How QR Codes Actually Work — and How to Use Them Safely

QR codes went from novelty to everyday infrastructure in just a few years. You scan them on restaurant menus, event tickets, product packaging, and payment screens without a second thought. But what is actually inside that square of black-and-white dots, and why does it still work when it is crumpled, partly covered, or printed with a logo in the middle? The design is genuinely clever.

QR stands for "Quick Response". It is a two-dimensional barcode: where a traditional barcode stores a number in a row of lines read left to right, a QR code stores data in a grid read in two directions at once. That two-dimensional layout lets it hold vastly more — a traditional retail barcode holds around a dozen digits, while a QR code can store thousands of characters, enough for a full web address, contact card, or Wi-Fi network detail.

The data itself is stored as a grid of small squares called modules, each either dark or light, representing the 1s and 0s of binary. But a scanner has to first find and orient the code, which is the job of the distinctive features you can see by eye. The three large squares in the corners are "finder patterns" that tell a camera "this is a QR code, and here is its rotation". Smaller alignment patterns and timing lines help the scanner correct for the angle and curvature of whatever surface the code is printed on.

That is why you can scan a QR code sideways, upside down, or off a curved coffee cup — the finder patterns let the software work out the orientation before it reads a single bit of data.

QR codes include built-in error correction using a mathematical technique called Reed–Solomon coding — the same family of methods that keeps CDs playing through scratches. Depending on the chosen level, anywhere from about 7% to 30% of the code can be missing or obscured and the original data can still be reconstructed perfectly.

This redundancy is what allows brands to drop a logo into the center of a QR code or print it on imperfect surfaces. At the highest error-correction level, nearly a third of the code is "spare" — which is also why those codes look denser, since they pack in extra recovery data.

A static QR code encodes its data directly and permanently — the destination is baked into the pattern and never changes. A dynamic QR code instead encodes a short redirect link controlled by a service, so the owner can change where it points later, and often track how many times it was scanned. Both look identical to you; the difference is what sits behind them.

Because a QR code hides its destination until you scan it, scammers exploit them — a tactic nicknamed "quishing" (QR phishing). Fake codes get stuck over real ones on parking meters, posters, or payment terminals, sending you to a lookalike site that harvests your card details or login. Protect yourself: preview the URL before opening it (most phone cameras show it first), be suspicious of codes that demand urgent payment or login, avoid scanning codes on stickers that look applied over something else, and never install an app a scanned code pushes you toward.

Creating a QR code is simple and free. QTNest's QR Code Generator turns any link or text into a downloadable, high-resolution code entirely in your browser — your data is never uploaded — and lets you tune the size and error-correction level. For products and shipping labels where a traditional 1D barcode is required instead, the Barcode Generator covers Code 128, EAN-13, and UPC formats.