QR guide · PNG, SVG and encoding

QR Code Command-Line and SVG Guide for Developers

QR codes are easiest to automate when the payload, output format, size, contrast, and error-correction policy are explicit. The examples below use the public QR API, so they work from a shell, a build step, or a static HTML page without an account or browser-side package.

PRACTICAL · COMMAND LINE READY

How do I generate a QR code from the command line?

URL-encode the payload and request PNG or SVG with curl. Save the response as a file and keep a quiet zone around the code when you place it in a document.

curl -G https://qr.lifestep.io/qr \
  --data-urlencode data=https://example.com \
  --data format=png --data scale=6 -o qr.png

# vector output
curl -G https://qr.lifestep.io/qr \
  --data-urlencode data=https://example.com \
  --data format=svg -o qr.svg

Why it works: The payload is encoded into modules: the dark and light squares that a scanner reads. `--data-urlencode` prevents characters such as `&`, `?`, and spaces from changing the query string. Scale controls pixels per module for raster output; SVG is usually better for print or responsive layouts because it stays sharp. Keep strong foreground/background contrast and preserve at least four modules of quiet zone around the symbol.

How do I use a QR code as SVG in HTML without JavaScript?

Put the API URL directly in an `` element. The browser fetches the SVG as an image; no JavaScript, canvas, or QR library is required.

QR code for example.com

Why it works: A static image request works in plain HTML, server-rendered pages, Markdown-capable systems, and email templates that allow remote images. The `alt` text should describe the destination because a QR symbol is not accessible by itself. For a production site, you may download and self-host the SVG to avoid a runtime dependency; if the payload contains private data, do not place it in a public request URL.

What do QR error correction levels mean?

QR levels trade capacity for recoverability: L restores about 7% of codewords, M about 15%, Q about 25%, and H about 30%. Choose the lowest level that fits the environment, then test the printed result.

# API implementations commonly expose the level as a query parameter
curl -G https://qr.lifestep.io/qr \
  --data-urlencode data=https://example.com \
  --data format=svg --data error_correction=H -o durable-qr.svg

Why it works: Higher correction adds redundant data, so the same payload needs a denser symbol or larger physical size. H is useful for labels exposed to dirt or a logo overlay, but it is not automatically better on a small screen. Quiet zone, contrast, focus, lighting, and physical dimensions matter just as much. Check the API’s supported parameter set before relying on a named option, and scan the final rendered asset rather than only the source SVG.

A small production checklist

Make the command deterministic before putting it in automation. Pin the input hostname or filename, set a timeout, capture the exit status, and emit a concise error that a build log can explain. Treat an empty answer differently from a transport failure: an empty DNS record, a workbook with no matching package member, and an unavailable endpoint are different states. Test one known-good fixture and one deliberately bad fixture so a future dependency or API change cannot silently turn a failure into a pass. Prefer machine-readable JSON when an API provides it, but retain the original command for local diagnosis. If the result controls a user-facing decision, show the reason and a timestamp rather than only a green or red label. These habits keep a useful one-liner understandable when it becomes a scheduled check.

When an agent runs this check for you

The habit above — one known-good fixture and one deliberately bad one — is the same rule that decides whether an agent’s own verification means anything. A check exercised only on its passing case is indistinguishable from one that returns a constant, and that is how a green suite ships an inverted result.

Two free collections built from the incidents behind that: adversarial review prompts (assume the diff is broken and prove it) and CLAUDE.md rules that bind (trigger, check, stop, evidence). Both MIT. The full set is the Complete Agent Ops Kit, $29.