How QR Codes Actually Work

Where QR codes came from

QR codes were invented in 1994 by Masahiro Hara at Denso Wave, a Toyota subsidiary, to track car parts through the manufacturing process. Traditional barcodes held about 20 characters and had to be scanned in one orientation, which was slowing production lines.

Hara’s team wanted a code that could be read from any angle at high speed. The story is that the finder patterns — the three large squares — came from studying the ratio of black to white areas in printed matter to find a pattern that essentially never occurs by accident: 1:1:3:1:1.

The decision that made QR codes ubiquitous was commercial, not technical: Denso Wave holds the patents but chose never to enforce them, and published the specification as an open standard (now ISO/IEC 18004). Anyone can generate or read them without a licence.

Adoption in the West was slow until two things happened: native camera scanning arrived in iOS 11 (2017) and Android, removing the need for an app, and the pandemic made contactless menus and check-ins routine.

What is inside a QR code

Every QR code contains fixed structural elements plus the data itself:

• Finder patterns — the three large squares in the corners. They let a scanner locate the code and determine its rotation instantly.
• Alignment patterns — smaller squares that correct for distortion when the code is on a curved surface or photographed at an angle.
• Timing patterns — alternating black and white modules between the finders, which establish the grid size.
• Format information — the error correction level and mask pattern, stored redundantly near the finders.
• Data and error correction codewords — the payload, interleaved with Reed-Solomon parity.
• Quiet zone — four modules of blank margin. Codes fail to scan surprisingly often because a designer cropped this away.

Codes come in 40 versions, from version 1 at 21×21 modules to version 40 at 177×177. Each step adds four modules per side. The generator picks the smallest version that fits your data.

Encoding modes and capacity

QR codes have four data modes, and the mode determines how efficiently characters are packed:

The practical consequence is worth knowing: alphanumeric mode only supports uppercase. A URL written as HTTPS://EXAMPLE.COM/PAGE uses alphanumeric mode at 5.5 bits per character; the same URL in lowercase forces byte mode at 8 bits, producing a visibly denser code. Domain names are case-insensitive, so uppercasing the host is free. Paths usually are case-sensitive, so leave those alone.

Reed-Solomon error correction

QR codes work when partly damaged because they carry Reed-Solomon error correction — the same family of codes used on CDs, DVDs, DSL lines and the Voyager probes.

The principle is that the data is treated as coefficients of a polynomial, and extra evaluation points are added. Any sufficiently large subset of the points reconstructs the original polynomial, so lost or corrupted codewords can be recovered rather than merely detected.

Level H is what makes logo-in-the-middle QR codes work: the logo destroys modules, and error correction reconstructs them. Keep the covered area under about 25% of the code even at level H, and never let it touch a finder pattern.

Generate codes at any level with the QR code generator.

Designing codes that actually scan

1. Contrast. Dark modules on a light background. Inverted codes fail on many scanners because the specification assumes dark-on-light. Aim for a contrast ratio above 3:1 — check it with the contrast checker.
2. Quiet zone. Four modules of margin on all sides, non-negotiable. This is the most common cause of a code that “sometimes works”.
3. Size. A rough rule is scanning distance divided by ten. A poster read from 2 m needs about 20 cm; a business card read from 30 cm needs about 3 cm. Never print below 2 cm.
4. Keep the URL short. Fewer characters means fewer modules, larger modules at the same physical size, and a much easier scan.
5. Never distort. Stretching, skewing or wrapping around a curve breaks the geometry the alignment patterns assume.
6. Test on real devices. Old Android phones, cracked screens, poor lighting, at an angle, from the intended distance.

Static versus dynamic codes

Static codes encode the destination directly. They work forever, cost nothing, depend on no third party and cannot be tracked or changed.

Dynamic codes encode a short redirect URL controlled by a service. The destination can be changed after printing and scans can be counted, but you have introduced a permanent dependency: if that service disappears or you stop paying, every printed code becomes dead.

A middle path avoids the trap. Encode a short URL on your own domain — example.com/r/menu — and handle the redirect yourself. You get editability and analytics with no external dependency, and the code keeps working as long as your domain does.

QR code security

“Quishing” — phishing via QR codes — grew sharply from 2023 onward, because a QR code hides its destination and email filters cannot read the URL inside an image.

Common attacks: stickers placed over legitimate codes on parking meters, restaurant tables and EV chargers; codes in phishing emails leading to credential harvesting pages; codes on fake invoices redirecting payment.

For users: check the URL preview your camera shows before tapping, be suspicious of codes on stickers that look applied rather than printed, and never enter credentials on a page reached by scanning an unsolicited code.

For organisations: print codes directly on materials rather than applying stickers, use your own domain so the destination is recognisable, print the URL in text alongside, and inspect physical codes periodically for tampering.

Frequently Asked Questions