GS1 standards, step by step
To create a GS1 QR code you get a GTIN from your GS1 member organisation, choose a domain you control, build a GS1 Digital Link URI that expresses that GTIN under Application Identifier (01), point the domain at a resolver, encode the finished URI into a QR symbol, and test the printed result before the artwork goes to press.
The single idea worth carrying through all six steps is this. The QR code is just the carrier. What makes it a GS1 code is the GS1 Digital Link URI encoded inside it. Generating the symbol is the easy part and it comes near the end.
Three things: an identifier, a domain and somewhere for the scan to land. Everything else in this guide is detail hanging off those three.
Step 1
You licence a company prefix from a GS1 member organisation and allocate GTINs from it yourself. GTINs are issued by GS1 member organisations, which are the national bodies such as GS1 Canada, GS1 US or GS1 UK, so the number you end up with is globally unique rather than a value you chose.
Once you hold a prefix, allocation is your own administrative job. Each distinct consumer facing product variant gets its own GTIN. A different flavour, a different pack size or a different formulation is a different product, and reusing one GTIN across them destroys the ability to say anything specific about either at scan time.
The last digit of a GTIN is a check digit computed from the preceding digits using GS1's standard check digit calculation, a modulo 10 scheme. It exists so that a mistyped or misread number fails arithmetic rather than silently resolving to some other real product. Validate the check digit at the point you first enter a GTIN into any system, not after artwork.
Then you almost certainly already have GTINs, because the linear UPC or EAN barcode on your current packaging encodes one. Creating a GS1 QR code does not mean requesting new numbers. It means expressing the numbers you already have in a different form.
Step 2
Use a domain your company owns. A common pattern is a dedicated subdomain such as scan.example.com pointed by DNS at whichever platform resolves your codes today. That keeps the printed string stable while leaving the service behind it replaceable.
The reason to be careful here is asymmetry. Every other decision in this guide can be revised after launch. The domain cannot, because it is physically printed on packaging that may sit in a warehouse for a year and on shelf for longer. If the printed domain belongs to a vendor, changing vendor means reprinting, and until you reprint your product packaging is pointing customers at a company you no longer work with.
The standard does not require any particular domain. A GS1 Digital Link URI is defined by the syntax of its path, not by who hosts the hostname in front of it. Brand domains, service provider domains and industry domains are all equally valid, which is exactly why the choice is yours to make on commercial grounds.
If you leave this platform, can the same printed URIs keep resolving under a different provider? Get the answer in writing while you still have leverage.
Every character in the URI becomes modules in the symbol. A shorter hostname produces a smaller, more forgiving QR code at the same printed size.
Step 3
You write a web address, HTTP or HTTPS, whose path carries pairs of GS1 Application Identifiers and their values. The simplest valid form is a domain followed by the identifier 01 and the GTIN.
https://scan.example.com/01/09506000134352That is a complete GS1 Digital Link. The segment 01 is the Application Identifier for a Global Trade Item Number, and the digits after it are the GTIN itself, written as 14 digits with leading zeros where the original number is shorter. Every GS1 aware parser reading that path knows what it is holding without any private agreement between you and the reader.
Qualifiers that narrow the identifier down, such as batch and serial, continue the path in the same alternating pattern. Data attributes such as the expiration date are commonly carried as query parameters instead.
https://scan.example.com/01/09506000134352/10/LOT2245/21/000199?17=270930Read left to right, that URI says: product 09506000134352, from batch LOT2245, unit number 000199, expiring on 30 September 2027. The date is written YYMMDD, so 270930 is the thirtieth day of the ninth month of 2027.
| Application Identifier | Data element | Format | When to include it |
|---|---|---|---|
| (01) | GTIN | 14 digits | The product identifier, and the one element a retail GS1 QR code cannot omit. A shorter GTIN-8, GTIN-12 or GTIN-13 must be padded with leading zeros to 14 digits in the (01) segment, matching how a GTIN is expressed in a GS1 element string. |
| (10) | Batch or lot | up to 20 characters | Identifies the production run. Adding it is what makes batch level routing and batch level recall messaging possible later, because the resolver can tell one run apart from another. |
| (17) | Expiration date | YYMMDD, six digits | The date after which the item should not be sold or used. It is a data attribute rather than an identifier qualifier, so it is commonly carried as a query parameter rather than as a path segment. |
| (21) | Serial number | up to 20 characters | Makes one individual unit distinguishable from every other unit with the same GTIN. Serialisation is the basis of unit level traceability, warranty registration and authenticity checks. |
Add qualifiers only where you can name the thing you will do with them. A code carrying a batch has to be generated per production run and applied by variable printing or online coding rather than pre-printed identically on every pack, which changes what your packaging line has to do. Serialisation raises that again, because every single unit now needs its own symbol.
Step 4
A resolver is the web service answering at the domain in your URI. It reads the identifier out of the incoming request, looks up the destinations registered against that identifier, and redirects the caller to whichever one fits. One printed identifier, many possible answers, decided at scan time.
This indirection is the whole reason not to encode a final landing page URL directly into the symbol. Without a resolver, the destination is frozen in print. With one, it is configuration.
A caller can name the kind of resource it wants using a link type drawn from a published GS1 vocabulary. That is how a regulatory system and a shopper end up somewhere different from the same scan, without either of them needing a separate code.
A URI carrying a batch under (10) can resolve somewhere different from the same GTIN with no batch. That is what makes a targeted recall message possible: the affected run routes to recall information while every other unit of the same product carries on to its normal page.
The same pack can resolve to a French page for one scan and an English page for the next, and an application asking for structured data can be answered with data while a browser is answered with a web page.
One property is worth understanding before you rely on it. A resolver outage costs you the web experience, not the product identity. Everything the symbol encodes stays encoded, so a scanner that speaks GS1 syntax reads the same values offline that it would have read online. Plan resolver uptime as a marketing dependency rather than a supply chain one.
Step 5
You generate a QR code whose payload is the finished GS1 Digital Link URI, and nothing else. There is no separate GS1 mode to switch on in a QR generator. The symbol is the carrier and the URI is the content, so a correct URI in an ordinary QR code is a GS1 QR code, and a marketing link in a beautifully branded QR code is not.
Both symbologies can carry a Digital Link URI. QR is the usual choice for consumer facing packaging because ordinary phone cameras read it natively. GS1 DataMatrix appears more often in healthcare and in settings where the symbol has to be very small.
QR defines four error correction levels, L, M, Q and H. Higher levels survive more damage and dirt but consume capacity, which makes the symbol denser at the same printed size. Raise it for surfaces that get handled, crumpled or chilled, and keep it moderate when the code is small.
A centred logo works only because error correction is spending capacity to cover it. Treat decoration as a budget you are drawing down, keep strong dark on light contrast, and never invert a code so that light modules sit on a dark ground unless you have tested it on real scanners.
Export vector artwork, normally SVG or EPS, rather than a raster image. A raster QR code resampled by a design tool or a prepress workflow can lose module edges, and the failure shows up only after the plates are made.
Step 6
Test the URI, the print and the retail path separately, because they fail for different reasons. A perfectly formed URI in an under-sized symbol still fails on shelf, and a beautifully printed symbol carrying malformed GS1 syntax still fails in a supply chain system.
Ask each retail customer how their point of sale handles a 2D symbol today. Readiness is uneven and will stay uneven through the Sunrise 2027 transition, so until a given chain has finished that work, the linear barcode is what rings the sale. Printing both symbols during the transition is normal practice, and it means a checkout that is not ready never becomes your problem at the till.
Finally, keep a proof of every code you release, tied to the GTIN, batch and print run it belongs to. When a scan fails in the field a year from now, the first useful question is which artwork version produced that pack.
Steps 1 and 6 are yours regardless of what software you use. Nobody can get your GTIN for you, and nobody can proof your packaging for you. QRbolt covers the middle: building the URIs, resolving them, and telling you what happened after the scan.
Build GS1 Digital Link URIs from a GTIN and its qualifiers in the syntax the standard defines, then generate the QR artwork from them.
Custom domains are supported, so the string printed on your packaging can be a hostname your company owns rather than ours. That is the recommendation in step 2, and it applies to us the same as to anyone else.
Batch level routing means a URI carrying AI (10) can be sent somewhere different from the same GTIN without a batch, and the destination can be changed after the packaging is printed.
Scan analytics tied to the identifier, so engagement reads per product rather than as one undifferentiated total. GS1 plans start at CAD $150 per month, and single sign-on is included on every plan that supports more than one team member, configured with you rather than left as a self serve toggle.
QRbolt is listed by GS1 Canada as a solution provider. That is a directory listing, not an endorsement or a certification, and it is worth being precise about the difference when you are comparing vendors who describe themselves differently.
Paste a URI into the free GS1 Digital Link validatorFor a retail product, yes. The GTIN is the identifier under Application Identifier (01), and it is the value the rest of the supply chain and the checkout already recognise. You licence a company prefix from your national GS1 member organisation and allocate GTINs from it, which is what makes the number globally unique rather than self assigned. For an internal asset that never crosses a retail till you can use a different GS1 identifier, but the retail case starts with a GTIN.
The data inside it, not the symbol. A QR code is a carrier. What makes it a GS1 QR code is that the string encoded in it is a GS1 Digital Link URI, meaning a web URI whose path expresses GS1 Application Identifiers and their values in the syntax the standard defines. Encode an ordinary marketing URL in the same symbol and you have an ordinary QR code.
A domain you control. The domain is printed into the packaging and stays there for the life of that artwork, so if it belongs to a vendor you cannot move away without reprinting. Owning the domain, or at least a subdomain such as scan.example.com delegated to whatever platform resolves it today, keeps the identifier portable while leaving the resolution service replaceable.
No. The GTIN under (01) is enough for a valid GS1 Digital Link. Batch (10), expiry (17) and serial (21) are optional and each one adds cost, because a code that carries a batch has to be generated and applied per production run rather than printed identically on every pack. Add them when you have a use for the granularity, such as targeted recall, freshness messaging or unit level authentication.
Yes, provided resolution sits behind the code. The printed symbol holds the identifier, and the resolver decides the destination at scan time. Re-point the resolver and every pack already on shelf starts routing somewhere new, with no artwork change. This is the practical reason to resolve rather than encoding a final destination URL directly.
That depends on the retailer, not on your code. Sunrise 2027 is a voluntary industry goal for retail point of sale systems to be able to accept 2D barcodes by the end of 2027, and readiness varies by market and by chain. While that transition is under way, many brands print both the existing linear barcode and the 2D symbol so checkout keeps working everywhere.
Large enough that the module size survives your printing process and the distance the code is read from. Rather than picking a millimetre figure from a web page, set the module size first, keep the four module quiet zone clear on all sides, then verify with the actual substrate, the actual press and the actual scanners. Curved surfaces, low contrast colour pairs and flexible film all reduce the effective read range.
Yes, and you should. Parsing the URI to confirm the Application Identifier syntax is well formed, checking the GTIN check digit under the GS1 standard check digit calculation, and scanning a printed proof with several phone models are all cheap. Reprinting packaging is not.
Reference material: the GS1 General Specifications define Application Identifiers and the check digit calculation, and the GS1 Digital Link standard defines the URI syntax and resolution behaviour described here. Both are published by GS1.