QR codes for PDF documents: how to link, host and update a brochure without reprinting

The problem with a QR code that points directly at a PDF

Your client prints 10,000 flyers. Every flyer has a QR code in the corner. The code links to the product brochure PDF, hosted somewhere on their website or in a cloud storage folder. Three months later, the product line changes, the pricing is wrong, or the brochure gets a redesign. The PDF needs to change.

If the QR code is pointing directly at that PDF's URL, you have a problem. Change the file and the link breaks. Upload a new file to a different URL and the old code becomes a dead end. Reprint 10,000 flyers and absorb the cost. This is the situation agencies face constantly, and it is entirely avoidable.

This guide covers how to link a QR code to a PDF correctly: choosing the right hosting, understanding what actually goes inside the code, controlling how the file opens on phones, and knowing exactly what you can and cannot track. It also explains the one architectural decision that makes PDF QR campaigns updatable after the print run.

What goes inside a QR code when you link it to a PDF

A QR code does not contain a file. It contains text, almost always a URL. When someone scans it, their phone opens that URL, which then delivers the file.

This distinction matters because the URL you put inside the code determines how flexible the campaign is. There are two approaches.

Static QR code: the PDF's own URL goes directly inside the code. If the URL is https://www.example.com/files/product-catalog-spring-2026.pdf, that exact string is encoded in the pattern. The longer the URL, the denser the resulting code. Per the ISO/IEC 18004 standard, a QR code encodes data in versions from 1 (a 21x21 module grid) up to version 40 (177x177). A typical URL of 60 characters or fewer stays at version 4 or 5, which produces a clean, easily scannable pattern. A URL of 100 characters or more pushes the code past version 7, at which point density increases, print tolerances tighten, and scan failure becomes a genuine risk unless print size is generous.

Dynamic QR code: a short redirect URL from a QR platform goes inside the code instead, typically 20 to 30 characters (for example https://scankit.app/r/abc12). The platform's server receives each scan and immediately redirects the visitor to wherever you currently point the code. The PDF URL, however long or complex, is stored in the platform dashboard, not encoded in the printed pattern. This keeps the code at version 2 or 3 regardless of the final destination URL.

The short URL is the mechanism that makes a campaign updatable. Every advantage described in this guide flows from choosing a dynamic code rather than a static one.

How to host a PDF for a QR campaign

Once you know the code will use a redirect, you need somewhere permanent and reliable to host the PDF. The most common options each have significant gotchas.

CDN or object storage (recommended)

Services such as AWS S3, Cloudflare R2, or Supabase Storage give you direct control over the URL, the file, and the HTTP headers. The URL structure never changes unless you change it. There are no admin-imposed expiry dates, no bandwidth limits that cut off access, and no interstitial pages between the scan and the file.

When you upload a new version of the PDF, you can either replace the file at the same URL (keeping the redirect destination unchanged) or upload to a new URL and update the destination in the QR platform dashboard. Both work. The printed code is unaffected either way.

R2 has no egress fees. S3 charges per gigabyte transferred, which becomes relevant for high-traffic campaigns.

Google Drive

Google Drive works, but only if you understand its quirks. A standard share link opens a Drive preview page, not the PDF directly. To make the link serve the raw file you need to modify the URL from drive.google.com/file/d/[ID]/view to drive.google.com/uc?export=download&id=[ID], which triggers a download. Files larger than 100 MB may show a Google virus-scan warning interstitial, which disrupts the experience.

More importantly: on Google Workspace accounts, administrators can enable automatic link expiry for shared files. Third-party add-ons can also impose expiry. If your client's IT team enables that policy after the campaign goes to print, every QR code that relied on a Drive link stops working without warning. There is no reliable way to know in advance whether a client's Workspace configuration will cause this.

Dropbox

Dropbox shared links are stable by default, but paid-plan administrators can set expiry dates. Free accounts have monthly bandwidth limits; exceeding the limit temporarily disables the link. The ?dl=1 parameter forces a download (rather than showing the Dropbox preview page), but Dropbox has occasionally served an HTML error page instead for files it flags as suspicious.

Your own server

If you or your client runs a web server, hosting the PDF there gives you the same control as object storage. The key requirements are HTTPS (see below) and enough bandwidth for the expected scan volume.

HTTPS is mandatory, not optional

Both iOS and Android enforce HTTPS for content served via QR redirects. Apple's App Transport Security, introduced in iOS 9, blocks cleartext HTTP connections at the system level. Android has enforced the same from Android 9 onwards. A QR code that redirects through an HTTP URL will either fail silently or show an error on the vast majority of modern phones. Every PDF hosting URL in a QR campaign must be HTTPS.

Controlling how the PDF opens: the Content-Disposition header

When a phone loads a PDF URL, one HTTP header determines whether the browser tries to display the file inline or prompt the user to download it: Content-Disposition, defined in RFC 6266.

Setting Content-Disposition: inline (or omitting the header entirely) tells the browser to render the file if it can. Setting Content-Disposition: attachment instructs the browser to prompt a download.

CDN and object storage services let you set this header when uploading. Google Drive and Dropbox do not give you direct control over it.

The practical effect varies by platform. iOS Safari renders PDFs natively using Apple's PDFKit engine. A PDF link always opens inline within the Safari tab, regardless of whether Content-Disposition: attachment is set; iOS Safari ignores the HTML download attribute and treats PDF URLs as inline content.

Android behaviour is less predictable. Modern versions of Chrome on Android have a built-in PDF viewer and will display the file inline. Older devices, non-Chrome browsers, or phones with certain PDF reader apps installed may instead trigger a download to the local storage folder. For campaigns where the audience skews heavily toward Android, consider hosting a single-column, mobile-optimised layout to work well either way.

The dynamic redirect in detail

Here is how a dynamic PDF redirect works in practice:

1. The printed QR code contains only a short redirect URL. This URL is fixed at print time and never changes; it is literally baked into the pattern of dark and light squares on the physical item.

2. The redirect node is the QR platform's server. Every scan hits this server first. The server looks up where the code is currently pointing and issues an HTTP redirect. This is the part you can update from a dashboard without any changes to the physical code.

3. The active PDF is whatever file is at the current destination URL. When you upload a new version of the brochure and either replace the file at the same URL or update the redirect destination, the next scan goes to the new file automatically. The printed item is unchanged.

The redirect typically takes under 100 milliseconds, imperceptible to the user. It is also where all the scan analytics are recorded, since the platform server sees every request before the redirect fires.

Updating the PDF without reprinting

The most valuable property of a dynamic PDF QR code is that the printed asset and the document content are decoupled. You can update the content without touching the printed item.

In practice, agencies use this in two ways.

Replace the file at the same URL. Upload the new PDF to the same path on your CDN or server, overwriting the old file. The redirect destination in the QR platform stays the same. The next scan delivers the new file immediately. This works cleanly if you own the hosting.

Update the redirect destination. If you are moving the file to a new location (a different CDN, a new URL structure, a new storage service), update the redirect in the QR platform dashboard to point to the new URL. All existing scans immediately go to the new location. This works for any hosting, including Google Drive or Dropbox, and means you can move files freely without reprinting anything.

Neither option requires reprinting. Neither requires notifying whoever printed the original material. The QR code on the physical item stays exactly as it was.

What you can and cannot track

A QR campaign manager needs to understand an important split in what tracking is possible when the destination is a PDF.

What the QR platform tracks is everything that happens at the redirect server: the number of scans, the timestamp of each, the country and city derived from the IP address, the device type and operating system from the User-Agent string, and (depending on the platform) an approximation of unique versus repeat scanners. This happens regardless of what the destination is. A scan to a PDF is tracked just as well as a scan to a webpage.

What Google Analytics 4 cannot track is anything about the PDF session itself. GA4 requires a JavaScript snippet to execute in the browser. A PDF viewer, whether native on iOS, Chrome's built-in renderer on Android, or a standalone app, does not execute JavaScript. No GA4 events fire. The session is invisible to your GA4 property. This is a hard technical limitation, not a configuration problem.

UTM parameters added to the PDF URL, such as ?utm_source=print&utm_medium=qr, also do not work with GA4. GA4's JavaScript never loads, so it never reads the UTM string. The parameters appear in server access logs and in the QR platform's raw redirect log, but they do not flow into GA4 campaign attribution.

This means: for a campaign where the destination is a bare PDF URL, your analytics source of truth is the QR platform's own dashboard, not GA4.

The landing page approach for full tracking

If GA4 attribution matters to the campaign, the solution is to redirect to an HTML landing page first rather than directly to the PDF. The landing page loads GA4, fires a page_view event, and the UTM parameters are read and attributed. A prominent download button or an automatic download link then delivers the PDF to the visitor.

This pattern gives you full GA4 session tracking, attribution, and event data. The tradeoff is one extra tap for the user. For most agency campaigns, the tracking benefit outweighs the friction; for campaigns where frictionless access to the file is the priority (a menu, an emergency product recall notice), you may prefer the direct-to-PDF approach and rely on the QR platform's analytics alone.

File size and mobile friendliness

No official specification defines a "comfortable" PDF size for mobile access, but practitioner consensus is clear: under 1 MB is ideal for all mobile conditions, including weak 4G connections. Under 10 MB is acceptable on LTE or 5G. Above that, load times become a problem for users on variable connections or older devices.

The most common cause of oversized PDFs in agency work is high-resolution images intended for print (300 dpi, CMYK, uncompressed). A PDF destined for screen viewing via QR code needs images at 72 to 150 dpi in RGB colour. The visual quality difference on a phone screen is negligible; the file size difference can be 4 to 10 times.

Single-column layouts also work better for mobile PDF delivery than the two- or three-column landscape layouts common in printed brochures. A PDF designed for A4 landscape print forces users to pinch and scroll constantly on a phone. A mobile-aware version designed in portrait orientation or with a reflowable layout is worth creating if scan volume is significant.

What file types work via QR code

PDF: the best option. Native rendering on iOS, reasonable rendering on Android, universal support.

Images (JPEG, PNG): work perfectly. Both operating systems render images natively in the browser. Appropriate for single-image certificates, vouchers, or maps.

Video (MP4): works via the native mobile video player. Appropriate if the campaign links to a product video or walkthrough.

HTML pages: the ideal format for everything requiring tracking, interactivity, or frequent updates.

Microsoft Word (.docx), Excel (.xlsx), PowerPoint (.pptx): do not link to raw files from a QR code. Mobile browsers have no native support for Office formats. The user either gets a download they cannot open or, if they have the relevant app installed, the file opens there after a delay. The experience is unreliable across devices.

If a Word or PowerPoint document must be linked via QR, the most reliable approach is to upload it to Google Drive or Microsoft SharePoint and share the web-viewer URL rather than the raw file URL. The web viewer renders the document in-browser without requiring any app. For presentations, converting to PDF first is cleaner still.

Common pitfalls

Direct PDF links to Google Drive preview pages. Using the standard share link from Google Drive opens a Drive preview interface, not the PDF directly. Many users on mobile cannot easily navigate from the Drive interface to viewing or downloading the actual file. Use the uc?export=download&id= form for the raw file, or redirect to a landing page that embeds the Drive file properly.

Google Workspace link expiry. If the file is on a client's Google Workspace account, their IT administrator may have enabled automatic link expiry policies. Links that worked at campaign launch can break weeks or months later with no notification. For any print campaign with a lifespan over a few weeks, host the PDF on infrastructure you control.

Dropbox bandwidth limits. Free Dropbox accounts have a monthly bandwidth cap. If a campaign generates significant scan volume, the shared link can be temporarily disabled when the cap is hit. Paid plans raise the limit significantly, but for high-traffic campaigns, owned CDN hosting is safer.

Private file permissions. If the PDF is in a private S3 bucket, a private Google Drive, or any storage with access controls requiring authentication, unauthenticated visitors reaching the URL via QR code receive a 403 error or an authentication challenge. The file must be publicly readable (or served via a properly configured CDN with appropriate cache headers).

Static codes pointing to versioned filenames. A static QR code that encodes campaign-brochure-v1.pdf is permanently bound to that filename. Agencies that name files with version numbers and then try to "update" by uploading a v2 find that the original printed code still points to v1. This is avoided entirely by using a dynamic redirect, where the destination filename is irrelevant to the printed code.

HTTPS not enforced. HTTP URLs fail on iOS and Android 9+. Always verify that your hosting URL uses HTTPS before printing.

Frequently asked questions

How do I make a QR code that links to a PDF?

Use a dynamic QR code generator rather than a free static code tool. Upload the PDF to a public URL (your CDN, S3, R2, or a similar service), then create a dynamic QR code pointing to that URL. The code will contain a short redirect URL managed by the platform. You can update the PDF URL at any time from the platform dashboard without changing or reprinting the code. For a step-by-step setup including analytics, see the guide on how to track a print campaign with QR codes.

Can a QR code link directly to a PDF file?

Yes. A QR code can point to any URL, including a direct URL that serves a PDF. Whether the PDF opens inline or triggers a download depends on the Content-Disposition header returned by the hosting server and the device type (iOS renders inline; Android behaviour varies). The main limitation is that a static code pointing directly to a specific PDF URL is permanently fixed; if the file moves or the URL changes, the code breaks.

How do I update the PDF without changing the QR code?

Use a dynamic QR code. The code contains a redirect URL, not the PDF URL. When you update the destination in the QR platform dashboard, the next scan automatically goes to the new file. The printed code is not affected. Alternatively, if the hosting URL stays the same, you can replace the file on the server without touching the QR platform at all.

Why can I not track PDF downloads in Google Analytics 4 via a QR code?

GA4 tracks events by executing a JavaScript snippet on the page. PDF viewers, whether native on iOS, Chrome's built-in viewer on Android, or a standalone app, do not run JavaScript. No GA4 events fire. This is a hard technical limitation of how PDF rendering works on mobile. For full GA4 tracking, redirect scans to an HTML landing page first, let the page fire a GA4 event, then offer the PDF as a download from that page. The QR platform's own scan analytics are still captured regardless of GA4.

How big can a PDF be for a QR code campaign?

For reliable access on mobile networks, keep PDFs under 1 MB where possible, and under 10 MB for all but the highest-bandwidth scenarios. The most common culprit for oversized PDFs is print-resolution imagery (300 dpi, CMYK). For screen delivery via QR, compress images to 72 to 150 dpi in RGB and you will typically reduce file size by 4 to 10 times with no perceptible quality loss on a phone screen.

What happens when someone scans a PDF QR code on an iPhone versus Android?

On iPhone, iOS Safari renders the PDF natively using Apple's PDFKit engine. The file opens inline within the Safari browser tab. The HTML download attribute and the Content-Disposition: attachment header are both ignored on iOS Safari; it will always display the PDF inline rather than prompting a download.

On Android, behaviour depends on the Chrome version and installed apps. Modern Chrome on Android has a built-in PDF viewer and renders inline. Older devices or phones with a dedicated PDF reader app installed may hand off to that app or prompt a download to the Downloads folder. Design PDFs in portrait single-column layout so they are readable either way.

Can a QR code link to a Word document or Excel spreadsheet?

It can, but the experience is unreliable on mobile. Native mobile browsers have no built-in support for .docx or .xlsx. Users either get a download they may not be able to open, or if they have Microsoft Word or Excel installed, the app opens after a delay. For Office documents that must be shared via QR, upload the file to Google Drive or Microsoft SharePoint and share the web-viewer URL. For presentations, export to PDF first.

Do PDF QR codes expire?

A dynamic QR code itself does not expire unless the QR platform shuts it down. However, the PDF URL that the code points to can become inaccessible for other reasons: a Google Workspace administrator enables link expiry, a Dropbox account hits its bandwidth limit, the file is deleted from the server, or the hosting provider changes URL structure. The code is only as reliable as the hosting and platform behind it. Using owned CDN hosting and a reputable dynamic QR platform removes most of these failure modes.

Is a landing page better than a direct PDF link for a QR campaign?

It depends on the campaign goals. A landing page enables full GA4 session tracking and UTM attribution, allows you to add context and a call to action around the file, and gives search engines an indexable HTML page to crawl. A direct PDF link is simpler to set up and reduces the number of steps between the scan and the document. For campaigns where analytics and SEO matter, a landing page is the better choice. For purely functional use cases such as a restaurant menu or an event programme where immediate access is the priority, a direct link is fine, and you rely on the QR platform's scan analytics instead of GA4.

The short version

A QR code for a PDF should use a dynamic redirect, not a static link. The redirect keeps the printed code short and clean (Version 2 or 3 per ISO/IEC 18004), and it gives you the ability to swap the destination file without reprinting.

Host the PDF on a CDN or object storage where you control the URL, the permissions, and the HTTP headers. HTTPS is mandatory on both iOS and Android. Cloud storage services (Google Drive, Dropbox) work but introduce expiry and permission risks that owned hosting avoids.

Accept that GA4 cannot track direct PDF opens; your analytics live in the QR platform dashboard. If you need GA4 attribution, redirect scans to an HTML landing page first.

For most agency brochures and catalogs, the practical setup is: upload a compressed, mobile-friendly PDF to R2 or S3, create a dynamic QR code pointing to it, set Content-Disposition: inline, and bookmark the platform dashboard for when the client next updates the file. The printed material can then evolve without the print run ever being touched again. Start by creating a free dynamic QR code on ScanKit and see how simple the update workflow is.