Yes. In our test, the ClueTrove QR Code Generator encoded text exactly as typed: spaces, newlines, tabs, Arabic and emoji all went in untouched.
Links with a scheme other than https (like http:// or ftp://) get a note. Text starting with javascript:, data: or vbscript: gets a warning. In both cases the code is still created.
The short answer
These results come from our test of build 1.6.4:
- Nothing is trimmed. Spaces at the start or end, newlines and tabs go into the code as typed. Delete what you do not want before you create the code.
- Non-Latin text is kept. Arabic, emoji, accented Latin and Japanese were encoded as UTF-8 and decoded back byte for byte.
- Empty input is refused. An empty or whitespace-only field (as JavaScript trim() defines it) shows “Enter some text or a link first.” and makes no code.
- Some links get a note. After trimming, text of the form scheme:// with a scheme other than https shows “Note: the link does not start with https://; check that it is the right address.” The code is still made.
- Some text gets a warning. Text starting with javascript:, data: or vbscript: gets a warning. The code is still made, and the tool encodes the text without running or opening it.
How do I create a code and check what it holds?
- Type or paste your text into the Text or link field.
- Select Create code.
- Read the Encoded content: line under the code. It shows the exact text that went in.
- If you see “Note: the link does not start with https://; check that it is the right address.”, confirm the address is the one you meant.
- If you see the warning about javascript:, data: or vbscript:, use the code only if you know what the text does.
- Select Download PNG or Download SVG to save the code.
The tool also has a Start over button. Under the code, a line states the PNG size. For the Arabic test sentence below, it stated a 1024×1024 pixel PNG with 24-pixel modules.
Which mistakes should I avoid?
- Pasting with a stray newline. A trailing newline from a copied line goes into the code. Check the Encoded content line.
- Ignoring the not-https note. An http:// address may be a typo or an old link. Confirm it before you print.
- Treating the warning as protection. It is a warning, not a block. Some disguised spellings get no warning at all (see below).
- Skipping a scan test. We read codes with software only. Test your code with a real phone before you print many copies.
What is a scheme, and how do QR codes hold text?
Both messages depend on the scheme, the first part of a link. Under RFC 3986, the generic URI syntax, every URI begins with a scheme name, and a colon separates it from the rest. The same standard says a scheme name starts with a letter, followed by letters, digits, “+”, “.” or “-”. Scheme names are case-insensitive, and lowercase is canonical.
The example URIs in RFC 3986 include the schemes http, mailto and tel, such as mailto:John.Doe@example.com and tel:+1-816-555-1212. RFC 2397 defines the “data” URL scheme, which carries small data items inside the URL, for example data:,A%20brief%20note. MDN Web Docs describes javascript: URLs as URLs that use the javascript: scheme. For vbscript:, we found no source that names it as a defined scheme. Text beginning with “vbscript:” simply has the scheme-plus-colon form that RFC 3986 describes.
On the QR side, the ISO/IEC 18004:2006 QR Code standard defines a Byte mode that encodes data at 8 bits per character. By default, byte data is read as ISO/IEC 8859-1. The standard’s Extended Channel Interpretation (ECI) protocol allows another character set. Our test showed only that both software decoders read the tool’s UTF-8 bytes back. DENSO WAVE’s QR Code standardization page lists “8-bit bytes (binary)” as one data type, with a maximum of 2,953 characters. That maximum applies to the largest symbol, not to what this tool accepts.
What did our test show?
These are results of ClueTrove’s own test of its QR Code Generator, build 1.6.4, run on 2026-10-08.
- Where it ran: a local copy of the live static files fetched that day. The live pages were not used in a browser.
- Browser: headless Microsoft Edge 154.0.4258.62 on Windows.
- Inputs: synthetic only, on both the English and the Arabic page.
- Readers: two independent software decoders, jsQR 1.4.0 and zxing-cpp 3.1.1. No phone scan was done.
Spaces, new lines and tabs
We tested three inputs: https://example.com with two spaces on each side, the same address followed by a newline, and two newlines followed by the address. Each produced a 25×25 code. Both decoders returned the exact text, spaces and newlines included. “line1”, a newline and “line2”, and “a”, a tab and “b”, decoded with the newline and tab kept. The Encoded content line showed the same text.
Arabic, emoji and other scripts
We tested Arabic text (“مرحبا”), an Arabic sentence with a URL (“زورونا: https://example.com”), one emoji and two emoji, accented Latin (“Café Zürich ñ”) and Japanese text. All were encoded as UTF-8, and both decoders read them back byte for byte. The English and Arabic pages gave the same outcome. An Arabic sentence with an emoji produced a 33×33 code, and the Encoded content line repeated the text.
Empty input
These inputs were refused with “Enter some text or a link first.”, and no code was created: an empty field, spaces only, newlines only, a tab only, a no-break space only, and a byte-order mark (U+FEFF) only. One input was not refused: a single zero-width space (U+200B) created a 21×21 code.
When does the not-https note appear?
The note appeared for http://example.com, HTTP://EXAMPLE.COM, the same with leading spaces, ftp://files.example.com/a.txt and file:///c:/test.txt. The code was still created each time.
No note appeared for https://example.com, HTTPS://EXAMPLE.COM, example.com (no scheme), http:example.com (no slashes), mailto:test@example.com, tel:+15555550100 and WIFI:T:WPA;S:name;P:pass;;.
The rule in the tool’s code: after trimming, the text matches the form scheme:// and the scheme is not https, ignoring capitalization.
What does the javascript:, data: and vbscript: warning cover?
We tested 13 spellings of text starting with these schemes, with different capitalization and a leading space, newline or tab. Examples: javascript:alert(1), JAVASCRIPT:alert(1), data:text/html,hello and vbscript:msgbox(1).
For all 13, the tool showed exactly: “Warning: the text starts with javascript:, data: or vbscript:. Some apps may run code or open embedded content when the code is scanned; use it only if you know what it does. This tool does not run or open it; it only encodes it as text.” The code was still created, Download PNG and Download SVG stayed enabled, and both decoders returned the exact text.
Does the tool run the text?
No. We ran 65 inputs on each of the two pages, 130 runs in total. They included javascript:alert(1), data:text/html with a script tag, and img onerror payloads. Across all runs we recorded:
- 0 dialogs and 0 popups
- 0 blocked requests
- 0 uncaught page errors
- 0 navigations
The payloads tried to set a marker variable, and it was never set. No img, script or svg element appeared in the output area, and the Encoded content line showed plain text. A script tag that does not start with one of the three schemes got no warning and was encoded as text.
What slips past the warning?
These near-miss inputs got no warning and were encoded as typed: https://example.com/?u=javascript:alert(1), the single word javascript, mydata:xyz, database:1 and blob:https://example.com/1234.
Some disguised spellings also got no warning and were still encoded:
- “java”, a tab, then “script:alert(1)”
- “java”, a newline, then “script:alert(1)”
- U+0001 or a zero-width space before “javascript:”
- a space before the colon
- the HTML entity form of the colon
- “javascript:” with a Cyrillic “а” in place of the Latin “a”
We did not test whether any scanner app or URL parser treats these as scripts. They are possible gaps in the warning, not shown exploits.
What are the limits?
- Text is encoded exactly as typed (UTF-8). Nothing is trimmed. Whitespace-only input is refused, and no code is made.
- The not-https note is only a note. Text starting with mailto:, tel: or WIFI: gets none.
- The risky-scheme warning is only a warning. It checks for javascript:, data: or vbscript: at the start, after trimming, ignoring capitalization.
- It does not cover every spelling. A tab inside the word, or a control character before it, is not flagged.
The two decoders differed on size. In a test of 320 downloaded PNGs, zxing-cpp 3.1.1 read 320 of 320 and jsQR 1.4.0 read 312 of 320. All 8 files jsQR missed were version-23 codes (109 x 109 modules), and zxing-cpp read them. That compares two software decoders on valid files. It does not show how phones behave.
Not covered: phone or scanner-app scans, printing, other browsers and real phones, scuffs, glare, distance or lighting, screen readers, live-site HTTP headers, repeat runs, and what scanner apps do with javascript:, data: or vbscript: text.
Related tools
To make a code and see exactly what it holds, open the ClueTrove QR Code Generator. Before you download, check the Encoded content line and any note or warning.
Questions and answers
Does the QR code generator remove spaces from my text?
No. Spaces and newlines at the start and end were kept, and both decoders returned them. Delete them before you select Create code if you do not want them.
Can I make a QR code with Arabic text or emoji?
Yes. Arabic, emoji, accented Latin and Japanese text were encoded as UTF-8 and decoded back byte for byte by two software decoders. Do a real phone scan before printing.
Why does it say the link does not start with https://?
The text, after trimming, has the form scheme:// with a scheme other than https, such as http:// or ftp://. It is only a note, and the code is still created. Check the address and switch to https:// if the site supports it.
Does the tool block a QR code containing javascript:?
No. It shows a warning and still creates the code. In our tests it never ran the text.
Does the warning catch every disguised spelling?
No. A tab inside the word, a control character before it, or a Cyrillic letter in place of a Latin one got no warning. Do not rely on the warning to vet text from others.
