How to Make a QR Code for a PDF (and Keep It Private)

You can't put a PDF inside a QR code: the largest QR code holds 2,953 bytes, and almost any PDF is bigger than that. A "QR code for a PDF" is a QR code of a link. Upload the PDF somewhere that gives you a shareable URL (your own website, Google Drive, Dropbox, OneDrive), make the link viewable by the people who will scan it, then turn that link into a QR code. What you choose for hosting decides who can open the file, how long the code works, and who sees each scan.

Steps

1. Check the PDF before it goes public. Open its properties (in most PDF readers, File > Properties or Document Properties) and look at Author, Title and Keywords. Remove names or internal file paths you don't want to publish, and flatten or remove comments.
2. Upload it to one of the hosts in the table below.
3. Set the sharing. In Google Drive, open Share and under General access choose Anyone with the link as Viewer. In OneDrive, choose a link that works for Anyone. In Dropbox, create a link set to view only.
4. Copy the link and open it in a private browser window, or on a phone that isn't signed in to your account. If it asks for a sign-in, the sharing setting is wrong.
5. Make the QR code from the link. Our free QR code generator creates it in your browser; any static generator works. A short link gives a smaller, easier code: a 34-character address fits in a 29 × 29 module code.
6. Test the printed or displayed code on an iPhone and an Android phone before you share it widely.

How each hosting option behaves

There's no single right answer. For a restaurant menu or a product manual, your own website is the most durable: the link lasts as long as your domain. For a one-week event handout, a cloud link with an expiry date is tidy. For anything personal, see the section on private documents below.

Static vs dynamic QR codes

A static QR code contains the URL itself. It costs nothing, needs no account, and never expires on its own. If the URL keeps working, the code keeps working.

A dynamic QR code contains a short URL owned by a QR service, which redirects to your PDF. You can change the destination later and see scan statistics. The costs: every scan goes through that company's server first, the scanner's phone reveals its IP address and browser to it, and the printed code depends on that company staying in business and on your plan staying paid. Some services turn off redirects when a free trial ends. More detail in do QR codes expire.

If you only need to swap the PDF now and then, you usually don't need a dynamic code: keep the URL stable (same file path on your site, or a new version of the same Drive file) and the static code keeps pointing to the latest file.

When the link stops working

The QR code itself is just printed text. It stops working when the address behind it does:

• You delete or move the file, or rename it on a host where the link includes the file name.
• You turn off link sharing, or an admin at your organization limits sharing outside the domain.
• The link reaches its expiry date. Dropbox, for example, disables an expiring link at 11:59 pm on the chosen day in your time zone; OneDrive asks you to create a new link after expiry.
• A dynamic QR plan ends.
• Your domain lapses.

For anything printed in volume, use an address you control, and put a short version of the URL in text next to the code for people who can't scan.

Privacy: what a PDF link gives away

The link is the key. "Anyone with the link" means anyone who scans the code, photographs it, or receives the link in a forwarded message. Codes on posters and handouts travel. Assume the PDF is public.

Passwords help, with limits. A password on a Dropbox or OneDrive link keeps out people who only have the QR code. Microsoft recommends sending the password in a separate message from the link. Don't print the password next to the code.

The file carries metadata. PDFs can include the author's name, the software used, creation dates and, if exported from an editor, comments or hidden layers. Images inside the PDF can carry their own EXIF data, including location; clean photos with the EXIF remover before you put them into the document.

Scanners take a risk too. People are right to be careful with QR codes that lead to downloads. A recognizable domain and a short note next to the code ("Menu, PDF, 2 MB, from example.com") help. Read are QR codes safe to scan for the scanner's side.

Private documents: don't use a public link

A public link is the wrong tool for an ID scan, a medical report, a signed contract or a bank statement. Use something that requires the recipient to sign in or that encrypts the file end to end, and send it to a named person, not to "anyone with the link". Our guide to sharing photos privately compares the options.

If the document is a photo, such as an ID scan or a photographed form, think about the copy you keep too: in the Camera Roll it syncs and shows up in search. Keeping ID documents on your phone in an encrypted sigil. vault is free up to 100 photos and documents per vault.

Bottom line

A QR code for a PDF is a QR code of a link. Host the file at an address you control if the code will be printed, make the link viewable and test it signed out, and prefer a static code. Treat anything behind "anyone with the link" as public, and use a sign-in, a password or end-to-end encryption for documents that aren't meant for everyone.

Sources

• DENSO WAVE: QR Code outline specification (capacity)
• Google Drive Help: Share files from Google Drive
• Google Drive Help: Stop, limit or change sharing (expiration dates)
• Google Drive Help: Check activity and file versions
• Dropbox Help: How to set shared link permissions
• Microsoft Support: Share files and folders in OneDrive
• ZXing project: Barcode contents (URLs)