The Coinbase Super Bowl QR code, and the sentence a QR vendor wrote while selling against it

The only thing that did not break was the code

On 13 February 2022, Coinbase spent as much as $14 million on sixty seconds of Super Bowl LVI and used it to show a QR code bouncing around a black screen. No logo. No copy. No voiceover. Just a colour-shifting square drifting about, in what Branch’s teardown later called an homage “designed to evoke memories of the old bouncing DVD screensaver.”

Then roughly 20 million things happened at once, and almost all of them fell over.

Coinbase’s chief product officer, Surojit Chatterjee, posted that night that the landing page took “more than 20 million hits” in one minute, and called it “historic and unprecedented.” He also said the company saw “more traffic than we’ve ever encountered” and had to “throttle traffic for a few minutes.” CNN reported the app was down for about an hour.

The code itself worked every single time.

That is not a small detail, and it is not luck. A QR code is ink and geometry. It has no server, no uptime, no invoice, and no opinion about how many people are looking at it. Twenty million cameras pointed at that pattern and twenty million cameras read it correctly, because there was nothing there to fail.

Everything behind it is where the fragility lives. That is the sentence this whole company is built on.

What a QR vendor admitted while arguing the other way

Two days later, Branch published a teardown of the campaign. Branch sells a mobile linking platform, so read what follows knowing they were making a sales argument: their view was that Coinbase’s plain code was “an example of a ‘dumb QR code’” and “probably the biggest missed opportunity of the campaign.” The post ends with a button that says Contact sales.

They are not on our side of this. They think Coinbase should have used the smarter, dynamic kind. And in the middle of making that case, they wrote this:

“these tools often have unexpected limits on the permitted number of QR code scans. Even worse, many QR code tools are simply not ready for the massive spike of traffic generated by major campaigns like this one, and can quickly become overloaded at exactly the worst time.”

Read that again with the context in mind. A company whose commercial interest is to tell you dynamic QR codes are excellent has stopped mid-pitch to mention that the category will cap how many times your code may be scanned, and will fall over when a lot of people scan it at once.

Not as a warning. As an aside. Ordinary common knowledge, the way you would mention that a car needs petrol.

That casualness is the whole story. Not that Coinbase was clever. That the industry finds “your QR vendor will cap you and buckle when it matters” unremarkable enough to say out loud while selling you the thing.

What a scan cap looks like on the day it works

A scan limit is an abstraction right up until the moment your campaign succeeds. Then it is a countdown.

The limits are real and published, in plain sight, by the vendors themselves. QR Tiger’s own FAQ: “You can generate three free dynamic QRs with a 500 scan limit each.”

Five hundred. On an ordinary Tuesday that number is invisible. On the one day the thing works, it is the ceiling your success arrives at.

Their same FAQ answers the obvious follow-up, and it is worth reading to the end of the sentence: “Dynamic QRs have unlimited scans with a valid subscription. If your plan expires, it will stop working.”

So the cap is not really 500. The cap is 500, or however long you keep paying, whichever runs out first.

Coinbase is what that looks like at scale, except their ceiling was capacity rather than a billing tier. Same failure, different reason. Their fragility was servers. Our competitors’ fragility is money: the code stops when the payment stops, which is a cap of a different kind and one that arrives on a schedule rather than a spike.

A code with no cap and no renewal costs $7.99, once.

Why did Coinbase use a static code?

Nobody outside Coinbase has ever said, so neither will we.

You can find plenty of confident theories. All of them are guesses. What is on the record is only the choice itself: the code was static and unbranded, pointing at a plain address, drops.coinbase.com, where new users were offered $15 in bitcoin and everyone else a $3 million sweepstakes.

Branch’s own note on the tradeoff is the honest one: Coinbase “managed to avoid these pitfalls by using a plain web URL, but at the cost of other benefits,” and the biggest downside was “likely the amount of custom work their team needed to do in order to duct tape all the pieces together.”

That is what a static code buys and costs. It cannot be capped, throttled, or switched off by a vendor, because there is no vendor. It also cannot be changed, ever. Coinbase aired theirs, so it evaporated after sixty seconds and the tradeoff evaporated with it.

Print one on fifty yard signs and you have made that decision permanently.

The bare code problem

One more thing Branch got right, and it costs us nothing to say so.

The Coinbase code was “completely unbranded.” Branch flagged that as a missed trust signal and a phishing risk: “a basic QR is a door to the unknown (and not always a smart one to walk through, given the risks lurking on the internet).”

They are correct. Coinbase could carry it because 100 million people had just watched them pay for the context. Your table tent has no context. A code with your logo in it is telling someone whose door they are about to walk through, which matters more for you than it ever did for Coinbase.

That is what our $4.99 custom design is actually for. Not decoration.

What we do about it, and what we will not claim

We built our platform with that specific situation in mind.

Here is what that means in practice, and it is measured rather than promised. We put an edge cache in front of the redirect and then load-tested it: 7,199 requests, with the rate climbing 20 times over three runs, produced 38 database lookups. The lookups stayed flat while the traffic climbed. Reads track the clock, not the traffic, which is the property you want on the day something goes strange.

What that proves is that we designed for a spike. It does not prove we would survive twenty million hits in a minute, and we are not going to imply it does. We have never run that load. Nothing short of a Super Bowl could prove it, and we have not bought one.

What we can tell you is the arithmetic, because it is already published on our homepage. Delivering a scan costs us about 57 cents per million. Twenty million of them is about $11.40 of traffic.

That is the number our competitors also know. It is why a product that costs pennies to run gets sold as a subscription that switches your printed code off when you stop paying, and it is why we charge $7.99 once instead.

The code was never the fragile part. It is the only part of that entire Super Bowl night that did exactly what it was supposed to do, twenty million times, for free, forever, because it is ink.

Everything else is a choice about who you rent the rest from.

Buy a code that has no cap and no renewal date at graklink.com.