How QR Codes Actually Work — and How to Use Them Safely

QR codes went from novelty to everyday infrastructure in just a few years. You scan them on restaurant menus, event tickets, product packaging, and payment screens without a second thought. But what is actually inside that square of black-and-white dots, and why does it still work when it is crumpled, partly covered, or printed with a logo in the middle? The design is genuinely clever.

QR stands for "Quick Response". It is a two-dimensional barcode: where a traditional barcode stores a number in a row of lines read left to right, a QR code stores data in a grid read in two directions at once. That two-dimensional layout lets it hold vastly more — a traditional retail barcode holds around a dozen digits, while a QR code can store thousands of characters, enough for a full web address, contact card, or Wi-Fi network detail.

It was invented in 1994 by Masahiro Hara and his team at Denso Wave, a Japanese automotive components company, to solve a mundane factory problem: tracking parts through a production line faster than a conventional barcode allowed, and from any angle. The design goal was speed of reading, which is where the name comes from. Hara has said the finder patterns — the three large squares — were chosen after surveying printed material to find a pattern that almost never occurs by accident, so a scanner would not mistake ordinary artwork for a code.

The decision that made QR codes ubiquitous, though, was commercial rather than technical: Denso Wave held patents but chose not to enforce them, publishing the specification as an open standard. Anyone could implement it for free. A proprietary format with licensing fees would almost certainly never have ended up on every restaurant table in the world.

The data itself is stored as a grid of small squares called modules, each either dark or light, representing the 1s and 0s of binary. But a scanner has to first find and orient the code, which is the job of the distinctive features you can see by eye. The three large squares in the corners are "finder patterns" that tell a camera "this is a QR code, and here is its rotation". Smaller alignment patterns and timing lines help the scanner correct for the angle and curvature of whatever surface the code is printed on.

That is why you can scan a QR code sideways, upside down, or off a curved coffee cup — the finder patterns let the software work out the orientation before it reads a single bit of data.

There is one more invisible step: masking. A code with large blank areas or long uninterrupted runs of the same module is harder for a scanner to read reliably, and a random-looking pattern is much easier. So the encoder tries eight standard masking patterns, each an XOR applied across the data area, scores the result against penalty rules, and keeps whichever produces the most evenly distributed pattern. Which mask it chose is recorded in the format information stored beside the finder patterns, so the scanner can undo it. This is why two QR codes containing identical data can look completely different.

QR codes come in 40 sizes, called versions. Version 1 is a 21×21 grid of modules; each version up adds four modules per side, ending at version 40, which is 177×177. Bigger versions hold more data and, on paper, more of it — which is why a code encoding a long URL looks visibly denser than one encoding a short one.

At the maximum size and the weakest error correction, a QR code holds up to 7,089 numeric digits, 4,296 alphanumeric characters, 2,953 bytes of arbitrary binary data, or 1,817 kanji characters. Those four figures correspond to the four encoding modes, and the difference between them is not trivial: numeric mode packs three digits into ten bits, while byte mode spends eight bits per character. An encoder picks the most efficient mode your content allows, which is why a code containing only digits can be substantially smaller than one containing the same number of mixed characters.

A practical consequence: uppercase URLs encode more compactly than mixed-case ones, because alphanumeric mode covers digits, uppercase letters and a few symbols, but any lowercase letter forces the whole segment into byte mode. It is a genuine trick for keeping a printed code sparse and easy to scan.

QR codes include built-in error correction using a mathematical technique called Reed–Solomon coding — the same family of methods that keeps CDs playing through scratches. Depending on the chosen level, anywhere from about 7% to 30% of the code can be missing or obscured and the original data can still be reconstructed perfectly.

This redundancy is what allows brands to drop a logo into the center of a QR code or print it on imperfect surfaces. At the highest error-correction level, nearly a third of the code is "spare" — which is also why those codes look denser, since they pack in extra recovery data.

There are four levels to choose from, and the names are just letters: L recovers about 7% of the code, M about 15%, Q about 25%, and H about 30%. M is the usual default and is right for most screen and print use. H is worth the extra density if the code will carry a logo, sit on packaging that gets scuffed, or be printed on fabric or a curved surface. Going straight to H for everything is a common mistake: it inflates the module count, which makes each module physically smaller at the same printed size, which can make the code harder to scan rather than easier.

A static QR code encodes its data directly and permanently — the destination is baked into the pattern and never changes. A dynamic QR code instead encodes a short redirect link controlled by a service, so the owner can change where it points later, and often track how many times it was scanned. Both look identical to you; the difference is what sits behind them.

The trade-offs are worth knowing before you print a thousand of something. A static code works forever and depends on nobody: there is no service to keep paying, no company that can go out of business and take your links with it. But if the destination changes, every printed copy is dead. A dynamic code is editable and gives you scan analytics, at the cost of a permanent dependency on a third party, and it makes the destination invisible even to a careful user — the previewed URL is the shortener's, not the real one.

A reasonable rule: use static codes for anything permanent and self-contained (a Wi-Fi password on a guest-room card, a contact detail, a link to a domain you control), and dynamic codes only where the ability to change the destination is genuinely worth the dependency. If you do use a dynamic code, point it at a redirect on your own domain rather than a third-party shortener — you keep the editability and the previewed URL still tells the user who they are trusting.

Because a QR code hides its destination until you scan it, scammers exploit them — a tactic nicknamed "quishing" (QR phishing). Fake codes get stuck over real ones on parking meters, posters, or payment terminals, sending you to a lookalike site that harvests your card details or login. Protect yourself: preview the URL before opening it (most phone cameras show it first), be suspicious of codes that demand urgent payment or login, avoid scanning codes on stickers that look applied over something else, and never install an app a scanned code pushes you toward.

Creating a QR code is simple and free. QTNest's QR Code Generator turns any link or text into a downloadable, high-resolution code entirely in your browser — your data is never uploaded — and lets you tune the size and error-correction level. For products and shipping labels where a traditional 1D barcode is required instead, the Barcode Generator covers Code 128, EAN-13, and UPC formats.

Most QR codes that fail in the real world fail for the same handful of reasons, and all of them are avoidable at design time.

Leave the quiet zone. The specification requires a clear margin of four modules of blank space on all sides, and scanners genuinely need it to locate the finder patterns. Cropping tight to the edge of the code, or letting a background pattern run right up to it, is the single most common cause of a code that will not read.

Respect the size-to-distance ratio. A workable rule of thumb is that the printed code should be about a tenth of the distance it will be scanned from — a code read at arm's length (say 30cm) wants to be around 3cm across, while one on a poster read from three metres needs to be roughly 30cm. Anything under about 2cm is unreliable for phone cameras regardless of distance.

Keep the contrast conventional. Dark modules on a light background, with real contrast between them. Inverting it — light modules on dark — breaks a significant number of scanners, because many implementations assume the standard polarity. Avoid low-contrast brand color pairings, avoid gradients across the code, and never print on a reflective or heavily textured surface if you can help it.

Finally, always test the finished artwork, on more than one phone, at the actual printed size, before committing to a print run. Test the file that goes to the printer rather than the one on your screen — resizing a code in a layout program can introduce interpolation that blurs module edges just enough to break it.