QR codes look like random arrangements of black and white squares, but almost every part of the grid has a specific job. Some patterns help a camera find and straighten the symbol. Other modules describe its format, hold the message, or provide enough redundancy to recover bytes that were obscured by dirt or damage.

That combination makes a QR code more than a compact web link. It is a standardized, machine-readable data container that can hold text, identifiers, contact details, network credentials, application commands, binary data, and many other payloads. The code itself does not require the internet, and it does not inherently track anyone. What happens after a scan depends on the data inside it and the app interpreting that data.

This guide explains the complete journey from a message to a finished symbol, how a scanner reverses the process, what QR codes can contain, and how to design and deploy them without sacrificing reliability or security.

What “QR” Means and Why the Format Was Created

QR stands for Quick Response. DENSO WAVE announced the format in 1994 after a small development team led by Masahiro Hara designed it for fast reading and greater capacity than the one-dimensional barcodes used in manufacturing. The distinctive corner patterns were chosen so readers could locate the code quickly and determine its orientation from any direction.

The familiar square QR code used today is normally QR Code Model 2. It improved the original Model 1 with alignment patterns that help readers compensate for distortion. The format became an international standard in 2000; the current published specification is ISO/IEC 18004:2024.

Unlike a traditional barcode, which primarily varies bars along one axis, a QR code stores information across two dimensions. This gives it much more capacity in a compact area while retaining fast optical recognition.

A QR symbol contains a sequence of data. That sequence may happen to be a URL, but the QR format has no special dependency on websites. A scanner decodes the bytes first and then decides how to present or act on them.

Common payloads include:

  • Plain text, serial numbers, asset IDs, or short instructions
  • Website URLs and app deep links
  • Email addresses or prefilled email messages
  • Phone numbers and prefilled SMS messages
  • Contact cards using formats such as vCard or MeCard
  • Wi-Fi network names, authentication types, passwords, and hidden-network flags
  • Geographic coordinates and map links
  • Calendar events
  • Product, inventory, shipping, and manufacturing identifiers
  • Tickets, boarding passes, coupons, and access tokens
  • Payment instructions defined by a bank, wallet, or national payment scheme
  • Sign-in, device-pairing, and multi-factor authentication setup data
  • GS1 identifiers and GS1 Digital Link addresses for retail products
  • Small binary payloads understood by specialized systems

Many of these are conventions layered on top of QR. For example, a string beginning with https:// is recognized as a web address, tel: can request a phone call, and a structured WIFI: payload can describe a wireless network. The QR decoder recovers text or bytes; the phone, wallet, camera app, or industrial reader gives those bytes meaning.

This distinction explains why support varies. A reader may decode a calendar payload but display it as plain text if it does not understand the calendar convention. Specialized payment and ticket codes may require the issuer’s app. Encoding data successfully does not guarantee that every scanner knows what to do with it.

The Anatomy of a QR Code

The smallest square in the grid is called a module. A module is conceptually dark or light, even when a designer renders it as a dot or another shape. Modules are divided between fixed functional patterns and the encoded data area.

Quiet Zone

The empty border around a QR code is part of its practical design. For a standard QR code, it should be at least four modules wide on every side. The quiet zone lets a reader separate the symbol from text, borders, images, and other visual noise. Cropping it away is one of the most common reasons an otherwise valid code becomes unreliable.

Finder Patterns and Separators

The three large squares in the upper-left, upper-right, and lower-left corners are finder patterns, sometimes called position detection patterns. Their alternating dark and light widths form a recognizable 1:1:3:1:1 ratio when scanned through the center.

Readers use the three locations to identify the symbol, establish its orientation, and estimate its size. A one-module light separator around each finder pattern keeps it distinct from neighboring content.

Timing Patterns

Alternating dark and light modules connect the finder regions horizontally and vertically. These timing patterns help the reader determine the grid spacing and map camera pixels to individual modules.

Alignment Patterns

Version 2 and larger QR codes add one or more smaller target-like alignment patterns. They give the decoder reference points for correcting perspective, curvature, lens effects, or uneven printing. More patterns appear as versions become larger.

Format Information

Two copies of a short format-information sequence sit near the finder patterns. They identify the selected error-correction level and the mask pattern applied to the data area. The format information has its own error protection because the rest of the symbol cannot be interpreted correctly without it.

Version Information

Versions 7 through 40 include duplicated version-information fields. Smaller symbols can be identified from their dimensions alone; larger ones explicitly encode the version as an additional safeguard.

The Dark Module

A fixed dark module appears in a specified position beside the data region. It is part of the symbol’s required function pattern, not message data.

Data and Error-Correction Modules

The remaining available modules carry the message, control bits, padding, and error-correction codewords. They are visually interwoven, so a damaged patch tends to affect portions of multiple blocks rather than erasing a single continuous section of the message.

Versions, Dimensions, and Maximum Capacity

Standard Model 2 QR codes have 40 versions. Version 1 is a 21 × 21 module grid. Each new version adds four modules per side, so Version 2 is 25 × 25 and Version 40 is 177 × 177.

The dimension of a standard symbol can therefore be calculated as:

modules per side = 21 + 4 × (version - 1)

Capacity is not one fixed number. It depends on the version, encoding mode, error-correction level, and sometimes the number of times the encoder switches between modes. Under the most capacity-friendly standard conditions, a Version 40 symbol can hold up to:

Encoding mode Maximum content
Numeric 7,089 digits
Alphanumeric 4,296 characters
Byte 2,953 bytes
Kanji 1,817 characters

These are upper limits, not recommended payload sizes. Higher error correction reduces capacity. Unicode text usually uses multiple UTF-8 bytes per character, so 2,953 bytes does not necessarily mean 2,953 visible characters. Long data also produces a denser symbol whose individual modules must still be large enough for the intended camera, distance, surface, and print process.

In practice, a short URL or identifier is often more reliable than embedding a large document. QR codes can technically carry binary data, but their roughly 3 KB ceiling makes direct storage of normal photos, audio, PDFs, or software impractical. A link to the file is usually the better design.

The Four Main Encoding Modes

An encoder can divide one payload into segments and choose a mode for each segment. Efficient encoders switch modes when doing so makes the bit stream smaller.

Numeric Mode

Numeric mode accepts digits 0 through 9. It compresses groups of three digits into 10 bits, making it the most space-efficient standard mode.

Alphanumeric Mode

Alphanumeric mode supports digits, uppercase A-Z, a space, and nine symbols: $, %, *, +, -, ., /, and :. Pairs of characters are compacted into 11 bits.

Lowercase letters are not part of this mode. A lowercase URL will therefore normally require byte mode for at least part of the payload.

Byte Mode

Byte mode stores 8-bit values and is the practical choice for most general text and binary content. Modern applications commonly encode Unicode text as UTF-8 bytes. Character encoding still matters: a decoder must interpret the recovered bytes the same way the encoder intended.

Kanji Mode

Kanji mode efficiently represents selected double-byte Japanese characters in 13 bits each. It was an important capability for the format’s original Japanese use cases.

The specification also defines control modes. ECI can identify a character encoding or interpretation, FNC1 supports GS1 and other application-identifier workflows, and Structured Append can divide one logical message across as many as 16 QR symbols. Real-world scanner support for less common features—especially Structured Append—should be tested rather than assumed.

How a QR Code Is Generated, Step by Step

A QR generator does considerably more than turn each input bit into a black or white square.

1. Analyze and Segment the Input

The encoder examines the payload and chooses numeric, alphanumeric, byte, Kanji, or a combination. Good segmentation can fit the same message into a smaller version.

2. Write the Mode and Length

Each segment begins with a mode indicator followed by a character-count field. The size of that count field depends on the mode and version range.

3. Encode the Content Bits

The characters are converted according to the selected mode. Numeric triples, for example, become compact binary values; byte-mode content becomes a sequence of bytes.

4. Terminate and Pad the Data

A terminator marks the end when space allows. The stream is extended to a whole-byte boundary, then alternating pad codewords are added until the chosen version’s data capacity is filled. This produces a precisely sized data-codeword sequence.

5. Create Reed–Solomon Error Correction

The data is divided into blocks. For each block, the encoder calculates Reed–Solomon error-correction codewords using arithmetic over a finite field. These extra codewords let the reader reconstruct missing or incorrect values without knowing in advance which modules were damaged.

6. Interleave the Blocks

Data and error-correction codewords from the blocks are interleaved. Spreading adjacent bytes across the symbol improves resistance to a localized smear, scratch, fold, or obstruction.

7. Place Bits into the Grid

After reserving the functional patterns, the encoder places bits through the remaining modules in a two-column zigzag path, generally moving from the lower-right toward the left and skipping reserved areas.

8. Apply and Evaluate a Mask

Large blank areas, long runs, and patterns resembling finder patterns can confuse optical recognition. To avoid them, the encoder tries eight mathematical mask patterns. A mask flips selected data-area modules according to a simple coordinate rule; it does not change the underlying payload.

Each candidate is scored for undesirable visual features. The lowest-penalty result is selected, and its mask number is recorded in the format information so the decoder can reverse it.

9. Add Format and Version Information

Finally, the encoder writes the error-correction level, chosen mask, and—where required—the version information into their reserved locations. The completed module matrix can then be rendered as pixels, vector shapes, printer dots, laser marks, or another physical medium.

How a Scanner Decodes It

A camera scanner performs the reverse operation, with image processing around it:

  1. It searches the image for finder-pattern ratios and groups three patterns into a candidate symbol.
  2. It determines orientation, estimates the grid, and uses alignment and timing patterns to correct perspective or distortion.
  3. It samples the center of each expected module to classify it as dark or light.
  4. It reads and error-corrects the format and version information.
  5. It removes the specified mask and extracts codewords in the defined traversal order.
  6. It deinterleaves the blocks and uses Reed–Solomon decoding to detect and repair recoverable errors.
  7. It parses mode and length fields, converts the content back into digits, characters, or bytes, and returns the payload.
  8. The scanning application interprets that payload and may offer an action such as opening a link, joining Wi-Fi, adding a contact, or launching another app.

This process explains why QR scanning can still work at an angle and after limited damage. It also explains why a code may decode slowly: the camera can see a square symbol, but low contrast, blur, glare, deformation, or heavy styling makes its module decisions uncertain.

Error Correction: What L, M, Q, and H Mean

QR uses Reed–Solomon error correction at four selectable levels:

Level Approximate recoverable codewords Typical tradeoff
L 7% Highest data capacity, least redundancy
M 15% Balanced default for normal use
Q 25% More tolerance for dirt or damage
H 30% Most redundancy, lowest data capacity

These percentages are useful approximations, not a promise that the same percentage of any picture can be covered. Damage location matters, codewords are distributed in blocks, and the finder, timing, format, quiet-zone, and alignment structures must still be recognizable. A large logo can destroy critical modules even when its area seems smaller than the advertised correction percentage.

Level M is a sound general default. Q or H can help in industrial environments, on packaging likely to be scratched, or behind a carefully sized center logo. Increasing correction may also force a higher version, creating more and smaller modules at the same printed size. That can offset the benefit if the output becomes too dense for the camera or printer.

Static and Dynamic QR Codes

“Static” and “dynamic” describe how a QR code is deployed, not two different QR symbologies.

A static code contains the final payload itself. If it contains https://example.com/menu.pdf, those characters are fixed in the symbol. Changing the destination requires replacing the printed code unless the same URL remains under your control and you change what the server returns.

A commercial dynamic QR service usually encodes a short redirect URL controlled by that service. Its dashboard can later change the redirect destination, apply rules, or record scans without changing the printed modules.

Dynamic codes can provide editable destinations, smaller payloads, expiration, campaign routing, and analytics. They also add dependencies: the redirect domain, account, subscription, privacy practices, and service must remain available. A static code works offline when its payload is intrinsically useful offline, and it does not send scan analytics by itself.

Not every QR-family symbol is the standard three-corner square seen on posters.

  • Model 1 is the original form. Model 2 is the improved, widely used standard form with alignment patterns and versions up to 40.
  • Micro QR Code uses one finder pattern and a two-module quiet zone. Its M1 through M4 sizes trade capacity for very small labels; the largest holds up to 35 numeric digits under its most favorable setting.
  • rMQR Code is rectangular, intended for narrow areas where a square symbol is awkward while offering more capacity than Micro QR.
  • Structured Append uses multiple standard QR symbols that can be reconstructed as one logical message, subject to compatible reader support.
  • SQRC is a DENSO WAVE variant with restricted-reading functionality for specialized deployments. It should not be confused with ordinary encrypted content or assumed to work in general phone cameras.
  • FrameQR provides a defined canvas area for graphics or text without simply painting over arbitrary data modules. It is a specialized DENSO WAVE format rather than a license to cover the middle of every standard code.

There are also other two-dimensional barcodes, such as Data Matrix, PDF417, Aztec Code, and MaxiCode. They may look related but use different symbol structures and standards.

What QR Codes Cannot Do by Themselves

QR codes are capable, but several popular claims give the square grid too much credit.

  • A QR code does not inherently redirect. A URL or redirect service does.
  • It does not inherently track scans. A web server, analytics platform, payment network, or app may do that after decoding.
  • It does not encrypt its contents. Anyone with a compatible reader can normally recover the payload.
  • It does not guarantee the destination is safe, genuine, or still controlled by the original creator.
  • It does not make a Wi-Fi password secret. The password is present in the payload.
  • It cannot run arbitrary code merely because it was scanned. The receiving app and operating system decide which actions are allowed, although unsafe links or vulnerable apps can still create risk.
  • It cannot hold unlimited data. Standard capacity tops out at a few kilobytes and practical phone-scanning limits are often much lower.
  • It does not guarantee universal behavior. Payload conventions and specialized variants depend on compatible software.

Thinking of QR as a compact transport envelope is helpful: the envelope carries data, while the scanner and connected systems decide what happens next.

Security and Privacy Risks

The main security problem is not the QR encoding algorithm. It is that humans cannot visually inspect the payload before decoding it, and a malicious sticker can be placed over a legitimate code.

Before opening a scanned link, check the displayed domain for misspellings, misleading subdomains, and unexpected URL shorteners. Be especially cautious when a code asks for credentials, a payment, an app installation, a device-management profile, or a permission change. A QR code on a parking meter, restaurant table, invoice, or sign can be physically replaced.

Creators should use a recognizable domain they control, HTTPS, a clear explanation of the expected action, and a human-readable fallback URL or reference number. Avoid embedding secrets unless every person who can see the symbol is allowed to know them. For long-lived printed codes, choose a URL and redirect strategy that can survive site migrations without relying on an unknown third party.

Authentication QR codes deserve special care. A time-based one-time-password setup code can contain the account’s shared secret; someone who photographs it may be able to generate the same login codes. Tickets and access codes may also be bearer credentials. Treat such symbols like the sensitive data they encode.

Designing QR Codes That Scan Reliably

The most dependable design is still dark square modules on a plain light background. Customization can work, but it consumes the symbol’s reliability margin.

Use these rules for production codes:

  1. Preserve a clear quiet zone of at least four modules on all sides.
  2. Use strong contrast. Dark-on-light is the safest polarity across readers.
  3. Keep the image square and do not stretch it horizontally or vertically.
  4. Export at a size that maps each module cleanly. Avoid resampling that creates blurred or uneven edges.
  5. Prefer SVG for scalable print artwork and a sufficiently large PNG for fixed-size digital use.
  6. Keep finder, separator, timing, and alignment patterns visually intact.
  7. Shorten the payload when possible. Fewer modules are easier to reproduce and scan.
  8. Add logos only when needed, keep them modest, and use Q or H as a buffer—not as a guarantee.
  9. Avoid reflective materials, folds, curved placement, low-quality printing, and backgrounds visible between modules.
  10. Test the final physical object, not just the source file, using several phones, camera distances, angles, and lighting conditions.

There is no universal minimum size such as “2 cm.” Required size depends on the version, module size, scan distance, optics, printing process, surface, contrast, and environment. Calculate from modules: a Version 3 code has 29 modules per side, and its four-module quiet zone makes the full clear footprint 37 modules wide. If each printed module is 0.5 mm, the complete footprint is 18.5 mm.

Choosing the Right Settings

For a normal website code, start with the shortest stable HTTPS URL available, automatic version selection, error-correction level M, square dark modules, a white background, and a four-module quiet zone.

Move to Q or H when the environment is harsh or a small logo is genuinely necessary. After changing correction, inspect whether the generator increased the version. If the grid becomes too dense, shortening the content or increasing the printed size may help more than adding still more correction.

For content that must remain usable without a network, encode the actual short text, contact information, or credentials. For content that changes frequently, use a durable URL on a domain you control. For sensitive or valuable actions, provide context beside the symbol and require the destination application to verify authenticity.

You can apply these settings with the Advanced QR Code Generator. It creates URL, text, Wi-Fi, contact, email, SMS, and phone payloads locally in your browser and exports PNG or SVG files.

A Practical Pre-Publishing Checklist

Before distributing a QR code, confirm all of the following:

  • The decoded payload exactly matches the intended text, URL, credentials, or identifier.
  • The destination uses the correct domain and remains under an accountable owner’s control.
  • The code has an adequate quiet zone and is not distorted.
  • Contrast remains strong in the final medium, including after grayscale printing if relevant.
  • Any logo or styling survives tests on both modern and older target devices.
  • The printed module size is suitable for the expected scan distance and surface.
  • The destination explains what users should expect and has a non-QR fallback.
  • No password, token, or personal information is exposed to a wider audience than intended.
  • The real printed or displayed artifact has been tested, not only a preview on the design computer.

The Essential Idea

A QR code works because it combines a carefully structured visual coordinate system with compact data encoding, masking, and Reed–Solomon redundancy. The corner, timing, and alignment patterns let a camera reconstruct the grid; the format fields explain how to interpret it; and the data and correction codewords recover the message even when the image is imperfect.

Its greatest capability is not any single action. It is the ability to move a small, exact payload from the physical world into software quickly and without typing. URLs, payments, tickets, Wi-Fi credentials, product identities, and app commands are all applications built on that simple bridge.

Primary References