LadyQR

LadyQR is a privacy-oriented QR code generator, with an optional private link shortener for your own domain, made to run on a minimal shared hosting plan.

You type a link and the QR code appears as you type. You download it as a PNG or a vector SVG. What you type is never sent to a server, and the page loads nothing from outside.

Features

• Instant. The code updates on every keystroke. There is no generate button.
• Private. The code is computed in the browser. A strict Content Security Policy forbids any network request from the page.
• PNG and SVG. A 500 px PNG with one click, a 1000 px PNG or a vector SVG from the menu next to it.
• Made to be scanned. Error correction levels L, M, Q and H, a margin from 0 to 8 modules, and custom colors. A warning appears for low contrast (4:1 or less), for inverted colors (modules lighter than the background), or for both.
• Remembers your settings, nothing else. Error correction, margin and colors are kept in your browser's localStorage. The text you type is never stored. A button resets the settings.
• Optional link shortener. Short links on your own domain, such as https://example.com/menu, managed from a private single-user admin.
• Installs like WordPress. Upload the files, open your site, and a short web installer asks what it needs. No database.
• Own encoder. About 450 lines of JavaScript with no dependencies and no build step. Versions 1 to 40, in the most compact mode for the text: numeric, alphanumeric, or byte mode (UTF-8, so accents and emoji work, up to 2953 bytes at level L).
• Made to be customized. A theme folder with your own CSS, header, footer and head tags, without touching LadyQR's files, so updates keep it. See Customizing the generator page.
• Accessible. High-contrast borders, full keyboard use and screen reader labels. See DESIGN.md.
• Translatable. Translations work like WordPress, with standard .po files. English and Spanish are included.

Privacy and security

• The page is served with this policy, sent as an HTTP header by index.php:

  default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self';
  connect-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'
  

  connect-src 'none' makes the browser refuse any connection from the page, whatever the code tries to do. There are no inline scripts or styles, and no fonts, images or scripts from other sites. You can check it yourself: open the developer tools on the Network tab and type something.

• Only the settings (error correction, margin and colors) are remembered, under the ladyqr-settings key in localStorage. They never leave your browser.

• The live editor on the website has no HTTP headers to send, because GitHub Pages does not allow them. It carries the same policy in a <meta> tag instead.

• Secure without .htaccess. LadyQR does not rely on .htaccess to protect anything. Every PHP file that is not a page stops when it is requested directly, and the configuration and the links are PHP files that print nothing. .htaccess only adds the routing for short links and the rules that force your site's address.

• Not installed means not usable. Until LadyQR is installed, every visit to the site goes to the installer, so a bot cannot find a working site with an open installer and take it over. Install it right after uploading it.

Requirements

• PHP 7.4 or later is the target, with no extensions beyond the default ones. The code has been tested on PHP 8.4 and 8.5.
• A web server that can run PHP. Apache is the target.
• For the link shortener: Apache with mod_rewrite and .htaccess files allowed. Most shared hostings have both. The QR code generator works without them.
• HTTPS is recommended, so the admin's password travels encrypted.
• No database.

The QR code itself needs a modern browser: ES modules, <dialog>, and localStorage (the editor works without it).

Installation

1. Download ladyqr-latest.zip, the latest release. Unzip it on your computer: you get a folder called ladyqr.
2. Upload what is inside the ladyqr folder to your site, by FTP or with your hosting's file manager. It can go in the root of your domain or in a folder of it, such as /qr/.
3. Open your site in a browser. The installer starts by itself and asks for the language of the installer, which components you want (the QR code generator alone, or with the link shortener) and the settings for that choice: the site's language and address, an optional title and description for the QR code page, and for the shortener a user and a password. If you choose the shortener, write down the user and the password it shows at the end; the password is not shown again.

The installer writes ladyqr-config.php (the settings), ladyqr-data.php (the short links) and, if there is none, an .htaccess with the rules that force your site's address. If PHP cannot write in the site's folder, it shows the content of each file for you to create and upload.

Only the QR code generator, with nothing to attack. Instead of using the installer, you can delete the admin folder. Without it there is no installer and no admin: the site is the QR code generator alone.

Updating. Upload the contents of the new zip over your current files. Your settings, your short links and your .htaccess are not in the zip, so they are kept. If you had deleted the admin folder, delete it again. When you next open the admin, it updates LadyQR's rules in .htaccess if the new version needs it.

Installing again. Delete ladyqr-config.php and open your site: the installer starts again. Your short links, in ladyqr-data.php, are kept.

The zip also has an INSTALL.txt with these steps.

This is the beginning of the README. Read the rest at the original. Read the full README ↗