How QRForge works

QRForge is designed to run at Rp0 forever-while-hosted. Here's exactly how, and where the honest limits are.

Architecture

A QR code encoded with a destination directly baked in can never change. QRForge instead encodes a link back to itself — /q/<ID> — and looks up the real destination at scan time. That lookup needs somewhere to live that's reachable from any device, not just the one that made the QR. That rules out browser-only storage (localStorage/IndexedDB) as the source of truth for redirects.

QRForge is built on:

• Cloudflare Pages — hosts the static site (HTML/CSS/JS) on Cloudflare's free tier.
• Cloudflare Pages Functions — small serverless functions (`/functions/q/[id].js`, `/functions/api/qr/*`) that run on Cloudflare's free Workers runtime. No VPS, no always-on server, no server you manage.
• Cloudflare Workers KV — a free-tier key/value store that holds the actual ID → destination mapping. This is the "public storage" every redirect and every cross-device edit reads from.

We evaluated the alternatives honestly before landing here:

• Pure GitHub Pages / pure static hosting can serve a QR image and even a redirect page, but it has no way to accept a write (an edited destination) from a random visitor without exposing a write-capable API token in the browser. It's a great fit for the static frontend, not for the mutable mapping.
• GitHub repository as storage (a JSON file updated via the GitHub API) works for reads, but writes require an authenticated token — either you keep it secret server-side (which needs a server) or you expose it client-side (which lets anyone rewrite anyone's destination). Also subject to GitHub API rate limits.
• URL-encoded configuration (baking the destination into the QR URL itself, e.g. as a query string) is fully static, but then the destination is the QR code — editing it requires printing a new code, which defeats the entire premise of this project.
• Cloudflare Workers + KV/D1 (what we chose) is the only option in this list that is simultaneously free, requires no server you operate, and supports real writes from any device.

Honest limitations

We will not tell you this is "100% permanent forever" — that isn't true of any free service. What we can say:

• Free while the hosting service remains available. Cloudflare's free tier can change its limits or pricing in the future, and QRForge's own hosting could stop running. Nothing about this design guarantees indefinite uptime — it just minimizes cost and moving parts while it does run.
• Free-tier request limits exist. Cloudflare Workers KV's free tier includes a daily allowance for reads and writes. High-traffic use could hit those limits; QRForge's own operator would need to upgrade or accept degraded service if that happens.
• No login means no cross-device account. "Your QR codes" on the dashboard is really "QR codes this specific browser remembers." Managing a code from a second device requires copying its edit key over (see the Manage page) — there is no password-based account system to sync it automatically, because building one would mean collecting personal data QRForge intentionally avoids.
• Anyone who scans a code can see it needs configuring, but only the edit key holder can change it. The edit key is not a password — treat it like one anyway.

Security

Destination URLs are restricted to http:// and https:// — javascript:, data:, and file: links are rejected both in the browser and again on the server. Edit keys are stored server-side only as a salted hash, never in plaintext. No password, API key, or admin secret is ever placed in the frontend code.