Technology 📅 October 22, 2026 ⏱ 13 min read

GS1 Digital Link on QR and RAIN RFID: The Dual-Carrier Rule, Resolver Behaviour and a Live Test

A GS1 Digital Link URI read from a QR code and a RAIN RFID tag, decoded from an EPC and sent to a GS1 resolver that answers with a redirect or a linkset

A RAIN RFID tag on a passport-ready product returns an EPC, a QR code beside it returns a web address, and a GS1 resolver decides what either one opens. This guide pins the current GS1 Digital Link documents, sets out the rule that keeps RAIN RFID next to a QR code, walks an EPC to a Digital Link bit by bit, and reports what the global resolver at id.gs1.org returned when we tested it on 22 October 2026.

Version pin

The single GS1 Digital Link 1.1 standard has been split into four documents (URI syntax, resolver, compression, semantics), and anything involving a RAIN RFID tag also leans on the General Specifications and the EPC Tag Data Standard. These are the releases checked for this article, each dated as printed on its title block.

Document	Release on the face	What it settles
GS1 Digital Link Standard: URI Syntax	Release 1.7.0, Ratified Aug 2026	URI grammar, canonical form, scanner recognition rules RE1–RE3
GS1-Conformant Resolver Standard	Release 1.2.1, “Ratfied” Aug 2026 (spelling as printed)	Redirects, linksets, status codes, decompression
GS1 Digital Link URI: Compression Technical Standard for EPC binary strings	Release 1.0.0, Ratified, Jul 2025	The `eh` and `ex` compressed forms
GS1 Digital Link Standard (legacy)	Version 1.1.4	Semantics; the older compression algorithm
GS1 General Specifications	Release 26.0, Ratified, Jan 26	Carrier rules (section 8.5, ASP 4; section 4.15)
EPC Tag Data Standard (TDS)	Release 2.3, Ratified, Oct 2025	SGTIN layouts and serial limits
Core Business Vocabulary (CBV)	Release 2.0, Ratified, Jun 2022	Which Digital Link forms may populate an EPCIS `epcList`
GSCN 23-103, Digital Product Passport	09-Apr-2025, provisional	GS1’s proposed DPP carrier choices

The URI Syntax change log lists 1.7.0 as Jul 2026 while its title block reads Aug 2026; we use the title block. On 22 October 2026 ref.gs1.org showed a maintenance notice, so each document was read from the Internet Archive capture of its official address (both are in the sources). Re-open the live pages before you freeze a specification against them.

Anatomy of a Digital Link URI

A GS1 Digital Link URI is an ordinary HTTPS address whose path carries GS1 Application Identifiers (AIs). Here is one with every optional part filled in:

https://brand.example/dpp/01/09528765123457/10/LOT42/21/123456789123?17=271231&camp=spring

  scheme ............ https://
  domain ............ brand.example
  path stem ......... /dpp                  optional, zero or more segments
  primary key ....... /01/09528765123457    AI 01, GTIN, always 14 digits
  key qualifiers .... /10/LOT42/21/123456789123   batch/lot, then serial
  data attribute .... 17=271231             AI 17, expiry date, query string only
  extension ......... camp=spring           non-numeric key, not part of the identity

The rules that trip implementations, with their section numbers in URI Syntax 1.7.0:

GTIN is always 14 digits (section 4.1). Since 1.4.0, GTIN-8, -12 and -13 are left-padded with zeros. Existing infrastructure should still accept legacy short GTINs; new implementations emit 14 digits.
Numeric AIs only. Convenience alphas such as gtin in place of 01 were deprecated in 1.2 and removed in 1.3.0.
Qualifiers keep a fixed order (section 4.9). For a GTIN the path is GTIN, then consumer product variant (22), then batch/lot (10), then serial (21). /01/09520123456788/21/12345XYZ/10/ABC123 is not permitted because the serial comes before the lot.
Data attributes live in the query string (section 4.10). Expiry date AI (17) and expiry date/time AI (7003) are attributes, so ?17=271231, never /17/271231.
Extension keys are never all-numeric (section 4.10.1): 23P=12098 is valid, 236=12098 is not, because 236 is reserved as a future AI. The restriction is on the key, not the value.
linkType and context are reserved for the resolver standard and are used only as it defines them.
A Digital Link is not a promise of a resolver (section 2). Applications are told not to assume one; the test is whether /.well-known/gs1resolver exists on that host.

Both the syntax and the resolver standard state conformance with ISO/IEC 18975:2024, encoding and resolving identifiers over HTTP.

Normalise before you store

One product instance can arrive as many strings: a brand domain from a QR code, a 13-digit GTIN from an old label, a linkType left in by an app. Store one form, the canonical GS1 Digital Link URI of section 4.12:

scheme https;
host id.gs1.org;
no convenience alphas, and GTINs padded to 14 digits;
the query string holds only GS1 AI keys, sorted in lexical (not numeric) order;
linkType, context and their values removed;
no trailing slash.

The standard’s example: http://example.com/01/09520123456788/22/2A?linkType=gs1:traceability becomes https://id.gs1.org/01/09520123456788/22/2A. Canonical is distinct from a reference Digital Link, which is any valid Digital Link on id.gs1.org.

What the scanner or reader layer is allowed to pass on

Section 6.1 lets a Digital Link-aware scanner pass a string on only when it is plausibly conformant; full validation belongs to the receiving application. Three regular expressions are offered: RE1 for uncompressed URIs, RE2 for the legacy compressed form, and RE3, new in 1.7.0, for EPC-binary strings, ending in (eh[0-9a-f]*|ex[a-zA-Z0-9_-]*)$. Try RE1 first, then RE2 or RE3; no match means the string is definitely not a Digital Link. RE2 is loose by design, which is why RE3 anchors on the flag. For a dictionary-driven check, section 6.1.4 points to the GS1 Barcode Syntax Resource, which validates AIs and values against the General Specifications.

The EPCIS link

For EPCIS events, CBV 2.0 section 8.2.2 narrows it further: epcList, parentID and childEPCs accept only Digital Link forms that mirror an EPC pure-identity scheme. For an SGTIN that is /01/{gtin}/21/{serial}. A QR code carrying GTIN + batch + serial is reduced to https://id.gs1.org/01/{gtin}/21/{serial} before it enters the event. Normalising once, at ingest, gives you that string.

Which carrier carries the Digital Link

The normative answer for consumer trade items sits in General Specifications 26.0, section 8.5, Application Standard Profile 4 (general retail consumer trade item with extended packaging). Read as a decision box:

Carrier	Role under ASP 4	Form of the Digital Link	Rule to design to
QR Code	Mandatory choice	Uncompressed	One of the two 2D codes is always present
Data Matrix	Mandatory choice	Uncompressed	Size and quality per GenSpecs Table 5-46
NFC tag	Optional, in addition to the 2D code	NFC Forum Well-Known Type URI record, identifier code 2 (`https://www.`) or 4 (`https://`)	Section 4.15.3: first NDEF record, same hostname and same GS1 values as the 2D code, same scheme as the QR
EPC/RFID (RAIN)	Additional carrier alongside the mandatory choice until Policy B11 is met	EPC binary in the EPC memory bank, decoded to a Digital Link per TDS/TDT	Section 4.15.2(a): an SGTIN EPC whose serial matches AI (21) character for character

GS1’s example of the Policy B11 condition is “90%+ of smart devices can read EPC/RFID tags.” Once met, EPC/RFID joins the mandatory options and could replace the 2D code. Until then, RAIN rides beside it.

ASP 4 also fixes how a RAIN tag reaches the web. The EPC is decoded to a Digital Link with the TDS/TDT algorithms: for SGTIN-96, SGTIN-198, SGTIN+ and DSGTIN+, software adds a pre-determined default host such as https://id.gs1.org; the ‘++’ schemes of TDS 2.3 carry their own. A smart device may emit the compressed eh/ex form, decompressed per the resolver standard before use. The EPC memory bank (MB01) must hold the EPC, any AIs the application needs (batch/lot is the example given) and, on the ‘++’ route, the host. Memory-bank layout is covered in our Gen2 EPC bank and PC word guide; the tag classes themselves are on the UHF RFID tags and HF and NFC pages.

For the CEN side, see our EN 18220 data carriers post.

From EPC to Digital Link: decode or compress

Two routes lead from a RAIN read to a Digital Link. Decode: your software parses the EPC per TDS and writes an uncompressed URI. Compress: the EPC is wrapped, unchanged, in a short URI for a resolver to unwrap.

Compression Technical Standard 1.0.0 defines the wrapping: previously reserved headers 7A and 7B, plus the bits 0001, render in RFC 4648’s URI-safe base 64 as eh and ex. After eh come lower-case hex characters, 4 bits each; after ex, base 64 characters, 6 bits each. The string follows a URI stem with exactly one slash and no query string or fragment. The motivating case is a hybrid UHF/NFC tag that presents its EPC over NFC as a URI without translating it on-chip.

The status has moved: the July 2025 compression standard advised closed systems only; GenSpecs 26.0 ASP 4 now allows the compressed form if it is decompressed per the resolver standard; URI Syntax 1.7.0 calls eh/ex the form expected in future application standards. The older compression algorithm is not maintained after 1.1.4. Either way, the 2D barcode carries the uncompressed form.

Worked decode of the standard’s own example

Input: https://example.com/eh30164596f40c0e5cbe991a83. Strip the stem and the eh flag, convert the 24 hex characters to 96 bits, and split them with TDS 2.3 Table 14-17 (SGTIN-96) and Table 14-16 (partition):

Segment	Bits	Binary	Value
EPC header	b95–b88	`00110000`	`0x30` = SGTIN-96
Filter	b87–b85	`000`	0 = All Others (TDS Table 10-1)
Partition	b84–b82	`101`	5 = 24-bit, 7-digit company prefix; 20-bit, 6-digit indicator + item reference
GS1 Company Prefix	b81–b58	`100100010110010110111101`	9528765
Indicator + item reference	b57–b38	`00000011000000111001`	012345
Serial	b37–b0	38 bits	123456789123

Rebuild the GTIN: indicator 0, company prefix 9528765, item reference 12345, then the mod-10 check digit. The weighted sum of 0952876512345 is 113, so the check digit is 7 and the GTIN is 09528765123457. The pure-identity EPC is urn:epc:id:sgtin:9528765.012345.123456789123, and the uncompressed Digital Link keeps the stem it arrived with: https://example.com/01/09528765123457/21/123456789123. With method 1’s default host it becomes https://id.gs1.org/01/09528765123457/21/123456789123 (52 characters).

The same 96 bits in base 64 give https://example.com/exMBZFlvQMDly-mRqD: 16 payload characters against 24 for eh. On id.gs1.org that is 37 characters, against 45 for eh and 52 uncompressed.

Before coding from section 4.2.2 (the ex option), note two slips: it says to append the base 64 string to ‘eh’ where ‘ex’ is meant, and step 2 says 6 bits per “hexadecimal” character where base 64 is meant. Its worked example uses ex correctly. For the bit layout itself, our SGTIN-96 walkthrough goes field by field.

Resolver behaviour

The GS1-Conformant Resolver Standard 1.2.1 defines what happens after the URI arrives. In order:

Transport. GET, HEAD and OPTIONS over HTTPS, with CORS.
Decompress. EPC binary strings (eh/ex) SHALL be decompressed; since 1.2.0 that is the only mandatory decompression. Linksets anchor on the decompressed URI.
Validate. Failing the basic tests (AI length, character set, check digit, structure) gets 400 Bad Request.
Look up. A valid URI for an unknown entity gets a simple 404 Not Found.
Linkset on request. linkType=linkset or Accept: application/linkset+json returns all links as an RFC 9264 linkset, validated against GS1’s schema, instead of a redirect.
Specific link type. If the requested linkType exists, redirect to it; if not, 404. That is a change from Digital Link 1.1, which fell back to the default.
Default. Otherwise redirect to the default link unless request headers allow a better match; where same-type links tie, return 300 Multiple Choices.
Never 200 for an error.

Around the flow: each entity has exactly one gs1:defaultLink, with a title, no optional attributes and a descriptive type such as gs1:pip. A serialised URI inherits GTIN-level links, synthesised in one response rather than by redirecting up the tree. The query string is passed through on redirect; a trailing slash is tolerated. Every conformant resolver publishes a description file at /.well-known/gs1resolver (RFC 8615) listing its supported primary keys. The standard does not fix the 3xx code; id.gs1.org used 307.

We tested id.gs1.org on 2026-10-22

Requests were sent with curl from New Delhi between 02:29 and 02:38 UTC on 22 October 2026, using GS1’s demonstration GTIN 09506000134352. For a like-for-like check we encoded it with serial 12345 as SGTIN-96 (filter 1, partition 5): 30364433400d1ec000003039 in hex, MDZEM0ANHsAAADA5 in base 64.

Request (host id.gs1.org)	What it tests	Status	What came back
`/.well-known/gs1resolver`	Description file	200	JSON: “The GS1 AISBL Resolver”, 16 supported primary keys, linkset context location
`/01/09506000134352/21/12345`	Uncompressed SGTIN	307	Location: the product information page (the default link)
Same, plus `?17=271231&foo=bar`	Query pass-through	307	Location carried `?17=271231&foo=bar` unchanged
Same, `Accept: application/linkset+json`	Linkset	200	`application/linkset+json`; anchor `https://id.gs1.org/01/09506000134352`; link types pip, hasRetailers, recipeInfo and exactly one defaultLink; Link header to the GS1 linkset context
Same, `?linkType=linkset`	Linkset, default Accept	200	An HTML linkset page
Same, `?linkType=gs1:recipeInfo`	Tie between language variants	300	List of three recipe links; adding `Accept-Language: es` gave 307 to the Spanish page
Same, `?linkType=gs1:instructions`	Link type not registered	404	Not Found
`/01/09528765123457/21/123456789123`	Valid URI, unknown entity (the compression standard’s example)	404	Not Found
`/01/09506000134353/21/12345`	Wrong check digit	400	Error `E002`, check digit incorrect
`/01/09506000134352/21/12345/10/ABC`	Serial before lot	400	Error `E041`, “Out of order sequence”
`/01/9506000134352` and a trailing-slash variant	Legacy 13-digit GTIN; trailing slash	307	Both redirected to the default link
`/eh30364433400d1ec000003039` and `/exMDZEM0ANHsAAADA5`	Row 2’s SGTIN, compressed	400	Error `E007`: the string was read as an invalid AI
`/eh30164596f40c0e5cbe991a83`, `/exMBZFlvQMDly-mRqD`, `/gAMRUwYcMwgHio`	The compression standard’s examples; GenSpecs 26.0 legacy example	400	Error `E007` for all three

Reading it neutrally. For uncompressed URIs, id.gs1.org behaved as the standard describes: 307 to the default, 404 for unknown entities and missing link types, 300 on a tie, 400 for syntax errors, query string passed through, linkset on request. On that date it did not decompress EPC binary strings: the eh and ex forms of an SGTIN it resolves uncompressed came back 400. This is a dated observation of a live service.

What we recommend. Decode at the edge. The software between the RAIN reader and the web, whether middleware on the reader, a gateway or the phone app, should turn the EPC into an uncompressed Digital Link (default host or the brand’s domain), check it against the Barcode Syntax Resource, then call the resolver. That works with any resolver, gives EPCIS its canonical form and keeps the raw EPC hex for audit. Re-run these before relying on compressed URIs in production:

curl -sI https://id.gs1.org/01/09506000134352/21/12345
curl -s -H "Accept: application/linkset+json" https://id.gs1.org/01/09506000134352/21/12345
curl -sI https://id.gs1.org/eh30164596f40c0e5cbe991a83

The DPP serial-number trap

Two GS1 texts, one ratified and one provisional, set the same serial rule.

General Specifications 26.0, section 4.15.2(a) (ratified, all sectors): RFID used beside a GTIN barcode carries an SGTIN EPC, and where the barcode has AI (21) it holds the same brand-assigned serial as the tag, no characters changed, no leading zeros added or removed.
GSCN 23-103, Digital Product Passport (09-Apr-2025, marked on its face as not ratified): carriers are QR Code or Data Matrix with Digital Link syntax, plus EPC/RFID in addition to one of them, with the SGTIN EPC and the same serial rule. GS1 has since listed a second provisional release; confirm its carrier note once ref.gs1.org is back. This is GS1 guidance, not law: the GSCN notes that data requirements will be set in EU delegated acts per sector.

The catch is TDS 2.3 section 14.6.1: SGTIN-96 stores the serial as a 38-bit integer, numeric from 0 to 274,877,906,943, with no leading zeros. Table 12-2 gives the alternatives:

Scheme	EPC bits	Serial numbers it holds
SGTIN-96	96	Numeric only, no leading zeros, 0 to 274,877,906,943
SGTIN-198	198	All values the General Specifications permit, up to 20 alphanumeric characters
SGTIN+	Variable, up to 216	Same as SGTIN-198
DSGTIN+	Variable, up to 236	Same as SGTIN-198, with a prioritised date

Worked example: five serials from one brand’s plan

Serial printed in the QR as AI (21)	Into SGTIN-96?	What a reader decodes	Outcome
`123456789123`	Yes	`123456789123`	Matches the QR
`0`	Yes (a single zero is allowed)	`0`	Matches the QR
`000123`	Only as the integer 123	`123`	Differs from the QR; use SGTIN-198 or SGTIN+
`A123`	No (not numeric)	—	Use SGTIN-198 or SGTIN+
`274877906944`	No (one above the 38-bit limit)	—	Use SGTIN-198 or SGTIN+

So the decision belongs at the inlay and label stage. If the serial plan has leading zeros, letters or values beyond the 38-bit range, the scheme is SGTIN-198 or SGTIN+ and the tag IC’s EPC memory must be large enough to hold it; check that line on the datasheet before ordering. A purely numeric plan without leading zeros, inside the range, round-trips cleanly in SGTIN-96. On tag and label orders the serial plan is the first thing we ask for, because the scheme, the memory size and the encoding script follow from it. Formats are on our RFID labels and inlays page; the passport side is on the Digital Product Passport page.

Frequently asked questions

What is a GS1 Digital Link resolver?

A web service that takes a GS1 Digital Link URI and either redirects to the most relevant online resource for that product or returns the full list of links. Under the GS1-Conformant Resolver Standard 1.2.1 it works over HTTPS with CORS, keeps exactly one default link per entity, returns an RFC 9264 linkset on request, decompresses eh/ex EPC strings and publishes a description file at /.well-known/gs1resolver. The global instance run by GS1 is id.gs1.org.

Can a Digital Product Passport use only an RFID tag without a QR code?

Under current GS1 rules the RAIN tag travels with a 2D code. General Specifications 26.0 ASP 4 makes QR Code or Data Matrix the mandatory carrier and allows EPC/RFID as an additional carrier until the Policy B11 conditions are met, and the provisional GS1 DPP application standard (GSCN 23-103) places RFID in addition to QR Code or Data Matrix. Legal requirements will come from the EU delegated acts for each product group.

What does a GS1 resolver return for an unknown product?

A syntactically valid Digital Link for an entity the resolver has no data on returns a simple 404 Not Found; a URI that fails validation returns 400 Bad Request; and a resolver never answers an error with 200. In our 22 October 2026 test, id.gs1.org returned 404 for the unregistered example GTIN 09528765123457 and 400 with error E002 for a GTIN with a wrong check digit.

What do 'eh' and 'ex' mean in a GS1 Digital Link?

They are the prefixes defined in the GS1 Digital Link URI Compression Technical Standard 1.0.0 for an EPC binary string carried inside a URI. Compression headers 7A and 7B followed by the bits 0001 render as eh and ex in URI-safe base 64. After eh the EPC is written in lower-case hex, 4 bits per character; after ex it is written in base 64, 6 bits per character. A 96-bit SGTIN takes 24 or 16 characters respectively.

How do I convert an EPC to a GS1 Digital Link?

Decode the EPC with the Tag Data Standard: header, filter, partition, company prefix, indicator and item reference, serial. Rebuild the 14-digit GTIN with its check digit and write https://{host}/01/{gtin}/21/{serial}. For SGTIN-96, SGTIN-198, SGTIN+ and DSGTIN+, General Specifications 26.0 ASP 4 says to use a pre-determined default host such as id.gs1.org. The EPC 30164596f40c0e5cbe991a83 becomes https://id.gs1.org/01/09528765123457/21/123456789123.

What is the latest version of the GS1 Digital Link standard?

As read on 22 October 2026: the GS1 Digital Link Standard: URI Syntax is Release 1.7.0, Ratified Aug 2026; the GS1-Conformant Resolver Standard is Release 1.2.1, Aug 2026; and the Compression Technical Standard for EPC binary strings is Release 1.0.0, Jul 2025. The former single standard, version 1.1.4, remains the legacy document for semantics.

Can an SGTIN-96 tag hold a serial number with leading zeros?

SGTIN-96 stores the serial as a 38-bit integer, so it holds numeric serials from 0 to 274,877,906,943 without leading zeros (TDS 2.3 section 14.6.1). A serial such as 000123 would decode as 123 and no longer match the QR code. For serials with leading zeros or letters, encode SGTIN-198 or SGTIN+, which carry up to 20 alphanumeric characters.