What a UPI QR code contains, field by field — and the ones that break payments
A UPI QR code is a link that starts upi://pay, followed by a handful of fields. Most failed scans at a counter come from three of them being missing, malformed or wrongly encoded.
WHAT THIS ARTICLE DOES AND DOES NOT TELL YOU✓A UPI QR encodes a upi://pay link. The fields come from NPCI’s UPI linking specification.✓The payee address (pa) is the only field that decides where money goes. Check it character by character.✓Names and notes must be percent-encoded; a raw space or ampersand is the commonest encoding fault.✕It does NOT list how each payment app behaves. Apps change, and claims about them need testing we date and publish.
The shape of the link
Every UPI QR code carries a link of the form upi://pay?pa=…&pn=…&am=…&cu=INR. The scheme, upi, tells the scanning app what kind of thing it is holding; pay is the action; the rest are query parameters defined by NPCI’s UPI linking specification. A UPI app reads the code itself — it does not follow a web link to get there — which is why a payment code is always a static code.
FieldNameWhat it does
paPayee addressThe VPA, such as shop@okaxis. Decides where money goes. Required.
pnPayee nameShown to the payer before they confirm. Treat it as required.
amAmountOptional. Rupees, with at most two decimal places.
cuCurrencyINR. The only currency UPI settles.
tnNoteA short note the payer sees, such as a table number.
trReferenceA merchant’s own transaction reference, for reconciling.
Field names from NPCI’s UPI linking specification. Merchant integrations use further fields; a shop counter code needs these.
The payee address is the only field that moves money
Everything else on the code is display or bookkeeping. pa is the destination. A single wrong character in it is a valid-looking code that pays somebody else, or nobody. That is why this site’s rule is that the payee address is never generated, suggested or completed by AI: it is typed or pasted by the person who owns it, and encoded exactly as entered.
Before printing, scan the code with the scanner on this site or any UPI app and read the payee back. It takes ten seconds and it is the only check that tests what was printed rather than what was meant.
A code with the wrong payee scans perfectly. That is what makes it dangerous.
Encoding: where most broken codes come from
Query parameters cannot contain raw spaces, ampersands or other reserved characters. A shop name like “Sharma & Sons” written straight into pn ends the name at the ampersand and starts a new, meaningless field. The correct form percent-encodes it: Sharma%20%26%20Sons. Different apps tolerate different mistakes, so a code that works in one wallet and not another is very often an encoding fault rather than a wallet fault.
Amounts have a format too: digits, a decimal point, at most two decimal places, no currency symbol and no thousands separator. 1,250.00 and ₹1250 are both wrong; 1250.00 is right.
What we do not claim
You will find articles listing exactly what each payment app accepts. Apps change their parsers without announcing it, so any such list is true on the day it was tested and drifts after. Our UPI generator validates against the specification and against the behaviour documented on its page, and that page dates what it says.
What this article is not
It is not the specification. NPCI publishes it; read it for merchant integrations, signed QR codes and fields not covered here.
It makes no claim about a particular app’s current behaviour.
It is not payment advice. We generate payment links; we are not a payment service provider.
Make a UPI QR code that encodes correctly
Fields validated and percent-encoded for you, the payee read back before you download, and no AI anywhere near the address.
We’d like to count visits with Google Analytics and see where pages confuse people with Microsoft Clarity. Both set cookies, and nothing loads until you choose. Anything you type stays hidden from recordings.
Change it any time from “Cookie settings” at the foot of every page. Cookie policy