Self-host your own QR code generator

OpenQR's generator is open source under AGPL-3.0, and it ships as a prebuilt Docker image: ghcr.io/open-qr/openqr. One route, one container, no database, no environment variables, no secrets: the generator runs entirely in the browser, so the server is a static file host with a Node heartbeat. Deploy it with a button, a docker run, or from source.

Why OpenQR is open source at all

A QR code is an open standard that costs nothing to generate, so charging for the generation itself always required an artificial scarcity: a watermark, a size cap, an expiry. OpenQR takes the position that the generator belongs in the open, where its privacy claims can be checked line by line, and that the paid layer should be the genuinely costly part: editable codes, scan analytics and automation on openqr.uk. If OpenQR disappears, your generator does not: the tool is yours to run. The full reasoning is on the open source page and why OpenQR is free.

Standing on the shoulders of giants

OpenQR's generator is a thin layer over other people's open work, and it would be dishonest to pretend otherwise. The QR rendering is qr-code-styling (MIT). The app stands on Next.js and React (MIT), Radix UI (MIT), lucide-react (ISC), zustand (MIT), Leaflet and react-leaflet (BSD-2 and MIT), jspdf and svg2pdf.js (MIT), and Tailwind CSS (MIT), with the Poppins typeface under the SIL OFL. The full list with licences lives in the repository's NOTICE file. We open sourced our layer for the same reason those libraries exist: because the next builder should start from our shoulder, not from zero.

When self-hosting is genuinely necessary

Honesty first: the hosted generator at openqr.uk is already fully client-side. What you type never leaves your browser there either, so for most people self-hosting changes the logo on the tab, not the privacy. The reasons that survive that test:

First-party instead of third-party. Some policies (and some clients, and some auditors) require that staff tools run on infrastructure the organisation controls. A first-party generator means no third party processes anything, by construction, and the whole story is one sentence long in the audit.
Air-gapped and restricted networks. Factories, hospitals, research ships: networks that cannot reach the public internet at all still need QR codes, and the generator needs no internet to make them.
Embedding and internal tools. The Generator component is embeddable, and running your own instance gives it a stable, internal origin to live on.
Longevity and volume. Your instance cannot be sunset, rate-limited or repriced, because it is yours.

One more honest line: the map-based Location tool fetches map tiles from CARTO and address lookups from OpenStreetMap's Nominatim, from the visitor's browser. Self-hosting does not change that; on a truly air-gapped network the Location tool is the one feature that degrades.

Which path fits you?

Three questions; the recommendation below updates as you answer. Every tab stays one click away.

Where will it run?

How do you feel about Docker?

Why are you self-hosting?

The button opens DigitalOcean's App Platform wizard with our app spec pre-loaded (.do/deploy.template.yaml in the repo): one web service, built from the repository, serving on port 3000. First build takes a few minutes. You will need a DigitalOcean account; the smallest instance runs it comfortably.

After it deploys: point a domain at the app for automatic HTTPS, and redeploy from the dashboard when you want a newer build. Instance sizing and current pricing live on DigitalOcean's pricing page.

Other managed platforms

Same image, same repo, one line each: Deploy to Render (blueprint from the repo; Render's free tier sleeps, assume a paid instance) or Deploy to Koyeb (pulls the published image directly, no repo build).

The image

Registry and tags: ghcr.io/open-qr/openqr, published on every release tag. latest tracks the newest release; pin a version in production.
Architectures: linux/amd64 and linux/arm64: x86 servers, Raspberry Pis, ARM cloud instances. One manifest list, docker pull picks the right one.
Hardening: Non-root user, tini as PID 1 for clean shutdown, a built-in healthcheck on port 3000, and no network calls at runtime.
Licence inside the box: AGPL-3.0. The LICENSE and NOTICE files ship in the image, and the source for every build is the public repository.

AGPL-3.0 in four sentences

Run an unmodified copy: nothing asked of you, ever, including commercially.
Modify it for internal use: still nothing asked, the code can stay private.
Offer a modified version as a network service: offer its source to its users under AGPL too.
The QR codes it generates are yours: data, copyright, everything.

A plain-English walkthrough of these points, including the trade-offs of self-hosting at all, is in the self-hosting guide. If you want the editable codes and scan analytics instead of running your own, the hosted version is the same generator with an account layer.