Self-Hosted QR Code Redirects: Run Your QR Codes on Your Own Cloudflare Account

A dynamic QR code doesn't hold your link directly. It holds a short address that redirects people to your link, which is why you can change the destination after printing. Normally that short address belongs to QRCartoon, so every scan passes through our servers.

With self-hosted redirects, it passes through your server instead: a small program called a Worker that runs on your own free Cloudflare account. You still create and edit your codes in QRCartoon as usual. Only the scanning part moves to you.

Why would I want this?

• Privacy for the people who scan. Scans go straight to your Worker. QRCartoon never sees who scanned, when, from where, or on what phone, because the request never reaches us.
• Your codes don't depend on us. Your Worker keeps its own copy of your redirects. If QRCartoon is down for maintenance or goes away entirely, your printed codes keep working.
• Your own address. Codes can point to something like qr.yourbrand.com instead of ours, if you connect your domain in Cloudflare.
• Fast scans worldwide. Cloudflare runs your Worker in hundreds of locations, so the redirect happens close to whoever is scanning.

How it works, in plain words

1. You edit a QR code in QRCartoon, just like today.
2. QRCartoon prepares your redirect list (which short code goes to which link) and signs it. That's a digital seal that proves the list really came from QRCartoon and wasn't changed along the way.
3. Your Worker downloads the list, checks the seal, and stores it in your Cloudflare account. It fetches right after every edit, usually within seconds, and there's a Sync button in your dashboard if you ever want to make sure.
4. Someone scans your code. Your Worker looks up the short code in its stored list and sends them on to your link. QRCartoon isn't involved at all.

Built to be safe, even if something goes wrong

We designed this so that a mistake or a break-in on our side can't be turned against the people who scan your codes:

• Allowed domains. You list the websites your codes may send people to, like yourbrand.com. Your Worker refuses to redirect anywhere else, even if the request came from QRCartoon itself.
• Signed lists only. Your Worker ignores any redirect list that isn't sealed by QRCartoon, and any list older than the one it already has. Nobody can sneak in a fake or outdated list.
• A setup key that can only read. The key you give your Worker only lets it download your list. It can't create, change or delete anything. We store only a fingerprint of it, so even we can't see the key after showing it to you once.
• Open source. The Worker is short, and its code is public, so you or your developer can read exactly what you're installing.

What you need

• A QRCartoon account
• A free Cloudflare account
• About 5 minutes

Setting it up, step by step

Open Dashboard → Settings and find Self-hosted redirects. Then:

1. Get your setup key. Click Set up self-hosted redirects and copy the key. It's shown only once, so paste it somewhere safe for the next step. Lost it? Just create a new one.
2. Install the Worker. Click Deploy to Cloudflare. Cloudflare copies the Worker into your account. When it asks, paste your setup key as SETUP_KEY, and list the websites your codes will open as ALLOWED_HOSTS, like yourbrand.com, instagram.com. Subdomains such as shop.yourbrand.com are included automatically. Using location codes? Add google.com.
3. Connect it. When Cloudflare finishes, click Visit to open your Worker, then click Connect to QRCartoon. We check that everything is right and pick up your allowed websites automatically. If something's off, you'll see exactly what to fix.

Once it says Connected, create a dynamic QR code and turn on Serve from my Cloudflare Worker when you save it.

What's different with self-hosted codes

Your Worker is a simple, fast redirect. That keeps it safe and private, but a few features need QRCartoon's own pages and aren't available:

• Supported types: website links, YouTube, email, phone, SMS, location and crypto payments. Text and Wi-Fi codes get a clean page on your Worker with copy buttons, and contact cards and events open straight in the phone's contacts or calendar. Richer pages (menus, coupons, PDFs and so on) still need QRCartoon.
• No passwords or scan limits. Expiry dates and pausing a code still work.
• No scan analytics in QRCartoon, because scans never reach us. Add UTM tags to your links to measure visits in your own analytics instead.
• Chosen at creation. Where a code is served from is part of its printed address, so you can't move an existing code to your Worker or back. Create a new code instead.

Day-to-day use

Nothing changes in how you work. Edit a code's link, pause it, or set an expiry date in the dashboard, and your Worker picks up the change within seconds. If something ever looks out of date, press Sync Worker in your dashboard. The settings page shows when your Worker last fetched an update, so you can always see that it's in sync.

Ready to try it?

Head to Settings → Self-hosted redirects to get started. New to dynamic codes? Read our static vs dynamic guide first.