Detailed Scan Tracking
Every scan is logged with real IP address (Cloudflare-aware), city, region, country, ISP, and device type. Geo-data is cached per IP to stay within API limits.
Dynamic QR Codes.
Fully Tracked.
Tuxxin QR Track is a lightweight, self-hosted QR code management system. Create dynamic codes for URLs, WiFi, vCards, maps, and more — then track every scan with real-time geo-location, device detection, and a clean dark-mode dashboard.
Free & open source — self-host on any Linux server with PHP 8.0+ and SQLite.
● URL
● WiFi
● vCard
● Maps
● SMS
● Email
● Phone
● Social
One QR Code. Any Destination.
Print a QR code once and update its destination whenever you need to — no reprinting required. QR Track stores a short redirect UUID on the code itself. The actual destination is managed through your dashboard and can be changed at any time.
- ✓ Update URL, vCard, or WiFi credentials without a new code
- ✓ Enable or disable codes from the dashboard
- ✓ Soft-delete and restore codes from Trash
- ✓ Fixed UUID means printed codes never break
How Dynamic QR Codes Work
- Create a QR code in the dashboard — pick a type, add your content.
- Print or share the generated QR image. The code encodes a short redirect URL.
- Track every scan — who, where, what device, and when.
- Edit anytime. Change the destination without changing the printed code.
Everything You Need to Manage QR Codes
8 QR Code Types
URL, WiFi (WPA/WEP/Open), vCard, Maps, Phone, SMS, Email, and Social Media. Each type generates the correct format with the right redirect or inline content.
Secure by Default
CSRF-protected forms, constant-time API key comparison, HttpOnly session cookies, MIME-validated file uploads, and all sensitive files blocked from web access.
REST API
Full JSON API for creating and retrieving QR codes. Configurable per-IP rate limiting, expiring image tokens, and a built-in Live Console — API key never reaches the browser.
Custom Logo Embedding
Upload a PNG or JPG logo to embed in the center of any QR code.
MIME type is validated server-side via finfo, not file extension.
Trash & Restore
Deleted QR codes are soft-deleted and appear in a Trash view. Restore them at any time with one click — scan history is preserved.
Supported QR Code Types
URL
Redirect scanners to any website. Fully trackable — update the destination at any time.
WiFi
WPA, WEP, or Open networks. Scan to connect instantly — no typing credentials. Not trackable by design.
vCard
Scan to save a contact card directly to the phone’s address book. Name, phone, email, company.
Maps
Open Google Maps to any address or location query. Great for businesses, events, and venues.
Phone
Trigger a phone call to any number. Scan on a mobile device and the dialer opens immediately.
SMS
Pre-fill a text message to a phone number. Useful for support lines, surveys, or contests.
Open a mail app with a pre-filled address, subject, and body. One scan, ready to send.
Social Media
Link to any social media profile or page. Trackable — see how many scans your social links generate.
Security-First Architecture
QR Track v2 was built with security as a primary concern, not an afterthought. Every attack surface has been addressed.
- 🔒 CSRF tokens on all dashboard forms
- 🔒 Constant-time API key comparison (
hash_equals()) - 🔒 API key never sent to the browser (server-side proxy)
- 🔒 API key accepted via header only — no
?api_key=GET param
- 🔒
HttpOnly,SameSite=Strict,Securesession cookies - 🔒 MIME type validation on logo uploads via
finfo - 🔒 SQLite and config files blocked from web access
- 🔒 Per-IP API rate limiting (configurable window & limit)
Why Self-Host?
Most QR code services charge monthly fees, limit scans, and own your data. QR Track runs on your server — you own everything.
No monthly fees
Run on shared hosting, a $5 VPS, or even a home server exposed securely via a Cloudflare Tunnel — no public IP or port forwarding required. No subscription, ever.
Your data, your rules
Scan logs never leave your server. No third-party analytics middlemen.
Unlimited QR codes
Create as many codes as your SQLite database can hold.
Easy install
Clone, composer install, edit config.php — live in minutes.
# Quick Install
$ git clone https://github.com/tuxxin/qr-track.git
$ cd qr-track && composer install
$ mkdir -p ~/db ~/tmp
$ # Edit config.php with your settings
✓ Visit your domain — database auto-initializes
Requirements
Linux
Debian or Ubuntu recommended. Any modern Linux distribution with Apache or Nginx.
PHP 8.0+
With extensions: sqlite3, gd, curl, mbstring, fileinfo.
SQLite 3
No separate database server needed. One file, zero configuration.
Composer
Used to install the chillerlan/php-qrcode library for QR image generation.
Frequently Asked Questions
Yes. QR Track is free and open source under the MIT license. There are no scan limits,
fees, or subscription tiers. You self-host it on your own server or shared hosting.
Dynamic QR codes encode a short redirect URL (e.g.
yoursite.com/p/abc123)
rather than the final destination directly. This means you can update the destination at
any time from the dashboard without reprinting or redistributing the code.
Yes. QR Track logs the IP address, city, region, country, ISP, and device type for
every scan. Geo-data is fetched once per IP (via ip-api.com) and cached in the database.
WiFi QR codes are not trackable by nature — they embed credentials directly and
don’t route through your server.
All API requests require the
Try it in the Live Demo.
X-Api-Key header. You can list all QR codes
(GET /api.php), fetch one by UUID (GET /api.php?uuid=…),
or create a new code (POST /api.php). A full Live Console is built into
the dashboard — the API key is never exposed in the browser HTML.
Try it in the Live Demo.
Yes. Set
USE_CLOUDFLARE_TUNNEL to true in config.php
and QR Track will extract the real visitor IP from X-Forwarded-For /
CF-Connecting-IP headers. It also handles Apple iCloud Private Relay
and other proxy scenarios gracefully.
Ready to take control of your QR codes?
Explore the live demo, then clone the repo and deploy it on your own server in minutes.