QR Codes in Mobile Apps: 8 Use Cases + iOS & Android Setup
Commodity guide to QR codes in mobile apps: definition, 8 real use cases (payment, login, menu, ticketing), 8 famous implementations, scanning APIs by platform, and zero-code setup.
A QR code is a two-dimensional barcode that stores a URL, text, payment instruction, or app deep link, scannable by any modern phone camera. Mobile apps use QR codes for payments (WeChat Pay, Venmo, Alipay), restaurant menus (Uber Eats, Starbucks), event tickets, contactless login, contact sharing (Snapchat Snapcodes), and Wi-Fi connection. This guide from Appy Pie AI covers what QR codes are, the 8 main use cases for mobile apps, 8 famous implementations, the iOS vs Android scanning APIs you should know, and the no-code path to add scan + generate to your app without writing camera-handling code.
What You Will Learn
- Plain-English definition of QR codes
- 8 use cases (payment, login, menu, ticketing, etc.)
- 8 famous implementations (WeChat, Venmo, Spotify)
- iOS vs Android scanning APIs
- Generate + scan without writing code
- 8 QR mistakes that erode trust
Backed by Apple AVFoundation documentation, Android CameraX + ML Kit barcode scanning APIs, Statista QR Code Usage Report 2026, EMVCo QR Payment specifications, and platform data from 10M+ apps built on Appy Pie AI. Rated 4.7/5 on G2 from 1,388 reviews.
Build Your App With QR Built InTL;DR Quick Summary
A QR (Quick Response) code is a 2D barcode that stores up to 4,296 alphanumeric characters, scannable by any modern phone camera. Mobile apps use QR codes for 8 main jobs: payment (WeChat, Venmo), login (no password typing), menu access (Starbucks, Uber Eats), ticketing (event entry), contact sharing (Snapchat Snapcodes, Spotify Codes), Wi-Fi joining, AR launchers, and deep-linking to in-app content. Scanning is built into iOS Camera and Android Google Lens since 2017-2018, plus available via AVFoundation (iOS) and ML Kit Barcode Scanning (Android) for in-app cameras. Generation is trivial server-side (qrcode libraries) or via free generators. The complexity is in the trust layer: scammers slap fake QR codes over real ones, redirecting payments to attacker wallets. This guide covers both the use cases and the mistakes.
Table of Contents
Jump to any section. This guide defines what QR codes are technically, walks through the 8 main use cases for mobile apps, profiles 8 famous implementations from WeChat Pay to Spotify Codes, breaks down iOS vs Android scanning APIs, shows the no-code path to ship both scan and generate, and ends with the 8 mistakes that erode user trust including QR-scam vectors.
What is a QR Code? (Plain Definition)
A QR (Quick Response) code is a two-dimensional barcode invented by Denso Wave in 1994 for tracking automotive parts. Unlike a traditional one-dimensional barcode that encodes ~20 numeric characters, a QR code can store up to 4,296 alphanumeric characters or 7,089 numeric characters in a square grid of black and white modules. The encoding includes error correction (Reed-Solomon coding) that lets the code remain scannable even when 7-30% of the grid is damaged, obscured, or has a logo placed over the center.
The simplest way to picture it: a QR code is to URLs what a barcode is to product SKUs, but with a thousand times more capacity and a built-in error-correction layer. Print a QR code on a poster, table tent, business card, or product label. Anyone with a smartphone camera can decode it in under a second.
The four core pieces of every QR-enabled app feature
1. The QR code itself. A static image (PNG, SVG) generated by a library that takes input (URL, text, JSON, EMV payment payload) and outputs the grid. Generation is computationally trivial; even a microcontroller can produce one.
2. The scanner UI. An in-app camera view with a focused viewfinder area and overlay graphics. iOS uses AVFoundation, Android uses CameraX + ML Kit Barcode Scanning, cross-platform frameworks (React Native, Flutter) wrap both.
3. The decoding step. The camera frame is sampled, the QR pattern is detected, error correction is applied, the payload is extracted. iOS Camera app and Android Google Lens do this automatically; in-app cameras require an SDK call.
4. The action. What the app does with the decoded payload: open URL, prefill a payment form, log the user in, route to a specific in-app screen via deep linking, save a contact, join a Wi-Fi network.
Three things that look like QR codes but are not
- Data Matrix codes: Smaller 2D barcodes used in pharmaceutical packaging and electronics. Similar concept; different encoding spec. Most phone cameras now decode both.
- Aztec codes: Used by airlines for boarding passes. Bullseye-style center pattern. Different spec.
- PDF417: Used by US driver’s licenses and shipping labels. Stack-of-bars pattern. Different spec.
For app development purposes, “QR code” almost always means the ISO/IEC 18004 standard you see on payment posters and restaurant menus. The other 2D formats exist but are rare in consumer apps.
What QR codes do NOT do
- Carry executable code. A QR code is data, not a program. It can carry a URL that opens an app, but the app does the work.
- Verify the source. Anyone can generate a QR code that opens any URL. The URL itself must enforce trust (HTTPS + signed payment payloads + domain verification).
- Work without a camera. Some accessibility users have difficulty with QR scanning. Always provide an alternative (manual code entry, text link, NFC tap).
Why QR Codes Belong in Modern Apps
QR codes were a niche tool in the West until 2020. Post-pandemic, they became the expected entry point for menus, payments, ticketing, and contact sharing across every demographic. The data is striking.
Three business outcomes QR codes drive
1. Reduced friction at the entry point. User sees a real-world surface (poster, table tent, business card, package label). One scan, they are in your app at the right screen. No typing, no searching, no manual download flow if combined with App Store smart banners.
2. Cross-channel attribution. Each printed QR can encode a unique campaign ID (UTM parameters or custom token). You can measure exactly which poster, which table, which mailer drove which install or conversion. Far better than “saw billboard, eventually searched” attribution.
3. Contactless transactions and authentication. Payment QRs (EMVCo standard) let users pay without entering card data. Login QRs let users authenticate on desktop by scanning with their phone. Both flows are faster and more secure than the keyboard alternative.
Where QR codes are still controversial
- Restaurant menus: Some diners prefer printed menus; QR-only menus exclude them. Hybrid approach (print + QR option) is the safe path.
- Accessibility: Users with visual impairments cannot reliably scan QR codes. Always offer alternatives (NFC, manual code entry, voice command).
- QR scams: Fake QR codes pasted over real ones in parking meters, payment posters, and EV chargers redirect funds. Trust must come from the URL behind the code, not the code itself.
For most app use cases (login, deep-link from offline channels, payment, sharing), the benefits outweigh the friction. Skipping QR support in 2026 means missing the default behavior of an increasing majority of mobile users.
8 QR Use Cases in Mobile Apps
Eight patterns cover most QR uses in consumer and B2B apps. Pick based on what real-world surface or flow you are connecting to your app.
1. Mobile payments
The most-used QR use case globally. Merchant displays a QR, customer scans, payment app opens with merchant ID prefilled. Standardized by EMVCo (the same body behind chip cards) since 2017.
2. Login and authentication
Desktop login flow: web page shows a QR, user scans with their already-logged-in mobile app, desktop is authenticated without typing a password. Used by WhatsApp Web, Telegram, Steam, Discord, banking dashboards.
3. Restaurant menus and ordering
Table tent with QR opens the menu in-browser or in-app. Some apps integrate order placement and pay-at-table; user never raises a hand for the server.
4. Event tickets and boarding passes
Concert ticket, flight boarding pass, festival entry, sports event. The QR encodes a signed ticket ID that staff scanners verify against the booking database. Replaces physical tickets entirely.
5. Contact and profile sharing
Business cards, profile QR codes (Snapchat Snapcodes, Spotify Codes, LinkedIn, TikTok), and “scan to add me” flows. Encodes a contact vCard or a profile URL.
6. Wi-Fi connection
QR encodes the SSID + password in a standardized format. Scanning auto-joins the network without typing the password. Standard since Android 10 / iOS 11.
7. AR experiences and product launchers
Print ad or product packaging carries a QR. Scanning launches an AR experience (3D model overlay, brand storytelling, in-place visualization). Native to iOS Quick Look and Android ARCore Scene Viewer.
8. Deep linking to in-app content
Print or physical marketing carries a QR that opens a specific app screen via deep link (Universal Links on iOS, App Links on Android). With deferred deep linking, the QR can route users through install first.
How to pick a use case combo
Consumer/retail app: Payment + login + deep-link to product. Three covers 80% of value.
Hospitality/restaurant: Menu + order + pay-at-table. The post-pandemic default stack.
Events/ticketing: Ticket + boarding pass + Apple/Google Wallet integration. Standard combo.
Social/creator: Profile sharing + follow + content deep-link. Mimics Snapchat Snapcodes.
B2B/internal tools: Desktop login + 2FA + Wi-Fi join. Productivity boost for distributed teams.
8 Famous QR Implementations
Eight well-known apps with documented QR strategies. Each takes a different angle on the same primitive.
WeChat Pay
Venmo
Alipay
Spotify Codes
Snapchat Snapcodes
Apple Pay Scan to Pay
Starbucks
Uber Eats Pickup
The common thread: QR codes work best when they connect a real-world surface to a specific app screen with zero typing. Payment is the highest-stakes use; ticketing and login are the most universal; menu and pickup are post-pandemic standards. The “branded QR” trend (Snapcodes, Spotify Codes) made QR codes part of brand identity, not just utility.
iOS vs Android Scanning APIs
Both platforms ship native QR scanning in the OS camera app. For in-app scanners, both expose mature SDKs. Here is the side-by-side.
| Capability | iOS | Android |
|---|---|---|
| Native OS camera scan | Camera app since iOS 11 (2017) | Google Lens since Android 8 (2017) |
| In-app scanner SDK | AVFoundation (AVCaptureMetadataOutput) | ML Kit Barcode Scanning |
| Supported barcode formats | QR, EAN, UPC, Code 128, PDF417, Aztec, Data Matrix | QR, EAN, UPC, Code 128, PDF417, Aztec, Data Matrix |
| Permission required | Camera (Info.plist usage description) | Camera (runtime permission) |
| Setup complexity (in-app) | Medium (~50 lines Swift) | Medium (~80 lines Kotlin) |
| Cross-platform wrappers | react-native-camera, expo-barcode-scanner | react-native-camera, expo-barcode-scanner |
| Generation library (server-side) | CoreImage CIFilter (CIQRCodeGenerator) | ZXing, qrcode (Python/Node/Go libraries) |
| Battery cost of continuous scan | ~15-20% per hour | ~12-18% per hour |
| Universal Links deep-link support | Yes | Yes (App Links) |
Practical iOS notes
For most apps, you do not need an in-app scanner if you can rely on the OS Camera. Print a Universal Link QR (e.g. https://yourdomain.com/p/abc123); user scans with Camera app; OS opens your app to the right screen. No code in your app. Use the in-app scanner only when the OS Camera path does not suit (e.g. you need continuous scanning, custom UI, or payment-flow specific UX).
Practical Android notes
Same logic with App Links. Google Lens decodes QR codes natively. For in-app scanners, ML Kit Barcode Scanning is the recommended path, faster and more accurate than older ZXing-based libraries. It also handles low-light and tilted codes well, which matters for restaurant table QR codes at angle.
The deferred-deep-link case
If the user does not have your app installed when they scan a QR, the OS opens the URL in the browser. Use deferred deep linking (Branch, AppsFlyer, Adjust) so that after the user installs your app from the App Store / Play Store, the original QR context is preserved and they land on the intended screen instead of the home screen.
QR Generation Libraries
Generating QR codes is computationally cheap and available in every language. Here are the standard libraries.
Server-side generation (recommended)
- Node.js:
qrcode(npm). Outputs PNG, SVG, base64, or terminal ASCII. Most common choice. - Python:
qrcode[pil]orsegno. Both produce PNG/SVG. - Go:
github.com/skip2/go-qrcode. Single binary, no dependencies. - PHP:
endroid/qr-code. Standard for WordPress and Laravel use. - Ruby:
rqrcode. - Java/Kotlin:
ZXing. Industry standard. - Swift:
CoreImage CIFilter("CIQRCodeGenerator"). Native iOS, no dependency.
Client-side generation (browser)
For showing a personal QR (Venmo-style) inside the app from already-known data:
- JavaScript:
qrcode.jsorqrious. Renders to canvas or SVG. - React:
react-qr-codeorqrcode.react. - Flutter:
qr_flutter. - React Native:
react-native-qrcode-svg.
Free hosted generators (no-code paths)
For one-off marketing or business cards: qr-code-generator.com, qrcode-monkey.com, qrickit.com. Use only for non-sensitive content; never paste payment payloads or auth tokens into third-party generators.
Error-correction levels (pick wisely)
- L (Low) ~7%: Smallest code, no logo placement. Good for clean printed environments.
- M (Medium) ~15%: Industry default. Good balance of size and durability.
- Q (Quartile) ~25%: Used when you want to place a logo (up to 25% of grid).
- H (High) ~30%: Maximum tolerance to damage. Use for outdoor or sticker applications.
For most app QRs (payment, login, deep-link), error-correction level M is the default. Higher levels make the code larger; lower levels make it more fragile.
How to Add QR Without Coding
For custom-coded apps, adding QR requires AVFoundation permissions and scanner UI on iOS, CameraX + ML Kit Barcode Scanning integration on Android, server-side generation with a library like qrcode, deep-link routing, and a fallback for users without camera permission. That is 1-2 weeks of engineering for first pass. No-code platforms expose both scan and generate as feature modules. Here is the flow on the Appy Pie AI App Generator.
Create your account. The platform’s app builder ships with QR scanner + QR generator modules pre-configured: AVFoundation on iOS, ML Kit on Android, server-side generation, and deep-link routing all included with no SDK integration on your part.
Confirm your email. The AI takes your business category (retail, restaurant, events, productivity) and pre-selects appropriate QR use cases: payment + deep-link for retail, menu + order for restaurant, ticket + entry for events.
Describe your use case in plain English (“Coffee shop with order-ahead and loyalty points”). The AI maps it to a feature stack: QR-on-receipt for loyalty, QR-on-menu for order, QR-on-payment-screen for tap-to-pay. Each feature is individually toggleable.
The AI confirms the full QR stack: native iOS scanner via AVFoundation, native Android via ML Kit, fallback web scanner for PWA, server-side QR generation for outbound QR codes (receipts, tickets, profiles). Camera permission UX (rationale + soft prompt) is configured automatically.
The platform exposes a live QR code for your test build. Scan it with another phone; the app opens to the test screen. Generate sample receipt/ticket QRs from the admin dashboard. Verify the full flow before publishing to iOS, Android, and PWA.
What used to be 1-2 weeks of dual-platform camera SDK integration (AVFoundation scanner UI, ML Kit setup, server-side generation, permission UX, deep-link routing, deferred install flow) is now configured automatically. The platform handles every quirk and you focus on which QR use cases your app needs.
8 QR Mistakes That Erode Trust
The QR mistakes we see most often, drawn from analyzing thousands of apps on the Appy Pie AI platform plus public QR-scam reports from law enforcement and security researchers.
Not verifying the URL behind the QR
App’s QR scanner opens any URL the code contains, including phishing or malware sites. User trusts the app, app trusts the code, code wasn’t trusted. Especially dangerous in payment apps.
No camera permission rationale
App requests camera permission on first launch with the generic OS dialog. User has no context why; denies. Now the QR scanner doesn’t work and they don’t know why.
Generating low-contrast or undersized QR
Designer overrides default colors to match brand (light blue on white). Scan rate drops 60%+. Or QR is too small (
QR-only without text alternative
Restaurant has QR-only menu. User without smartphone or with broken camera can’t see the menu. Same for QR-only payment; users without working camera can’t pay.
Static QR for dynamic content
QR encodes a hardcoded URL. The destination page later changes URL structure; QR breaks. Or QR encodes a campaign ID that you can’t change without reprinting all materials.
Ignoring QR-overlay scam vectors
Public payment QRs (parking meters, EV chargers, restaurant tables) are targets. Scammers print a fake QR with their wallet ID, paste it over the real one. Payments flow to attacker.
Logo too large in the center
Marketing places a 40%+ logo overlay on the QR. Error correction can only tolerate ~30% damage. Code becomes unscannable for many cameras.
No analytics on QR scans
You print 50,000 QR codes across 20 campaigns. No way to tell which channel performed best. Marketing budget allocated on guesswork.
QR Scan + Generate, Pre-Configured. Zero Code.
Appy Pie AI App Generator ships native iOS + Android QR scanning, server-side QR generation, camera permission UX, and deep-link routing in every app it builds. Skip the 1-2 weeks of camera-SDK setup.
Try AI App Generator App BuilderFrequently Asked Questions
What is a QR code?
A QR (Quick Response) code is a 2D barcode invented by Denso Wave in 1994 that can store up to 4,296 alphanumeric characters in a square grid of black and white modules. Modern smartphones decode QR codes natively via the camera app (iOS Camera since iOS 11, Android Google Lens since Android 8).
How do I scan a QR code on iOS?
Open the iOS Camera app, point at the QR code, wait 1-2 seconds. A notification appears with the decoded URL or action. Tap to open. No third-party app required. For in-app scanning, developers use AVFoundation’s AVCaptureMetadataOutput.
How do I scan a QR code on Android?
Open the Camera app or Google Lens, point at the QR code, decoded result appears as an overlay. On some Android versions, you may need to enable “Suggested actions” in Camera settings. For in-app scanning, developers use Google ML Kit Barcode Scanning.
Can QR codes be used for payments?
Yes, extensively. WeChat Pay, Alipay, Venmo, Cash App, PayPal, and Apple Pay all support QR-based payments. The EMVCo standard defines the secure payload format for merchant payment QRs. Asia (China, India) leads global QR payment volume; the US and EU adopted it post-pandemic.
Are QR codes safe?
QR codes themselves are safe, but the URL behind them may not be. Scams include fake QR overlays on parking meters or restaurant tables that redirect payments to attacker wallets. Best practices: verify the URL/merchant name BEFORE confirming any action. Use only HTTPS URLs. For payments, validate the merchant ID against your app’s known-good list.
How much data can a QR code hold?
Up to 4,296 alphanumeric characters, 7,089 numeric characters, or 2,953 bytes of binary data. Most app uses (URLs, payment payloads, vCards) fit easily in a small QR. For longer payloads, consider storing data server-side and encoding only a short ID in the QR.
Can I put a logo in the middle of a QR code?
Yes. QR codes have built-in error correction (Reed-Solomon) that lets them remain scannable when up to 30% of the grid is obscured. Keep your logo under 20% of the QR’s total area and use error correction level H. Always test on multiple device cameras before printing.
What is the difference between static and dynamic QR codes?
Static QR codes encode a hardcoded URL or payload that cannot be changed without regenerating the QR. Dynamic QR codes encode a short redirect URL (yourdomain.com/q/abc) whose destination can be updated in your admin without reprinting. Use dynamic QRs for marketing materials so you can change the landing page over time.
How do I track QR scans?
Encode unique UTM parameters or a campaign ID per QR variant. Server-side, log each scan with the QR ID, timestamp, user agent, and downstream conversion. Compare scan counts and conversion rates across campaigns. Most marketing platforms (Google Analytics, Mixpanel, Amplitude) handle this if you tag URLs correctly.
Do QR codes work without internet?
Scanning a QR code does not require internet (the decoding is local). But the action behind it usually does: opening a URL, processing a payment, joining Wi-Fi all need network. For offline use cases, encode the actual data (vCard contact info, plain text, Wi-Fi credentials) directly in the QR rather than a URL.
What’s the best free QR generator?
For non-sensitive content: qr-code-generator.com, qrickit.com, qrcode-monkey.com all work. For production use, generate server-side with a library (qrcode npm package, Python qrcode, Go go-qrcode). Never paste payment payloads or auth tokens into third-party generators.
How long does QR support take to add to an app?
Custom-coded with AVFoundation (iOS) + ML Kit (Android) + server-side generation + deep-link routing: 1-2 weeks for first pass. No-code platforms like Appy Pie AI ship QR scanner + generator in every app with no additional setup.
QR Codes Are the Default Real-World-to-App Bridge.
The fundamentals are simple. Use QR for payment, login, menu, ticketing, sharing, Wi-Fi join, AR launchers, and deep linking. Both iOS Camera and Android Google Lens decode natively; in-app scanners use AVFoundation (iOS) and ML Kit (Android). Generate server-side with a small library; use dynamic QR (redirect URL) so you can update destinations without reprinting. Verify the URL behind every scanned QR before acting; warn on suspicious domains. Keep logos under 20% of the QR; use error correction level M for most cases, H if you need durability. Test on multiple devices before going to print. Avoid the trust mistakes: tamper-evident stickers, signed payment payloads, fallbacks for users without working cameras. Build smarter with our complete app creation guide or check our deep linking guide for the routing layer behind app QRs.
Build Your App With QR →
Aasif Khan
Head of SEO and Growth Marketing Lead at Appy Pie AI with 17+ years of experience in digital marketing, AI-powered optimization, and scalable growth strategies. Specializes in SEO, Generative AI optimization, marketing automation, SEM, CRO, and performance-focused content strategy.
Abhinav Girdhar
Founder and CEO of Appy Pie AI. Builder of one of the world’s largest no-code and AI app platforms, with 10M+ apps and websites created on the platform. Reviewer of editorial guides covering AI app builders, QR code use cases, and product strategy.
QR Handled. You Build the App.
Appy Pie AI App Generator ships native QR scanning (iOS + Android), server-side QR generation, camera permission UX, and deep-link routing in every app. Skip the SDK plumbing.
Build My App With AI4.7/5 on G2 with 1,388 reviews | 10M+ apps built since 2016