For generating the barcode image, free tools are exactly as legitimate as paid ones — the symbology specs are public and the math is the math. The real questions are about privacy, strings attached, and a particular scam to avoid.
An EAN-13 generated by a free tool and one from a $200 suite are byte-for-byte interchangeable if both follow the spec. What a generator can never sell you legitimately is a retail number: GTINs come only from GS1. Any site bundling "barcode + registration" for a one-off fee is reselling someone else's prefix — the listing-killer covered in our Amazon GTIN guide.
Many free generators send your input to a server to render the image. For a product GTIN that hardly matters; for bulk customer lists, WiFi passwords or vCard contact sheets it absolutely does. Prefer tools that generate client-side in your browser. Ours does — the generation libraries are bundled with the page, and nothing you type is transmitted anywhere.
Common free-tier strings: a watermark printed into the code area (can break scanning), raster-only downloads too small for print, and — worst — "dynamic" QR codes that route through the vendor's redirect domain and die when the trial ends. A barcode or static QR has no business expiring. Look for SVG export and a plain statement that codes are static.
A trustworthy generator computes check digits, rejects malformed input, and warns about scannability (contrast, logo coverage, quiet zones) instead of happily rendering garbage. Test one: type an EAN with a wrong final digit — a good tool names the digit it expected.