QR Code Generator Chrome Extension: I Audited 14 of Them

Ever installed a QR code generator Chrome extension, clicked it once, and wondered what it just did with your URL?

I build QR and link tooling at linkutm, so I wanted to know. On November 3, 2026, I downloaded the install packages of 16 QR code extensions from the Chrome Web Store and read their code. Two no longer exist. The other 14 are below, with what each one does with your page.

Most are fine. A few are not. One with 100,000 users silently cuts UTM parameters off your links, and I proved it with a scan test.

Here’s the short version:

What I checked	Result (14 extensions)
Built on Manifest V3	14 of 14
Generate the QR code inside your browser	12 of 14
Send your page URL to a remote image server	2 of 14
Encode a third-party short link instead of your URL by default	1 of 14
Ask only for activeTab access (no install warning)	10 of 14
Bundle an analytics SDK	5 of 14
Open a tab when installed or updated	4 of 14

What Does a QR Code Generator Chrome Extension Actually Do?

A QR code generator Chrome extension is a small add-on that turns the page you’re on, a link, or selected text into a QR code without leaving the browser. You click its toolbar icon or right-click a link, and a scannable code appears in a popup.

Under the hood, every one I audited does three things:

1. Reads a URL. Usually the current tab’s address, sometimes a link or text you right-clicked.
2. Encodes it. Either with a QR library bundled inside the extension, or by sending the URL to a remote image API that returns a picture of a code.
3. Shows or saves the result. Most offer PNG download. Some add SVG, colors, logos, or a history list.

Step 2 is the one that matters. It decides whether your URL ever leaves your machine and whether the extension works offline.

A few terms you’ll see below:

• Manifest V3 (MV3): the current extension format Chrome requires. Google switched off older Manifest V2 extensions from Chrome 139 and removed the remaining ones from the store on August 31, 2026, per its MV2 support timeline.
• activeTab: a permission that gives an extension access to one tab, only after you click it. Chrome shows no install warning for it.
• Host permission: standing access to websites. <all_urls> means every site, and Chrome warns “Read and change all your data on all websites.”
• Content script: code an extension injects into web pages as they load.

Honest limitation: I read code and manifests. I did not watch live network traffic from every extension, so “bundles an analytics SDK” means the code is present, not that I saw what it sends.

Do You Even Need a QR Code Extension? Chrome Has One Built In

For a one-off code of the page you’re on, no. Chrome already ships a QR code generator in its menu, on desktop, Android and iPhone. I covered how it works, and its quirks, in how to create a QR code on Google Chrome.

An extension earns its place when you need something the built-in tool doesn’t do:

You need	Built-in Chrome	A QR code Chrome extension
Code for the current page	Yes	Yes
Code from a right-clicked link or selected text	No (paste it into the URL box instead)	Most offer it in the right-click menu
Colors, logo, SVG export	No	Some
A history of codes you made	No	Some
Works in Edge, Brave, Opera, Vivaldi	Chrome only	Yes, any Chromium browser can install Chrome Web Store extensions
Nothing new to trust	Yes	No, it’s another piece of software with access to your tabs

My take: if you make one code a month, use Chrome’s menu. If you make codes daily from links on other pages, a QR code generator extension saves real clicks. Just pick one carefully, because the last row never goes away.

I Audited 14 QR Code Chrome Extensions: Here’s What I Found

I collected 16 extension IDs from search results for “QR code generator Chrome extension”. I downloaded each package from Google’s update server, which is the same file Chrome installs. Then I read each manifest.json and scanned the bundled code as text. I never ran any of it.

Two IDs were dead, including a 2015 Chrome App called URL2QR. Here are the 14 that remain, as listed on November 3, 2026:

Extension (listing title)	Users	Last updated	Where the code is made	What stood out
QR Code Generator	900,000	Oct 8, 2026	In the browser	activeTab only, no analytics SDK found
QR Code (Generator and Reader)	200,000	May 31, 2024	In the browser	Opens a tab on install and update
QR Code	100,000	Aug 25, 2023	In the browser	Also scans codes
QR Code Generator (developer: BXN)	100,000	Apr 5, 2026	Remote server (api.qrserver.com)	Access to all sites; cuts UTM parameters
Easy QR	20,000	Apr 2, 2026	In the browser	Content script on google.com only
The QR Extension	10,000	Jun 2, 2024	In the browser, but encodes a third-party short link by default	Opens tabs on install and update
QR Code Generator	1,000	Feb 12, 2026	In the browser	Bundles a 2016 open-source encoder
QR Code Generator for Chrome	509	Oct 25, 2023	Remote server (Google Charts)	Server returns 404: no code at all
QR Code Generator & Scanner	238	Mar 22, 2024	In the browser	Content script on all sites
QR Code Generator (Free & Offline)	91	Jun 16, 2026	In the browser	Opens a tab on install
QR Generator	71	Mar 26, 2024	In the browser	Asks for tabs (“Read your browsing history”)
Web Page QR Code Generator	37	Sep 10, 2024	In the browser	Content script on all sites
Current Page QR Generator	12	Oct 12, 2026	In the browser	activeTab only
The QR Code Generator (Uniqode)	Not shown	Jan 18, 2026	In the browser (static codes)	Dynamic codes need a Uniqode account

The good news first. The most popular extension, at 900,000 users, is also one of the cleanest: three permissions, local generation, no analytics code I could find. Popularity and quality lined up there. If you just want the best QR code Chrome extension by the numbers, that one passed every check I ran.

The rest of this section is the part listings don’t tell you.

One extension depends on a dead Google API

“QR Code Generator for Chrome” (509 users) builds its image from chart.apis.google.com, the old Google Charts infographics endpoint. I requested it on November 3, 2026, and got HTTP 404 every time. So the popup shows a broken image on every page. The listing is still live and still installable.

That’s the core risk of remote generation. When someone else’s server goes away, your extension silently stops working.

Two “Featured” extensions send your URL to someone else’s server

“Featured” sounds like a quality seal. It isn’t a privacy review. Google’s Chrome Web Store discovery docs list the nomination criteria: published, English support, no active policy violations, core features free. Nothing about where data goes.

Two Featured extensions in my sample send the page URL off your machine:

• QR Code Generator by BXN (100,000 users) builds every code by calling api.qrserver.com with your tab’s URL. It also holds access to all websites and runs a content script on every page. On install or update, it posts its version to createqrcode.xyz and opens whatever URL that server sends back.
• The QR Extension (10,000 users) has a “Dynamic QR” option switched on by default. It sends your page URL to a shortener backend (hybridapps.net, with a fallback host) and encodes the short link that comes back, not your URL.

Both listings declare the developer “will not collect or use your data”. I’m not saying either developer does anything bad with URLs. I’m saying the code sends them, and the label doesn’t tell you.

Five bundle analytics code, four open tabs at install

Five of the 14 bundle Amplitude or Google Analytics code, which usually means usage events go back to the developer. Four open a new tab when installed or updated, usually a welcome or “what’s new” page. Seven set an uninstall page, typically a survey.

None of that is malicious. But a QR code extension doesn’t need any of it to make a QR code.

Why Some QR Code Extensions Break UTM Links

A QR extension breaks UTM links when it sends your URL to an image API without percent-encoding it first. Everything after the first & gets read as a separate API parameter, so it never makes it into the code.

Percent-encoding (also called URL encoding) turns characters like &, + and # into codes like %26, so they survive inside another URL. goQR’s own API documentation says the data value must be URL encoded.

I rebuilt the exact request the 100,000-user BXN extension makes, then decoded the returned image with two decoders (zxing-cpp and OpenCV). I also sent a correctly encoded version as a control:

URL I fed in	QR decoded to (as the extension sends it)	Encoded control
https://shop.example/fall-sale?utm_source=newsletter&utm_medium=email&utm_campaign=fall-sale	https://shop.example/fall-sale?utm_source=newsletter	Exact match
https://shop.example/search?q=red+shoes&size=9	https://shop.example/search?q=red shoes	Exact match
https://app.example/#/signup?ref=chrome	https://app.example/	Exact match

Look at row one. The code still scans. It still opens the right page. But utm_medium and utm_campaign are gone, so in GA4 the visit arrives with a source and no medium or campaign. You’d never spot it by looking at the code.

The dead Google Charts extension builds its request the same unencoded way, so it would have had the same problem even when the API worked.

The lesson isn’t “never use an extension”. It’s: scan your first code and read the URL your phone shows before you print anything. If your links carry UTM parameters, check that all of them survived.

How to Check a QR Code Chrome Extension Before You Install It

You can vet a QR code Chrome extension in about five minutes. These six checks would have caught every problem in my audit:

1. Read the permission prompt. For making QR codes, activeTab (no warning) is enough. “Read your browsing history” or “Read and change all your data on all websites” is more access than the job needs. The full warning list is in Chrome’s permissions reference.
2. Check the “Updated” date and version. A listing untouched since 2023 isn’t automatically bad, but both remote-API extensions I found were old or tied to an outside server.
3. Look for “works offline” and test it. Turn off Wi-Fi, click the extension. If no code appears, it generates on a server, so your URL leaves your machine.
4. Encode a tricky test URL. Use one with &, + and #, like the three in my table. Scan the result with your phone and compare it character by character.
5. Check what the code points to. If the scanned URL is a short link you didn’t create, the extension swapped in its own redirect. Your printed code now depends on that service.
6. Re-check after updates. Extensions update silently. On Christmas Day 2024, attackers used a compromised Cyberhaven account to publish a malicious update to its Chrome extension, which auto-updated on users’ machines before it was pulled, as TechCrunch reported. If an extension suddenly asks for new permissions, Chrome disables it until you approve. Don’t approve on autopilot.

Real talk: step 4 is the one most people skip, and it’s the one that catches silent data loss.

Static Codes, Short Links and “Dynamic” Codes: What an Extension Can’t Do

A QR code Chrome extension makes static codes. The URL is baked into the pattern, and you can’t change it after printing.

Some extensions offer “dynamic” codes. A dynamic QR code encodes a short redirect link instead of your URL, so the destination can change later and scans can be counted. That needs a server. So a “dynamic” extension is really a front end for someone’s redirect service, like the default short link in The QR Extension.

That trade-off is fine if you chose it. It’s a problem if you didn’t. If that redirect service shuts down or starts charging, every printed code that points to it breaks. I tested what happens to codes from big QR vendors when you stop paying in my best QR code generator comparison.

My rule: for anything printed, own the redirect. Use a short link on a domain you control, or encode your full URL as a static code. Don’t let an extension pick the redirect for you.

Where linkutm Fits (and What It Doesn’t Do)

Our own Chrome extension does not make QR codes. I’d rather say that up front. It does something QR extensions skip: it adds UTM parameters to the page you’re on, applies your team’s naming rules, and turns the result into a branded short link.

Here’s the workflow I use for printed campaigns:

1. Tag the URL. The free QR code UTM builder pre-fills utm_source=qr_code and suggests a medium by placement.
2. Shorten it on your own domain, so the code stays small and you can redirect it later.
3. Generate the code from that short link. linkutm makes a QR code for any link you create, with your colors and logo, on the QR codes feature. The Free plan includes 25 a month.
4. Scan it and check the landing URL before printing.

Honest limitation: if all you want is a quick code for the page you’re on, this is more steps than a one-click extension. It pays off when you need the scans to show up correctly in GA4. For the reporting side, see how to track QR code scans.

Frequently Asked Questions

Are QR code Chrome extensions safe?

Most are, but safety depends on permissions and where the code is generated. In my November 2026 audit, 12 of 14 generated codes inside the browser, and 10 asked only for activeTab. Two sent the page URL to a remote server. Prefer extensions that work offline and don’t ask to read all your data on all websites.

Do QR code Chrome extensions work offline?

Only those that bundle a QR library. Twelve of the 14 I audited can generate a code with no internet connection. The other two call a remote image API, and one of those, built on Google Charts, no longer works at all because the endpoint returns a 404. Test it by turning off Wi-Fi and clicking the icon.

Can a QR code extension see my browsing history?

Only if it asks for the tabs or history permission, or for access to all sites. Chrome warns you at install: tabs shows “Read your browsing history.” Two of the 14 extensions I audited request tabs. An extension that uses activeTab sees only the tab you click it on, and only when you click.

Why does my QR code extension drop UTM parameters?

It’s sending your URL to an image API without percent-encoding it. The API reads everything after the first & as its own parameter, so utm_medium and utm_campaign never reach the code. I confirmed this with a scan test on a 100,000-user extension. Switch extensions, or encode a short link that already carries your UTM parameters.

Do QR codes made with a Chrome extension expire?

No, not if the code contains your actual URL. A static code works as long as the page it points to exists. The exception is an extension that encodes its own short link. That code works only as long as the developer’s redirect service keeps running.

Do Chrome QR code extensions work in Edge or Brave?

Yes. Edge, Brave, Opera and Vivaldi are built on Chromium and can install extensions from the Chrome Web Store. The same permission checks apply. Edge also runs its own add-ons store, where a developer may publish a different version.

The Best QR Code Generator Chrome Extension Is the Boring One

The best QR code generator Chrome extension does one thing. It reads the tab you click, encodes it locally, and hands you a file. No server round trip, no surprise short link, no access to every site you visit.

Quick recap:

• Chrome’s built-in generator covers the one-off case.
• 12 of the 14 extensions I audited generate codes locally. Two depend on remote servers, and one of those servers is dead.
• A Featured badge is not a privacy review.
• Always scan a test code with & in it before you print.

If your QR codes need to show up correctly in GA4, start with a tagged, shortened link. Build the tags with the free QR code UTM builder, then generate a branded QR code from it in linkutm.