How QR Codes Store Data: What's Inside Those Black and White Squares

A Barcode That Grew Up

Old style barcodes store a dozen digits in one dimension, stripes read left to right by a laser. QR codes ("Quick Response", invented at Denso Wave in 1994 to track car parts on a Toyota assembly line) store data in two dimensions instead, packing thousands of characters into a square that a phone camera decodes from almost any angle, even partially damaged, in a fraction of a second. The design is genuinely clever engineering, and once you know its parts you won't see those squares the same way again.

Anatomy of a QR Code

• Modules: the individual black and white squares. Each one is a single bit, black for 1, white for 0. A "Version 1" code is 21 by 21 modules, and sizes grow up to Version 40 at 177 by 177.
• Finder patterns: the three large squares in the corners. They tell a scanner "a QR code is here" and establish orientation, which is why a code scans correctly even upside down.
• Alignment patterns: smaller squares that let the reader correct for perspective distortion and curved surfaces, so a code printed on a coffee mug still scans.
• Timing patterns: alternating lines running between the finder squares that establish the exact spacing of the module grid.
• Format information: a small strip encoding which error correction level and data mask the rest of the code uses.
• The quiet zone: the blank border around the whole code. Skimp on it in a design and scanning suffers, it's the most common mistake in homemade codes.

Everything else is data and error correction, laid out in a zigzag pattern starting from the bottom right corner and XORed with a mask pattern chosen to avoid confusing solid blocks of one color that would be harder to read reliably.

The Superpower: Error Correction

QR codes use Reed-Solomon error correction, the same family of math that lets a scratched CD keep playing. The encoder treats the data as a mathematical sequence and generates extra redundant values woven through the grid, at one of four selectable levels:

That last row explains the codes you see with a logo sitting in the center. The logo physically destroys the modules underneath it, and the error correction data reconstructs what was lost, as long as the damage stays under the level's threshold. It's style paid for with redundancy budget. Generate codes at any correction level with our free QR generator, which runs entirely in your browser.

How Capacity Scales With Version

The "version" number determines the grid size, and capacity grows fast as version increases, since a bigger grid has room for both more data and more error correction. A few reference points at error correction level M:

Generators pick the smallest version that fits your content automatically, which is why a short URL produces a noticeably coarser, chunkier looking grid than a long one. At the absolute maximum, Version 40 with the lightest correction level (L) holds 7,089 digits, 4,296 alphanumeric characters, or 2,953 bytes of arbitrary data. The encoder also chooses the tightest encoding mode it can for your content: pure digits pack three characters into every 10 bits, uppercase letters plus digits pack two characters into 11 bits, and anything else, lowercase letters, punctuation, symbols, costs a full byte per character. The practical takeaway is that shorter content produces a coarser, more reliably scannable code, which is half the reason URL shorteners exist on printed posters and menus in the first place.

A QR code doesn't "do" anything on its own, it's frozen text. The action, opening a URL, joining a WiFi network, filling in a payment amount, is your phone's software interpreting that text after the scan. That distinction is the entire security story below.

What's Actually Written in Common QR Codes

The payload is plain text following conventions the scanning app recognizes and acts on:

Website:    https://2fafast.com/
WiFi:       WIFI:T:WPA;S:MyNetwork;P:password123;;
Contact:    BEGIN:VCARD ... END:VCARD
2FA setup:  otpauth://totp/GitHub:you?secret=JBSWY3DPEHPK3PXP&issuer=GitHub

That last one deserves attention on a site about authentication: the QR code you scan when enabling 2FA contains your account label and the Base32 secret key that generates every future code, an encoding explained in our Base32 guide and a protocol covered in depth in our 2FA QR code post. Two consequences follow directly:

• Treat 2FA setup QR codes as passwords. A screenshot of one sitting in your camera roll is your 2FA secret stored in plaintext. Anyone who scans that image can generate your codes forever.
• You can inspect a code before trusting it. Our QR decoder reads any code from an image and shows you the raw text without acting on it, and our TOTP generator turns a secret into live codes so you can verify a setup independently.

Real World Uses Beyond 2FA

2FA setup is a narrow slice of what QR codes carry day to day. A few categories worth knowing:

• Payment QR codes: systems like India's UPI, Thailand's PromptPay, and Singapore's PayNow encode a merchant identifier, and sometimes a fixed amount, directly in the code. Scanning one opens your banking app pre filled with the payee, turning a wallet free counter transaction into a few taps.
• Restaurant menus: a code on a table links to a hosted menu page, popularized heavily during contactless dining requirements and now kept for the printing cost savings alone.
• WiFi network sharing: the WIFI: format shown above lets a guest join a network by scanning a code taped to a router, skipping the error prone process of typing a long password on a phone keyboard.
• Digital business cards: the vCard format packs a full contact record, name, phone, email, company, into a code that populates a new contact entry directly when scanned.
• Product traceability: manufacturers print codes linking to batch numbers, origin data, or authenticity checks, letting a phone verify a product's supply chain history on the spot.

All of these share the same underlying mechanism as a 2FA setup code, only the convention for what the text means, and what the scanning app does with it, changes.

The Security Angle: Quishing

Attackers exploit the fact that humans can't read QR codes by eye: a sticker pasted over a legitimate restaurant menu code, a fake parking meter code, a QR code embedded in a phishing email asking you to "scan to verify your account" that actually routes to a credential harvesting page. The scanning app shows a URL preview for a second, most people tap through anyway, and the fake login page does the rest of the work.

Defenses are straightforward: read the URL preview before opening it, treat codes on stickers and in unsolicited emails with extra suspicion since a legitimate email can simply include a normal clickable link instead, and never enter credentials on a page you reached by scanning a code without checking the domain first. The full pattern library of these tricks is in our phishing guide.

Frequently Asked Questions

Why do QR codes look different every time, even for similar content?

Beyond genuine content differences, the encoder applies one of eight mask patterns chosen to balance the black and white distribution across the grid, and may pick a different version or encoding mode depending on the exact input. Two codes with different appearances can decode to identical text.

Can a QR code itself contain a virus?

The code is inert text, it can't execute anything on its own. The risk lives in where it sends you, a malicious site or a malware download, or what it asks you to do, join an unfamiliar network or add an unverified contact. The scan itself is safe, the follow through is where judgment matters.

Do QR codes expire?

Static codes never expire, the text inside is permanent and will scan the same way indefinitely. "Expiring" codes are dynamic, they encode a short redirect URL whose destination a service can change or disable at will. The printed code still scans fine, the server behind it simply stops cooperating.

Do colored or logo QR codes actually work?

Yes, within limits. Scanners need reasonable contrast between dark and light modules, an intact quiet zone, and undamaged finder patterns. Inverted color schemes often fail outright. Logos work by spending error correction budget rather than by magic. When in doubt, test with a couple of different phone models, our generator produces clean, high contrast codes by default.

What's the smallest QR code that can hold a URL?

A shortened URL of around 20 characters fits comfortably in a Version 2 code, 25 by 25 modules. Physical print size then depends mostly on expected scan distance, a common rule of thumb is scan distance divided by 10 for the minimum printed width in the same units.