same reasoning applies to a code on packaging, a flyer, or a conference stand.
Attributing scans to a specific placement
The most common mistake is one code for a whole campaign. If the same code goes on the table tent, the window decal, the flyer, and the receipt, every scan lands in one pile and you learn nothing about which surface did the work.
The fix is one short link per placement, not per campaign. The table tent gets its own link, the window decal another, the flyer a third — identical destination, different codes — so the report separates them into rows you can act on. This is exactly the mechanism behind offline-to-online attribution, and it is why a real campaign needs many codes rather than one. Generating them one at a time is tedious; the bulk URL shortener makes a batch at once, each with its own QR.
Scan counts vs analytics sessions: why they never match
Sooner or later you will compare your scan count against the sessions in Google Analytics and find they disagree, often badly. This is normal, and neither number is broken.
The short link counts a scan the moment the redirect is hit. Analytics counts a session only once the destination page loads its script — and a lot happens in between. Bots and preview crawlers hit the redirect but never load the page. Some phones prefetch the link before the person taps. People abandon during the redirect on a slow connection. Ad and tracking blockers stop Analytics but not the redirect. The scan count is therefore almost always higher, and the gap is mostly automated traffic — which is worth understanding in its own right in bot traffic and click analytics.
Tracking scans without tracking people
You do not need to identify anyone to count scans, and you should not try. InBio never stores a visitor's IP address: a scan is counted, its rough location is derived and then discarded, and no fingerprint is kept that could tie two scans to the same person.
That is not only a privacy stance, it is a practical one. A printed QR code lives in a physical space where you cannot show a consent banner before someone points a camera at it — so the less personal data the scan collects, the simpler your position under GDPR and similar rules. You still get the counts, the timing, the device split, and the geography; you just do not get, or keep, the person. More on why we built it this way is in introducing InBio.
The takeaway
You can't track a plain QR code, but you can track the short link inside one — and that single change gives you scan analytics and an editable destination for free. Encode the short link, download the code, and you'll know how your printed campaigns actually perform.
Ready to make one? Generate a trackable QR code — free, no account needed, styled to match your brand.
Tracking scans proves your codes work; checking destinations keeps them trustworthy. To verify where any link or code actually points, expand the short link to see its destination, or run it through the link safety checker.