What Is a QR Code and How It Works

July 29, 2026

A QR (“Quick Response”) code is a two-dimensional barcode that a camera can read from almost any angle and at a range of sizes. It was invented in 1994 by Denso Wave, a Toyota subsidiary, to track car parts on an assembly line; smartphone cameras with built-in scanning made it universal about a decade ago.

What is inside the pattern

A QR code is a square grid of black and white cells (“modules”). The structure has distinct parts:

• Finder patterns — the three large nested squares in the top-left, top-right, and bottom-left corners. A scanner uses these to locate the code in a photo and work out its orientation and perspective, so it reads correctly even when the image is rotated or taken at an angle.
• Timing patterns — the dotted single-cell lines running between the finder patterns. They tell the scanner the size of the grid and keep row/column counting aligned.
• Alignment patterns — smaller nested squares scattered through larger codes, correcting for lens and surface distortion.
• Format and version information — cells near the finders that encode the error-correction level and the grid size.
• Data and error-correction modules — everything else. The payload is encoded as bits, laid out in a zig-zag pattern from the bottom-right, and interleaved with Reed-Solomon error-correction bits so damage is spread out rather than concentrated.

The more data you encode, the larger the grid: QR “versions” run from 1 (21×21 modules) to 40 (177×177). A short URL might be version 3–4; a long one with high error correction can push to version 10+.

What a QR code can hold

Most commonly a URL, but also plain text, a phone number (tel:), an SMS (sms:), an email (mailto:), Wi-Fi credentials (WIFI:S:...;T:WPA;P:...;;), a calendar event, a geo-location, or a vCard contact. Capacity depends on the version and error-correction level; a version-40 code at the lowest correction level holds up to about 2,953 bytes, but practical scannable codes are far smaller.

Static vs dynamic codes

• Static. The data is baked directly into the pattern. Encode https://example.com and that URL is the code. It never expires, can be generated entirely offline, involves no third party, and cannot track who scans it. The downside: to change the destination you must reprint the code.
• Dynamic. The pattern encodes a short link to a redirect service, which forwards to the real destination. The owner can change the target later and see scan counts, locations, and devices — useful for marketing, but it depends on that service staying online and paid for, and it logs your scanners.

The QR code generator here produces static codes, so nothing you encode is sent anywhere and the code will keep working indefinitely.

Error correction: why a scratched code still scans

QR codes use Reed-Solomon error correction, the same mathematical family used on CDs, DVDs, and in deep-space communication. You pick a level when generating the code:

Higher levels add redundant data, so the grid gets denser for the same payload. That density is the price of a code that still reads with a coffee-cup ring, a crease, or a small printing defect across it.

Are QR codes safe to scan?

The code itself is just data — text or a URL — so it cannot “infect” your phone on its own. The risk is entirely in where a URL sends you: a malicious code can point to a phishing page that mimics a login, a payment page, or an app-store listing, or to a WIFI: string that joins you to a hostile network. Attackers have stuck fake codes over real ones on parking meters and restaurant tables (“quishing”).

Sensible habits:

• Preview the URL before opening it — most phone cameras and QR apps show the destination first. Check the domain, not just that it “looks official.”
• Be wary of codes that lead straight to a login or payment form, especially if they arrived by email or were posted in public.
• A shortened link (bit.ly/…) in a code hides the real destination — expand it or skip it.
• For WIFI: codes, only scan ones from a source you trust.

Where QR codes are used well

• Payments — the dominant way to pay in much of Asia; the code encodes a merchant ID and (sometimes) an amount.
• Restaurant menus, event tickets, boarding passes — the code is a lookup key or a signed token.
• Wi-Fi sharing — a WIFI:S:<name>;T:WPA;P:<password>;; string joins the network with no typing.
• App install and “add contact” — deep links and vCards.
• Product packaging and manuals — linking to setup videos, registration, or authenticity checks.
• 2FA setup — the code carries the shared TOTP secret for your authenticator app (otpauth://…).

Making one that actually works in print

• Keep the quiet zone. Leave a clear margin of at least 4 modules’ width all around the code — scanners need the blank border to find the edges. Codes butted right against other artwork often fail.
• Maintain contrast. Dark code on a light background. Inverted (light on dark) codes are unreliable; coloured codes need strong contrast and a light background.
• Do not stretch it. Keep it square.
• Size for the scan distance. A rough rule is the code should be at least 1/10th of the expected scanning distance — about 3 cm for something read at 30 cm, much larger for a poster or billboard.
• If you overlay a logo, use error-correction level H and keep the logo under ~20% of the area, clear of the finder patterns.
• Test the real print, at the real size, with several phones before ordering in quantity. Include the plain URL nearby as a fallback.

The bottom line

A QR code is a self-orienting grid that stores data (usually a URL) with built-in Reed-Solomon error correction, so it tolerates real-world damage. Static codes embed the data permanently and privately; dynamic codes trade that for editability and tracking via a third-party redirect. For a code that lasts, generate a static one with generous quiet space, strong contrast, and adequate size, and always test the physical print. Make one with the QR code generator.