Static vs dynamic Pix QR codes: what changes at checkout

A static Pix QR code stores all the payment data inside the image itself. A dynamic one stores an address that leads to a charge created and signed by the payee's payment provider. In e-commerce, dynamic is the better fit: it allows one charge per order, with an expiry time and automatic reconciliation. But neither type, on its own, stops malicious code on the page from swapping the QR code for another one. That protection has to live in the checkout itself.

How a static QR code works

According to Banco Central do Brasil's Pix initiation manual, a static QR code has a limited feature set and all the information is already in the code. There are only five settings: the Pix key, which is mandatory, and four optional ones: a transaction identifier, free text, the amount and a field used for Pix cash withdrawals.

Creating a static QR code is not part of the Pix API. It can be assembled by the payee's own system or by any generator. It is the code on the sign by the cash register, with or without an amount, and also what some stores generate at purchase time with a unique identifier so they can reconcile the payment.

How a dynamic QR code works

A dynamic QR code carries only the payee's basic details and an address. When the code is read, the payer's app calls that address and receives the charge details directly from the payee's provider: amount, identifier, expiry and additional information.

Three features matter for security:

• The data is signed. The manual says the app should proceed only if the domain is authorised and the payee provider's digital signature is valid.
• The charge expires. If the store sets no deadline, the default validity is 24 hours. Paid, expired or removed charges can be refused.
• What the address returns wins. Any amount or identifier written into the image must be ignored by the payer; the data retrieved from the address prevails.

The manual lists online commerce among the typical uses of dynamic QR codes, generated through the Pix API by the store's payment provider or gateway. There is also a composite QR code, used for recurring payments under Pix Automático.

Copy and paste (Pix Copia e Cola) works with all of them: the copied text is exactly the same content a scanner would read from the QR code.

Where each one shows up in e-commerce

• Dynamic: checkouts integrated with a payment provider or gateway that creates one charge per order.
• Static: stores without integration, sales closed over messaging apps, hand-made payment links and the Pix key printed in the site footer.
• Composite: subscriptions and recurring billing using Pix Automático.

What changes for checkout security

Static has no secret at all. Anyone can generate a static QR code with any key and any amount. A fake code never expires and can be reused. When one QR code serves many customers, the manual itself acknowledges that reconciliation is limited, because every payment arrives with the same identifier.

Dynamic is traceable. Each order gets its own identifier, the charge expires and the provider can notify the store when the Pix for that identifier is credited. That closes important doors: an old screenshot cannot be used to pay, and the store knows exactly what was and was not received.

The limit of dynamic. The signature proves the data came from the provider named in the code and was not altered in transit. It does not prove that the payee is your store. A criminal with an account at any provider can generate a perfectly legitimate dynamic QR code for the same amount. If a malicious script swaps the QR code on the page before the customer scans it, the bank app will show a valid charge, just from a different payee.

That is why dynamic codes need two complementary layers: the customer checking the payee's name, as CERT.br and Febraban advise, and the store making sure the QR code displayed is the one it issued.

Checkout checklist

1. Use dynamic QR codes generated through your provider's or gateway's Pix API, one charge per order.
2. Set an expiry that fits the purchase instead of leaving the 24-hour default by accident.
3. Reconcile by the charge identifier and release the order only when the credit is confirmed.
4. Do not offer a fixed Pix key or a static QR code as a fallback at checkout.
5. Show, next to the QR code, the name and company ID (CNPJ) the customer will see in the bank app.
6. Keep the payment page to the minimum number of third-party scripts.
7. Confirm, in the shopper's browser, that the QR code and copy-and-paste text displayed are the ones the store generated.

Learn how Pix checkout protection works.

Dynamic QR codes solve reconciliation, not the on-screen swap. Proteside records every Pix charge your page generates and checks, in the shopper's browser, that the QR code and copied code are exactly those, blocking any swap before confirmation. Try it free for 14 days.