Pix QR Code Generator

How does the Pix QR Code work?

Underneath sits the BR Code, a TLV (tag-length-value) standard descended from EMV-CO, with fields for key, beneficiary, amount, city, and a CRC16 at the end.

It can be static (no amount, so the payer types it in) or dynamic (with a fixed amount). Here we generate the static/with-amount kind.

Generation is fully in-browser. Copy the BR Code and paste it into your bank app too.

PIX: Brazil's instant payment system (launched Nov/2020 by the Central Bank)

PIX is the instant payment ecosystem created, operated and regulated by the Banco Central do Brasil (BCB). It went live on November 16, 2020 and within five years became the most used payment method in the country, surpassing debit, credit, boletos and traditional wire transfers combined. It moves money between participating institutions in seconds, 24/7/365 — no batch window, no business-hour restriction, no settlement delay.

PIX runs on the SPI (Sistema de Pagamentos Instantâneos), a real-time gross settlement infrastructure operated by the BCB, and uses DICT (Diretório de Identificadores de Contas Transacionais) to map PIX keys to actual bank accounts. The QR Code channel follows the BR Code standard published by the BCB, based on the international EMV QR Code Specification for Payment Systems (EMVCo QRCPS).

Static vs dynamic PIX QR Code: differences, limits, use cases

Static QR Code

A static QR carries the PIX key and receiver data directly inside the payload. The amount can be fixed or open. Static QRs are permanent, can be paid an unlimited number of times and do not depend on any backend. Typical use cases: street vendors, small shops, freelancers, donations and tip jars. The downside is reconciliation: the merchant has to match transactions manually using the txid (25 ASCII chars max) or by cross-referencing payer name, amount and timestamp.

Dynamic QR Code

A dynamic QR embeds a URL pointing to a JSON document hosted by a Pix Service Provider (PSP). When the payer scans it, the bank app fetches that URL and retrieves the actual amount, receiver and txid before displaying the confirmation screen. Each dynamic QR represents a single charge with a unique txid (up to 35 chars) and becomes invalid after payment. Dynamic QRs are mandatory for structured commerce — e-commerce checkout, subscriptions, marketplaces — and enable webhooks, instant reconciliation, expiration timers and the COBV variant with late fees, interest and discounts.

BR Code structure (EMVCo standard + BACEN adaptation): TLV, CRC16, required fields

The PIX payload is a flat string of TLV (Tag-Length-Value) triplets: each field has a two-digit ID, a two-digit length and the value. Nested fields use the same convention recursively. The mandatory fields are:

• 00 — Payload Format Indicator: always "01".
• 01 — Point of Initiation Method: "11" for static (reusable) or "12" for dynamic (single use); omitted means reusable.
• 26 — Merchant Account Information: nested group with GUI BR.GOV.BCB.PIX and the PIX key (or URL, for dynamic).
• 52 — Merchant Category Code: ISO 18245 MCC, "0000" when N/A.
• 53 — Transaction Currency: "986" (ISO 4217 Real).
• 54 — Transaction Amount: optional in static, required in dynamic.
• 58 — Country Code: "BR".
• 59 — Merchant Name: up to 25 ASCII chars, no accents.
• 60 — Merchant City: up to 15 ASCII chars.
• 62 — Additional Data Field: nested group carrying the txid (subfield 05).
• 63 — CRC16: four uppercase hex chars, always last.

The CRC16 uses CRC-16/CCITT-FALSE: polynomial 0x1021, initial 0xFFFF, no reflection, no final XOR. The input covers everything from byte zero up to the literal "6304" prefix. Any change in the payload — even a single space — produces a different CRC, letting bank apps detect tampering before the confirmation screen.

PIX key: CPF, CNPJ, e-mail, phone, random key — which one to use

A PIX key is an alias inside DICT. Five types are accepted:

• CPF (11 digits) — exposes the receiver's tax ID. Bad for privacy in public QRs.
• CNPJ (14 digits) — standard for companies; already public information.
• E-mail — easy to remember, professional on a custom domain.
• Phone (+55DDDNNNNNNNNN) — convenient but exposes the cell phone.
• Random key (UUID v4) — privacy-friendly: no personal data revealed.

For public QRs (stickers, websites, invoices), the random key is strongly recommended. Each individual can register up to 5 keys; legal entities, up to 20.

Pix with due date: PIX Cobrança v2, interest, fines, discounts

PIX Cobrança com Vencimento (COBV) is the dynamic QR variant designed to replace the traditional boleto. It supports a due date, automatic late-payment interest (juros), automatic fines (multa), early-payment discounts and abatement. After the due date, the bank app shows the updated amount in real time. COBV is created via the BCB Pix API by POSTing to /cobv with JSON describing calendar, debtor, original amount and calculation rules. Rules support fixed values and percentages per day, month or year. When the due date falls on a weekend or holiday, it rolls forward to the next business day.

How to generate: online tools, APIs (BACEN, Itaú, Mercado Pago), libraries (qrcode.js)

For static QRs the payload can be built locally — no network call required. Open-source libraries: qrcode (Node/browser, MIT), pixqrcode (Dart/Flutter), pix-payload (Java 21). This page uses the same approach: the BR Code string is assembled in JavaScript, the CRC16 is appended and rendered with the local qrcode.min.js — no data leaves the browser. For dynamic QRs you must integrate with a PSP. The BACEN Pix API spec is the same across banks, but each PSP wraps it with its own auth (mTLS + OAuth2). Common choices: Mercado Pago, Asaas, Efí, OpenPix, Cora, Inter, Itaú, Banco do Brasil. Most expose webhooks that POST to your backend when a payment is confirmed.

Security: QR Code scams, always check the receiver

PIX itself is highly secure — the SPI runs on a closed network between regulated institutions and every transfer is signed and audited. The weak link is social engineering. Common scams: pasting a fake QR over the real one on parking meters or restaurant menus, sending QR images via WhatsApp pretending to be a known contact, and fake invoices mimicking real companies. Before confirming any payment, always check three things on the bank app's confirmation screen: receiver's full name, receiver's bank, and amount. If the name doesn't match, cancel. Merchants should prefer the random key over CPF/CNPJ in public QRs and monitor PSP webhooks rather than customer screenshots.

FAQ

Does the static QR Code expire?

No. It is permanent and works as long as the underlying PIX key is active. To invalidate it, delete the key in your bank app.

Why is the merchant name limited to 25 characters?

The 25-char limit (field 59) comes from the EMVCo QRCPS spec, which PIX inherits. Longer names must be abbreviated; accents are not allowed.

Is it safe to generate a PIX QR Code online?

Yes, as long as the tool builds the payload locally in the browser — which is the case here. The QR encodes only public information; the money transfer still requires the payer to authorize it inside their own bank app.

Can I add a logo in the middle of the QR Code?

Yes — QR Codes have error correction (level H tolerates up to 30% damaged modules). Keep logos small and centered to preserve scannability.

Difference between txid and EndToEndId?

The txid is set by the merchant before payment (25 chars static, 35 dynamic). The EndToEndId is assigned by the SPI at settlement and is the canonical identifier — used to confirm receipts and request refunds via BACEN MED.