QR code payload cheatsheet, every URI scheme in one reference

Reference table: every scheme at a glance

Web URLs: http and https

The base case. The scanner sees a string starting with http:// or https:// and hands it to the OS to open in a browser. Defined by RFC 3986, the generic URI syntax.

• Always use https; modern scanners warn or block plain http on phones with corporate profiles.
• Percent-encode any character outside the unreserved set defined in RFC 3986 (e.g. spaces become %20).
• Watch payload length. Long URLs push the QR symbol to a higher version, which raises the minimum print size. Strip unnecessary query parameters before encoding.
• Trailing slashes and case affect server matching but not QR decoding. Match your canonical form.

mailto: email

Defined by RFC 6068. Lets a scanner open a pre-filled email draft.

Full example: `mailto:hello@example.com?subject=Reservation&body=Table%20for%20two%20on%20Friday`. Most mobile clients honour subject and body; some desktop clients ignore body. Use the email QR generator to assemble the URI without hand-encoding.

tel: phone

Defined by RFC 3966. The scanner opens the dialler with the number pre-loaded.

• Use the E.164 international form with a leading +: tel:+919876543210.
• Spaces, hyphens and parens in the number are stripped by the OS; including them is fine for readability.
• Extensions can be added with ;ext=, e.g. tel:+12025550100;ext=42.
• The phone QR does not place the call; it only loads the dialler. The user still taps to dial.

Build one with the phone QR generator.

SMS: two schemes, one outcome

Two conventions are in use. The RFC form is RFC 5724 (sms:); the older form pre-dates the RFC and lives on as SMSTO:.

Stick with the RFC form for new QRs. The body field is optional in both. Use the SMS QR generator, which emits the RFC form by default.

WIFI: join a network on scan

Wi-Fi QR codes use a vendor format documented by the ZXing project. iOS (since 11) and Android (since 10) both honour it.

Full example: `WIFI:T:WPA;S:Cafe-Guest;P:letmein123;;`. The trailing `;;` matters; some scanners refuse the payload without it. Generate one safely with the Wi-Fi QR generator.

geo: pin a location

Defined by RFC 5870. Opens the OS map app to a coordinate.

On Android, geo: opens Google Maps reliably. On iOS, behaviour varies: many scanners convert geo: into a Maps URL automatically, while others ignore it. For cross-platform safety, encode an https://maps.apple.com or https://maps.google.com URL instead, or use the location QR generator which emits a fallback.

upi: India UPI payments

UPI QR codes follow the National Payments Corporation of India's UPI Linking spec, published under the NPCI UPI product documentation. The scheme is upi://pay with query parameters.

Example: `upi://pay?pa=merchant@bank&pn=Sample%20Store&am=199.00&cu=INR&tn=Order`. Use the UPI QR generator for static merchant QRs. The NPCI spec is authoritative; payment apps reject any payload that omits a required field.

vCard: contact cards

vCard is the standard contact format. Two versions matter for QR codes: 3.0 (RFC 2426) and 4.0 (RFC 6350). iOS and Android both support 3.0 reliably. 4.0 has better field types but inconsistent QR-scanner support in 2026.

Keep the vCard short, vCard payloads bloat fast. A full address plus two phones, two emails and a photo will push the QR symbol to a high version and force a large print size. Strip optional fields. Build one with the vCard QR generator.

MeCard, the compact alternative

MeCard (`MECARD:N:Doe,Jane;TEL:+919876543210;EMAIL:jane@example.com;;`) is a denser legacy format that Android originally promoted. Modern scanners still understand it. vCard 3.0 has wider iOS support; default to it unless print size is critical.

Calendar: ICS events

Calendar events use the iCalendar format defined in RFC 5545. For a QR payload, encode a single VEVENT inside a VCALENDAR wrapper.

Scanner support for raw ICS varies. iOS and most Android scanners do recognise it; some only accept ICS hosted at an https URL and treat the QR as a URL instead. For best cross-platform behaviour, host the ICS file at a public URL and encode that URL in the QR.

App store links: Android and iOS

App store links are the messiest part of the QR cheat sheet, because Android and iOS use different conventions.

iOS: a normal HTTPS URL

Use the canonical https://apps.apple.com/<country>/app/<slug>/id<numeric-id> URL. Encode it as a plain URL QR. No custom scheme is involved; Safari and the App Store handle the rest.

Android: market:// and intent://

Two conventions exist. `market://details?id=com.example.app` opens the Play Store app directly if it is installed; it fails on devices without Play Services. `intent://...#Intent;scheme=https;package=com.example.app;end` is the Android Intent URI scheme and lets you fall back to a web URL when the app is missing.

For QR codes meant to install or open an app, the safe pattern is to encode the canonical https://play.google.com/store/apps/details?id=... URL and let the OS dispatch it to the Play Store app. Same for iOS with apps.apple.com URLs. Use the app store QR generator, which emits cross-platform-safe URLs.

Scheme-specific gotchas, in one list

• Anything inside a QR is plain text. Wi-Fi passwords, mailto bodies and vCard fields can all be read by decoding the symbol. Treat printed codes as public.
• Long payloads push the symbol up several QR versions, raising the minimum print size. Strip optional fields ruthlessly.
• Capital-letter schemes (WIFI:, SMSTO:, MATMSG:) are case-sensitive vendor conventions. Lowercase RFC schemes (mailto:, tel:, sms:, geo:, upi:) are case-insensitive per RFC 3986 but should be written lowercase for safety.
• Some scanners default to opening only http(s) automatically and require an extra tap for everything else. This is a security feature, not a QR error.
• iOS and Android disagree on geo: behaviour. Encode a maps URL fallback for cross-platform reliability.
• vCard 4.0 (RFC 6350) is technically the modern version, but 3.0 (RFC 2426) has wider scanner support in 2026. Default to 3.0 unless you control the readers.
• intent:// URLs work only on Android Chrome and its derivatives; on iOS they are ignored. Use plain https URLs for cross-platform app deep links.