QREagleStudio
Complete User Guide

Getting Started

QREagleStudio is available exclusively on macOS 13 Ventura and later, distributed through the Mac App Store. Download it free — core features are available immediately, premium features unlock with a subscription or lifetime licence.

System Requirements

• macOS 13 Ventura or later (macOS 14 Sonoma or 15 Sequoia recommended)
• Mac App Store account for download
• Internet connection required for Dynamic QR, Smart Cards, and signature verification only

Interface Overview

QREagleStudio is divided into three areas:

• Sidebar (left) — content tabs (Content, Style, Output, Dynamic) and the QR type picker
• Preview (centre-right) — live QR code preview that updates as you type
• Toolbar (top) — Export, Library, and app-level controls

Creating Your First QR Code

1. Launch QREagleStudio and accept the EULA on first run.
2. In the sidebar, choose a category (e.g. Utilities) and then a type (e.g. URL).
3. Fill in the form fields. The preview updates live.
4. Switch to the Style tab to customise colours, shapes, and logos.
5. Click Export in the toolbar to save as PNG, SVG, or PDF.

QR Code Types

QREagleStudio supports 167 QR content types across 8 categories. Every type has a dedicated form — no manual string formatting required.

Categories at a Glance

• Social Media — YouTube, Instagram, TikTok, LinkedIn, X/Twitter, Facebook, Snapchat, Pinterest, and 14 more
• Communication — Email, Phone, SMS, WhatsApp, Telegram, Signal, Discord, Zoom, Microsoft Teams, FaceTime
• Payments — Bitcoin, Ethereum, Litecoin, PayPal, SEPA Bank Transfer, XRP Ledger, Monero
• Utilities — URL, Wi-Fi, vCard, App Store, Google Play, Geolocation, iCal Event
• Location — GPS Coordinates, Google Maps, Apple Maps
• Smart / Interactive Cards — 85 types (see Chapter 4)
• Dynamic QR — short-link QR with live destination editing (see Chapter 5)
• Other — ISBN, Google Review, plain text, and more

Style & Design

The Style tab gives you complete control over every visual aspect of your QR code — colours, pixel shapes, eye styles, gradients, logos, labels, and frames.

168+ Built-in Presets

Tap any preset card to instantly apply a complete visual style: colours, pixel shapes, and eye shapes in one click. Presets include Classic, Nebula, Sakura, Circular variants, and many more. You can further customise any preset after applying it.

Data Pixels & Eye Shapes

Data pixels are the individual modules that make up the QR pattern. Eye shapes are the three corner squares used by scanners to orient the code. Available shapes include Square, Circle, Rounded, Star, Flower, Sharp, Pointy, Squircle, and Diamond. Use the Inset and Corner sliders to fine-tune each shape.

Gradient Fill

Enable the Gradient Fill toggle to apply a Linear or Radial gradient across data pixels. Pick start and end colours independently. Gradients render correctly in all export formats (PNG, SVG, PDF).

Logo / Icon

Add a logo from your Mac (PNG, JPEG, GIF, SVG) or choose from Apple’s 1,000+ SF Symbols. Keep logos at 25–30% of the QR code area and set Error Correction to Q or H (25–30%) to preserve scannability.

Text Labels

Enable the Text Label toggle to add up to two lines of text above or below the QR code. Set font size (14–80 pt), colour, alignment, and vertical offset for precise placement.

Frame / Border

Add a decorative frame with a solid background colour, adjustable padding, and corner radius. When Circular QR is enabled, the frame adapts automatically to an oval.

Error Correction Levels

• L (7%) — smallest code, least redundancy
• M (15%) — good balance for most uses
• Q (25%) — recommended when adding a logo
• H (30%) — maximum resilience; use for print with logos

Smart Interactive Cards

Smart Cards are QREagleStudio’s signature feature — 85 interactive web pages encoded entirely within the QR code URL. No server storage, no database. The entire card payload lives in the URL parameters and is rendered by qreagle.com on demand.

How Smart Cards Work

When you fill out a Smart Card form (e.g. Gift Card, Business Card, Wedding Invitation), QREagleStudio encodes all the fields into URL-safe parameters and builds a URL like qreagle.com/api/gift?to=Alice&fr=Bob&msg=…. Scanning the QR code opens that URL, which renders a beautifully styled HTML page — with no data stored on any server.

• 85 card types: Gift Card, Business Card, Pet ID, Wedding, Ticket, Recipe, Coupon, and many more
• All data lives in the QR URL — fully private by design
• Rendered pages are mobile-optimised and work in any browser
• No account, no server storage, no personal data collected from the viewer

Dynamic QR

Dynamic QR codes contain a short link (e.g. qreagle.com/go/abc123) instead of a fixed URL. You can update the destination at any time from the QREagleStudio app — without reprinting or redistributing the code. A scan counter shows how many times each code has been scanned.

Creating a Dynamic QR

1. Select Dynamic URL under the Utilities category in the sidebar.
2. Enter a destination URL and an optional label.
3. The app registers the link and generates a QR code pointing to your personalised /go/ short URL.
4. Export and use the QR code. The short link is now live.

Updating the Destination

Open the Dynamic QR tab in the app, select the link, tap Edit Destination, enter the new URL, and save. The change is immediate — no reprinting needed.

Scan Counter

The scan count is displayed in the Dynamic QR tab. Only an aggregate integer is stored — no IP addresses, no device data, no timestamps per scan, and no cookies are collected from the people who scan your code.

Privacy & API Key

Dynamic QR requires a Premium subscription. Your API key is derived from your StoreKit transaction ID via HMAC-SHA256 and stored exclusively in your macOS Keychain. See our Privacy Policy for full details.

Bulk Generator

The Bulk Generator creates dozens or hundreds of QR codes in one click, each from a row in a CSV file, all styled identically to your current design.

How to Use Bulk Generator

1. Set your desired style in the main window (colours, shapes, logo, labels).
2. Press ⌘⇧B or go to Tools → Bulk Generate from CSV…
3. Click Import CSV… — one line per QR code, just the raw content.
4. Choose an output folder and set the resolution (200–1200 px).
5. Click Generate All. Files are saved as 001.png, 002.png, 003.png… matching row order.

CSV Format

Each row is the raw QR content — a URL, phone number, Wi-Fi string, plain text, etc. No header row is needed. Example:

https://example.com/product/001
https://example.com/product/002
mailto:sales@example.com
+43123456789

QR Signing & Verification

Cryptographic QR Signing is QREagleStudio’s most advanced security feature. It lets you attach a verifiable digital signature to any QR code you create — so anyone who scans it can confirm the content is authentic and untampered, directly from qreagle.com/api/verify.

7.1 What is Cryptographic QR Signing?

Digital signing is a well-established cryptographic technique. QREagleStudio implements it for QR codes using the P-256 ECDSA algorithm (also known as ES256 or secp256r1) — the same curve used by Apple’s Secure Enclave, passkeys, and TLS 1.3.

When you sign a QR code, the app produces a unique mathematical signature over the QR content using your private key. Anyone with your public key can verify that signature — proving that:

• The content is exactly what you signed (not altered in transit or by a third party)
• The signature was produced by whoever holds the corresponding private key

The public key, signature, your optional signer name, and the original content are all embedded as URL-safe base64 parameters in a verification URL. Scanning the signed QR code opens the verification page automatically.

7.2 Enabling Signing in QREagleStudio

1. Create or open any QR code in the app.
2. Switch to the Style tab in the left sidebar.
3. Find the Signature section at the top of the Style tab (icon: checkmark.seal.fill).
4. Toggle "Sign this QR code" on. On first use, QREagleStudio generates your P-256 key pair automatically and saves the private key to your Keychain.
5. Optionally enter a Signer Name — this display name appears on the verification page for anyone who scans the code.
6. Export your QR code as usual. The signature is embedded in the QR content automatically.

7.3 The Verification Page

When someone scans a signed QR code, their device opens:

https://qreagle.com/api/verify?d=BASE64URL&s=BASE64URL&k=BASE64URL&n=BASE64URL

The page shows:

• ✅ QR Signature Verified — the content and signature match. The content has not been altered since signing.
• ❌ Signature Invalid — the content does not match the signature. The QR code may have been tampered with.

In both cases the page displays: the content type (URL, email, text, etc.), the original QR data, your optional signer name, and a short key fingerprint (first 8 hex characters of the SHA-256 hash of your public key) so scanners can identify which key was used.

The URL parameters are:

• d= — base64url-encoded original QR content
• s= — base64url-encoded P-256 ECDSA signature (64 bytes IEEE P1363 format)
• k= — base64url-encoded raw P-256 public key (64 bytes, x‖y uncompressed)
• n= — base64url-encoded signer name (optional)

7.4 Security Model

Private key storage: Your P-256 private key is generated using Apple’s CryptoKit framework (P256.Signing.PrivateKey) and stored in your macOS Keychain with kSecAttrService = "com.eaglestudio.qr.signingKey". The Keychain entry is AES-256 encrypted, sandboxed to QREagleStudio’s bundle identifier, and protected by your Mac’s login password. On Macs with the Apple T2 chip or Apple Silicon, Keychain secrets are additionally protected by the Secure Enclave.

Signing algorithm: P-256 ECDSA with SHA-256 (P256.Signing.PrivateKey.signature(for:)). The signature is in IEEE P1363 format (64 bytes: r‖s). The verification endpoint converts it to DER format for PHP’s OpenSSL.

Verification endpoint: qreagle.com/api/verify is completely stateless. No data from the request is written to any database. Only the standard Apache access log entry is created (deleted after 30 days). See Privacy Policy §5f.

Key rotation: Your key pair persists across app updates. If you want a new key pair (e.g. after a security incident), you must delete the Keychain entry manually via Keychain Access.app under the entry com.eaglestudio.qr.signingKey, then relaunch QREagleStudio to generate a new pair. QR codes signed with the old key will still verify — they carry the old public key in their URL.

7.5 Signing FAQ

Does signing work with any QR type?
Yes — URLs, vCards, Wi-Fi credentials, email addresses, plain text, Smart Cards, payment addresses, and every other type QREagleStudio supports.

Is signing free?
Signing is included with a QREagleStudio Premium subscription or lifetime licence. The verification page at qreagle.com/api/verify is free for anyone to use, with no account required.

What if I get a new Mac?
If you migrate your Keychain (iCloud Keychain, or the Migration Assistant), your signing key transfers automatically. On a clean install without Keychain transfer, a new key pair is generated. Old signed QR codes still verify correctly — the public key is embedded in each code’s URL.

Can someone forge my signature?
Not without access to your private key. P-256 ECDSA is considered computationally infeasible to forge. Protect your Mac’s login credentials and Keychain as you would any signing credential.

Does the verification page store the content I signed?
No. The verification endpoint is stateless. Nothing is written to any database. The content you see on the verification page comes directly from the URL parameters of that request and is never persisted.

QR Library

The QR Library saves complete QR configurations — type, content, style, and all options — so you can restore any saved design instantly.

Saving a Configuration

Click the Library button (book icon) in the toolbar. Press Save Current and give it a name. All settings — type, form fields, colours, pixel shape, logo, labels, frame — are saved locally in UserDefaults on your Mac.

Restoring a Configuration

Open the Library and tap any saved item to restore it instantly. You can also delete items by swiping or clicking Delete. Library data is stored locally and is never transmitted to any server.

Export & Output

QREagleStudio exports in three formats. Choose the right one for your use case.

Export Formats

• PNG — raster image, up to 1200 px. Best for web, social media, and digital use.
• SVG — vector format, infinitely scalable without quality loss. Ideal for logos, branding, and large-format signage.
• PDF — vector format, ideal for professional print. Embeds all style elements correctly.
• Animated GIF — exports a looping animation of the QR code. Useful for digital signage and presentations.
• Clipboard — right-click the QR preview and choose Copy to Clipboard to paste directly into Keynote, Pages, Figma, etc.

Print Recommendations

• Use PNG at 600–1200 px or SVG / PDF for professional printing.
• Physical QR code size: at least 2 cm × 2 cm for reliable scanning at arm’s length.
• Maintain high contrast: dark foreground on a light background is most reliable.
• Always test with multiple scanner apps before committing to a print run.

Privacy & Security

QREagleStudio is built around a privacy-first principle: most processing happens on your device, and server-side interactions are minimal and fully documented.

On-Device Processing

QR generation, style settings, your QR library, logo files, and all design work happen entirely on your Mac. No account is required for core features.

Keychain Storage

API keys (Dynamic QR), AI service keys, and your signing private key are stored exclusively in the macOS Keychain — AES-256-encrypted and sandboxed to QREagleStudio’s bundle identifier. They are never logged, never shown in plaintext, and never transmitted to our server.

No Analytics

QREagleStudio contains zero analytics, tracking, or advertising SDKs. No Firebase, Amplitude, Sentry, Crashlytics, or similar libraries. No IDFA access. No behavioural data collection of any kind.

Server Interactions (Summary)

• Smart Cards — rendered server-side from URL parameters only. No data stored.
• Dynamic QR — destination URL and aggregate scan counter stored. No personal data of scanners collected.
• QR Signing Verification — stateless endpoint. Nothing stored. See Chapter 7.
• AI Generation — text prompt sent to Replicate API using your own Replicate key. No image you provide is sent.

Full details in our Privacy Policy.

Troubleshooting

Most issues have a quick fix. Try these steps before contacting support.

QR Code Won’t Scan

• Ensure sufficient contrast between foreground and background.
• If you added a logo, increase error correction to Q or H (25–30%).
• Keep the physical print size at least 2 cm × 2 cm.
• Test with multiple scanner apps — some apps handle unusual pixel shapes better than others.

Dynamic QR Not Redirecting

• Ensure your Premium subscription is active and the link is toggled Active in the Dynamic QR tab.
• Tap the link in the app to verify the destination URL is correct.
• Check your internet connection — Dynamic QR requires a connection to qreagle.com.

Signing Key Not Found

• On first use, QREagleStudio generates your key pair automatically. If the key cannot be found, toggle signing off and back on — the app will regenerate the key pair.
• If you use multiple Mac user accounts, the Keychain is per-user. Log in to the correct account.

Verification Page Shows "Signature Invalid"

• The QR content may have been modified after signing (e.g. by a URL shortener that altered the content).
• Ensure the QR code was scanned cleanly — partial scans can corrupt the URL parameters.
• If you regenerated your signing key after creating the QR code, the old public key in the URL will not match the new key. Re-export the QR code with the current key.

Contact Support

For issues not covered here, visit qreagle.com/support or email us at info@it-egarter.at. We aim to respond within 72 hours (business days).

Scan Analytics

Every Dynamic QR link automatically records anonymised scan events. The Analytics sheet — opened via the View Analytics button in the Edit Link sheet — gives you a full breakdown of who scans your codes, from where, and on which devices. All data is privacy-compliant worldwide: no IP addresses, no cookies, no device fingerprints are ever stored.

12.1 Data Collected Per Scan

When someone scans a Dynamic QR code and their browser opens qreagle.com/go/{slug}, the server records one anonymised scan event containing the following fields:

12.2 Opening the Analytics Sheet

1. Open the Dynamic tab in the QREagleStudio sidebar.
2. Find the link you want to analyse. Click the ✏️ pencil icon to open the Edit Link sheet.
3. Scroll to the Analytics row at the bottom of the sheet. It shows the total scan count.
4. Click View Analytics. The analytics sheet opens on top.

The analytics sheet contains:

• Scans Over Time — an area + line chart of daily scan volume for the last 30 days. Date labels are staggered across three rows so they never overlap, even when many dates are shown.
• Countries — ranked bar chart of the top 6 country codes by scan count.
• Browsers — ranked bar chart of browser families (Safari, Chrome, Firefox, Samsung Browser, etc.).
• OS — ranked bar chart of operating systems (iOS, Android, macOS, Windows, etc.).
• Languages — compact pill list of the top 12 accept-language codes.
• A/B Variant Performance — horizontal bar chart comparing scan counts per variant (shown only if A/B testing is configured).

12.3 Privacy Design

The analytics system was designed from the ground up to be privacy-compliant worldwide. Key design decisions:

• No IP storage — the country lookup happens at redirect time and only the 2-letter result is stored. The IP is never written to the database.
• Date-level granularity only — no timestamp below day level means individuals cannot be identified by timing.
• No cookies on the redirect page — go.php sets no cookies and runs no JavaScript. The redirect is a single HTTP 302 response.
• No cross-link tracking — each scan event is associated with a single link ID only. It is impossible to correlate one person's scans across different links.
• No fingerprinting — no Canvas fingerprint, no WebGL, no font enumeration, no screen dimensions are collected.
• Compliant by design — these measures satisfy GDPR (EU), CCPA (California), LGPD (Brazil), PIPEDA (Canada), PDPA (Thailand/Singapore), DPDP (India), PIPL (China), and all other major privacy frameworks without requiring a consent banner for analytics because no personal data is processed.

A/B Testing

A/B testing (split testing) lets you route scans of a single Dynamic QR code to multiple different destination URLs according to configurable traffic weights. Use it to compare landing pages, offers, or content variants and identify the highest-performing destination — all without reprinting the QR code.

13.1 Configuring Variants

1. Open the Dynamic tab and click the ✏️ pencil icon on any link to open the Edit Link sheet.
2. Scroll to the A/B Testing section and toggle it on.
3. Two default variants (A and B) appear. Each row has three fields: Label (A–F, read-only), Destination URL, and Weight.
4. Enter a destination URL for each variant.
5. Set the traffic weight for each variant (see §13.2 below).
6. Click + Add Variant to add up to 6 variants total (A through F).
7. Click Save Changes. The new routing takes effect immediately for all future scans.

13.2 Traffic Weights

Each variant has a numeric weight. The redirect engine calculates each variant’s share of traffic as:

share(variant) = weight(variant) / sum(all weights)

Examples:

• 50 / 50 split — Variant A: weight 50, Variant B: weight 50 → each gets 50% of scans.
• 70 / 30 split — Variant A: weight 70, Variant B: weight 30 → A gets 70%, B gets 30%.
• Three-way split — A: 60, B: 30, C: 10 → A 60%, B 30%, C 10%.
• Weights do not need to sum to 100 — they are normalised automatically. A: 2, B: 1 is the same as A: 67, B: 33.

13.3 Reading A/B Results

1. Open the Edit Link sheet for the link under test.
2. Click View Analytics.
3. Scroll to the A/B Variant Performance section at the bottom of the analytics sheet.
4. Each variant is shown as a horizontal bar with its absolute scan count. The longer bar is the higher-traffic variant.

Interpreting results:

• Use absolute scan count as the primary metric — more scans = more people reached by that variant.
• Allow enough time and volume before drawing conclusions. A 50/50 split with only 10 total scans is not statistically meaningful.
• Once you have a clear winner, update Variant A’s URL to the winning destination, set Variant A weight to 100, and remove or zero-weight the other variants. Or simply disable A/B testing and set the destination directly.