Those black-and-white squares on posters, menus and packages are QR codes. They let a phone camera read a web address or other text in an instant, with no typing. Understanding how they work also helps you scan them with more confidence.
Key takeaways
- A QR code stores data as a pattern of dark and light squares.
- Three large corner squares help the camera find the code and its orientation.
- Built-in error correction means a code can often be read even if partly damaged.
- A QR code only holds data; the link it contains can still lead to a harmful site.
- Check the link preview before opening it.
What the pattern means
QR stands for quick response. The code was invented in 1994 by Denso Wave, a Japanese company, to track car parts during manufacturing. A QR code is a grid in which each square, called a module, is either dark or light, representing binary data. The arrangement encodes characters such as the letters of a web address.
The three corner squares
Look at a QR code and you will see large squares in three corners. These finder patterns let a scanner quickly detect the code, work out its size and determine how it is rotated. That is why a code can be scanned from any angle. Smaller alignment patterns and timing patterns help correct for distortion on curved or tilted surfaces.
Error correction
QR codes include extra data using an error-correcting method known as Reed-Solomon coding. This allows a scanner to rebuild missing information if part of the code is dirty, scratched or covered. Designers can choose different levels of error correction, which is why some codes can carry a small logo in the middle and still work. Higher correction levels use more space and make the code denser.
How your phone reads it
A phone camera captures the image, software locates the finder patterns, straightens the grid and reads the modules. It then decodes the data, and if it recognises a web address, it typically shows a link you can tap. Many modern phone cameras do this automatically without a separate app.
Static and dynamic codes
A static QR code has its data fixed in the pattern. A dynamic code holds a short web address that redirects to another page, which allows the destination to be changed later and lets the owner track scans. Dynamic codes depend on the redirect service continuing to work.
Scanning safely
A QR code is not dangerous in itself, but the content it points to might be. Criminals sometimes place fake codes over real ones, for example on parking meters or posters, to send people to fraudulent sites. Sensible habits include:
- Check the link preview on your screen before opening it.
- Be cautious if a code leads to a page that asks for passwords or payment details.
- Look for signs a sticker has been placed over another code.
- Prefer typing the official website address if something feels wrong.
How QR codes are structured
QR codes come in forty sizes, called versions. Version 1 is a grid of 21 by 21 modules, and each higher version adds four modules on each side, up to version 40 at 177 by 177. A bigger version holds more data. Beyond the finder patterns at three corners, the code includes timing patterns, alignment patterns on larger versions and format information that tells the scanner which error correction level is used. Four levels, called L, M, Q and H, can restore roughly 7, 15, 25 and 30 percent of damaged data. The largest codes can store thousands of characters, though most everyday codes hold a short web address.
Common uses
QR codes are used in many places. Restaurants share menus through them, airlines and event organisers use them for boarding passes and tickets, and shops use them for payments, especially in places where mobile payments are popular. Manufacturers print them on packaging to link to instructions or product information. During the COVID-19 pandemic, they were widely used for contact tracing and health passes. Some websites use QR codes to sign in to accounts from a phone, and they are used for sharing Wi-Fi details or contact cards.
Design and best practice
If you create a QR code, a few rules make it easier to scan. Use strong contrast, usually dark on light, and leave a blank border around the code, called the quiet zone. Do not make it too small for the distance people will scan from. Use a short web address, because shorter text makes a simpler pattern, and test it on several phones before printing. Adding a logo is possible with higher error correction, but test thoroughly. Tell people what the code does, so that they know what to expect.
Quishing: phishing with QR codes
Criminals have adopted QR codes because people cannot read the destination by eye. In quishing, a fake code is placed over a legitimate one on a parking meter, poster or restaurant table, or sent in an email, to lead victims to a fraudulent payment or login page. Protect yourself by checking that the preview address matches what you expect, being wary of codes that ask you to enter passwords, and avoiding downloads prompted by a code. If a sticker looks like it has been placed over another, do not scan it.
Other two-dimensional codes
QR codes are one of several two-dimensional barcodes. Data Matrix codes are small and used for marking tiny components and medicines. Aztec codes, with a bullseye in the centre, appear on many train and airline tickets. Traditional barcodes, which store numbers in lines of varying width, are still used on most shop items. Each format is optimised for its use, and phone cameras can read many of them.
Frequently asked questions
Do I need an app to scan QR codes?
Most modern phone cameras can scan them directly.
Can a QR code carry a virus?
The code is just data, but the page or file it links to could be harmful, so be careful what you open or install.
Why do some QR codes have logos?
Error correction lets designers cover part of the code while keeping it readable.
Do QR codes expire?
A static QR code does not expire, because the data is built into the pattern. A dynamic code points to a redirect service, which may stop working if the service closes or the subscription ends. Choose a reliable provider if you need a code to last.
How much data can a QR code hold?
The largest version can store up to about 7,000 digits or roughly 4,000 letters and symbols, with lower capacity at higher error-correction levels. Most real codes hold much less, such as a web address.
Can I make my own QR code?
Yes. Many free generators and apps create them from a web address or text. Check that the generator is reputable, test the code, and be careful about codes that route through tracking services if privacy matters.
Sources and further reading
Written by
FactNest Editorial Team
FactNest is operated by Muonix. The FactNest Editorial Team publishes general-interest explainers with AI-assisted drafting and illustrations. Contact contact@muonix.co for questions or corrections; we respond within 2 business days.
More from this author →
