UPI QR codes — the NPCI spec, field by field

The payload

upi://pay?pa=merchant@upi&pn=Chai%20Point&am=120.00&cu=INR&tn=Table%207

Every UPI app in India parses this, because the format is defined by NPCI rather than by any one wallet. There is no per-app QR code — a single printed code works for Google Pay, PhonePe, Paytm, BHIM, Amazon Pay and every bank app.

Every parameter

Param	Name	Required	Notes
pa	Payee address (VPA)	yes	name@bank, e.g. merchant@okhdfcbank
pn	Payee name	yes	Shown to the payer before they confirm
am	Amount	no	Two decimal places, e.g. 120.00
cu	Currency	effectively yes	Always INR
tn	Transaction note	no	Shown to the payer; keep it short
tr	Transaction reference	no	Your order id, 1–35 alphanumeric
mc	Merchant category code	no	4-digit ISO 18245
mode	Mode	no	02 for merchant-presented static QR
sign	Signature	no	Only for signed merchant codes issued by a PSP

UseQR validates the VPA against ^[\w.-]{2,256}@[a-zA-Z]{2,64}$, the amount to two decimals, the MCC to exactly four digits, and the reference to 35 alphanumeric characters — the constraints the NPCI spec actually imposes, so a code that generates here will not be silently rejected at the app.

Static versus dynamic, in UPI terms

• Static: no am. The payer types the amount. This is the shop-counter standee — print once, use forever, no per-transaction cost.
• Dynamic: am is set. Generated per transaction, usually shown on a screen. Best for billed amounts where typing errors matter.

A printed code with a fixed amount is almost always a mistake — prices change, and the code cannot.

Merchant category codes

mc matters more than it looks. Some issuers apply different interchange, limits or cashback rules by MCC, and a few UPI-Lite and offline-payment flows are gated on it. Common values: 5411 grocery, 5812 restaurants, 5814 fast food, 5912 pharmacy, 8220 education, 4121 taxi. If you have a PSP-issued merchant VPA, use the MCC they assigned rather than picking one.

Why an app sometimes will not detect the code

In rough order of frequency:

1. The code is too small or too dense for the counter distance. A standee scanned from 40 cm needs at least 4 cm of code; most printed UPI standees are undersized.
2. The VPA has a typo. Apps validate the handle against a live registry — a wrong bank handle fails at confirmation, not at scan.
3. A long tn pushed the version up. Keep the note under 25 characters.
4. The code was resized in a design tool with smoothing on, blurring module edges.
5. Glare. Glossy lamination on a counter standee under a ceiling light is the classic real-world failure. Use matt.

Print guidance for a shop counter

• Minimum 4 cm × 4 cm of code, not counting the frame, for a 40 cm scan distance.
• Error correction M is enough; go to Q only if you are adding a logo.
• Matt laminate, never gloss.
• Keep the printed VPA and business name next to the code — it lets a customer pay manually when their camera struggles, and it is a fraud check.

Fraud: the sticker-over-sticker problem

The dominant UPI QR fraud is physical, not digital: someone pastes their own code over yours. Two defences that cost nothing — print the payee name large enough that a customer notices when the app shows a different one, and check your standee daily. No amount of cryptography helps if the customer never reads the confirmation screen.

FAQ

Do I need a different QR code for Google Pay, PhonePe and Paytm?

No. NPCI standardised the format, so one upi://pay code works in every UPI app including all bank apps. Any service selling you per-app codes is selling you nothing.

Should my printed shop code include the amount?

No. Leave the amount out for a printed code so the customer enters it. A fixed printed amount cannot be changed when prices do.

Is there a fee for using a UPI QR code?

Person-to-person UPI is free. Merchant transactions may carry charges depending on your PSP agreement and the instrument used; generating and printing the code costs nothing.

How big should a UPI QR standee be?

At least 4 cm of code for a 40 cm scanning distance — roughly the width of a counter. Use the ten-to-one rule: printed width is at least the scan distance divided by ten.

What is the mc parameter for?

The merchant category code, a four-digit ISO 18245 value. Some issuers apply different limits or rewards by category, and certain offline flows depend on it. Use the code your payment provider assigned.

Can someone charge my account by making me scan a QR code?

No. A UPI QR code initiates a payment from the scanner, and it always requires their explicit confirmation and PIN. Any message telling you to scan a code "to receive money" is a scam.