SMS QR Code Generator

Three competing formats, and why that is your main problem#

SMS is the QR payload type with the worst standards story. There is no single URI scheme that every device honours, and the differences are not cosmetic — pick the wrong one and the message body silently disappears on half your audience.

Three formats exist in the wild:

SMSTO:+442079460018:Text JOIN to enter
sms:+442079460018?body=Text JOIN to enter
sms:+442079460018&body=Text JOIN to enter

SMSTO: is the original format from NTT DoCoMo's specification, and it has the broadest reliable support across QR scanner apps. It is not a registered URI scheme, so it works by scanner convention rather than by operating system handling — which in practice means the scanner app parses it and constructs the message itself.

sms: with ?body= is the RFC 5724 standard. It is handled by the operating system rather than the scanner, and works correctly on modern Android and current iOS.

sms: with &body= is the historical iOS variant. Older versions of iOS ignored ?body= and required an ampersand, which is invalid per the RFC but was the only thing that worked on those devices for years. You still see it recommended in older documentation.

The practical guidance: use SMSTO: when the code will be scanned by a general audience with unknown devices, which is most printed material. It is the format the generator above produces for that reason.

Test the body field, always#

Whichever format you use, the recipient number is the reliable part and the message body is the fragile part. Some scanner apps open the messaging app with the number filled and the body empty. Some open a compose screen with both. A few show the raw string and let the user copy it.

This has a design consequence that matters more than the format debate: never depend on the pre-filled body being there. If your campaign is "scan this and text us to enter," the user who arrives at an empty compose window has no idea what to type. Print the keyword next to the code — "Scan to text us, or send JOIN to 60777" — and the code becomes a convenience rather than a single point of failure.

Number formatting#

Use E.164 for the recipient: +, country code, subscriber number, no spaces or punctuation. +442079460018, not 020 7946 0018.

The one common exception is short codes — the five- or six-digit numbers used for campaigns and alerts, like 60777. These are national by definition, have no country code, and must be written bare. A short code will not work for anyone roaming on a foreign network, which is worth knowing before you print it on material at an international airport.

Keeping the code light#

SMS payloads sit in the middle of the density range. The number is short; the body is what costs you.

Note that the body counts toward QR capacity, not toward the 160-character SMS limit — those are separate budgets. A pre-filled body longer than about 80 characters is usually a sign that the content belongs on a web page rather than in a text message.

The 160-character question#

A single SMS carries 160 characters in the GSM 7-bit alphabet. Exceed that and the message is split into concatenated segments of 153 characters each, which the recipient's phone reassembles — and which the sender may be billed for separately.

Two things silently blow this budget:

• Non-GSM characters. Curly quotes, em dashes, the euro sign in some encodings, and any emoji force the message into UCS-2 encoding, which drops the limit from 160 characters to 70. A single emoji in a pre-filled body can turn a one-part message into three.
• Accented characters outside the GSM extension set do the same thing.

If the pre-filled body is going to be sent by the user, keep it plain ASCII and under 160 characters. If it is a short keyword — which it usually should be — this never comes up.

Where SMS codes still make sense#

Messaging apps have taken most of the ground SMS used to hold, but a few use cases remain genuinely better served by it:

Opt-in campaigns and competitions. The keyword-and-shortcode pattern is well understood, works on every phone including feature phones, and gives you a verified mobile number rather than an email address someone typed wrong.

Two-way service requests. Reporting a broken streetlight, a fault on a machine, an issue with a rental property. SMS threads persist in a way that a web form submission does not, so the user has a record.

Audiences without smartphones or data. SMS is the lowest common denominator. If you are reaching an older demographic, a rural one, or anyone on pay-as-you-go without a data bundle, SMS reaches them where a WhatsApp link does not.

Appointment confirmations and reminders where you want the interaction anchored in the messaging app the user already checks.

Situations where a phone call is too much friction but you still want a direct line — a queue, a waiting list, a callback request.

Consent and the legal side#

If the scan is going to enrol someone into receiving messages from you, the consent rules apply in full. In the UK and EU that is PECR and GDPR; in the US it is the TCPA. The specifics differ but the shape is the same:

• The opt-in must be informed. Print what they are signing up for, how often you will message, and that message rates apply. A QR code with no context does not constitute informed consent.
• The keyword itself is not consent for unrelated marketing. Someone texting MENU to get your lunch specials has not agreed to receive promotional messages twice a week.
• Provide a working STOP. It must be honoured immediately and automatically.
• Keep records of when and how each consent was given.

The penalties for getting this wrong are meaningful and the compliance work is not difficult. Any reputable SMS platform handles the opt-out mechanics for you; the informed-consent part is your copy, and it belongs on the printed material next to the code.

Testing before you print#

1. Scan with an iPhone using the native Camera app.
2. Scan with an Android device using both the Camera app and Google Lens — they sometimes parse differently.
3. Scan with at least one third-party scanner app, since a chunk of your audience uses one.
4. Confirm whether the body arrived on each, and design your printed copy to work even where it did not.
5. Send the message and check it lands in your inbound system with the sender number intact.

Frequently asked questions#