A Barcode That Grew Up
Old barcodes store a dozen digits in one dimension: stripes read left to right. QR codes ("Quick Response", invented at Denso Wave in 1994 to track car parts) store data in two dimensions, packing thousands of characters into a square your phone decodes from any angle, even damaged, in milliseconds. The design is genuinely clever, and once you know its parts, you'll never see those squares the same way.
Anatomy of a QR Code
- Modules: The individual black and white squares: each one is a bit (black = 1, white = 0). A "Version 1" code is 21×21 modules; sizes grow to Version 40 at 177×177.
- Finder patterns: The three big squares in the corners. They scream "QR code here" to the scanner and establish orientation: it's why codes scan upside down without complaint.
- Alignment patterns: Smaller squares that let the reader correct for perspective and curvature (a code on a coffee mug still scans).
- Timing patterns: Alternating lines between finder squares that establish the module grid spacing.
- Format information: Encodes the error correction level and data mask in use.
- The quiet zone: The blank border. Skimp on it in a design and scanning suffers: the most common mistake in homemade codes.
Everything else is data and error correction, laid out in a zigzag from the bottom right corner, XORed with a mask pattern to avoid confusing blobs of solid colour.
The Superpower: Error Correction
QR codes use Reed-Solomon error correction, the same math that let scratched CDs play. Redundant recovery data is woven through the grid at one of four levels:
| Level | Recoverable damage | Typical use |
|---|---|---|
| L | ~7% | Clean digital display, maximum capacity |
| M | ~15% | The everyday default |
| Q | ~25% | Print in rough conditions |
| H | ~30% | Codes with logos punched in the middle |
That last row explains the codes with logos: the logo literally destroys the modules under it, and error correction reconstructs the missing data. Style, paid for with redundancy. Generate codes at any correction level with our free QR generator: it runs fully in your browser.
How Much Fits Inside?
Capacity depends on version (size), error correction level, and data type. The maximums, at the largest size with lightest correction:
- Numeric only: 7,089 digits
- Alphanumeric: 4,296 characters
- Bytes (any data): 2,953 bytes
The encoder picks the tightest mode automatically: pure digits pack three-per-10-bits, uppercase-plus-digits pack two-per-11-bits, everything else costs a full byte per character. Practical takeaway: shorter content means a coarser, more scannable code: a short URL produces a cleaner grid than a 300 character monster, which is half the reason URL shorteners exist on posters.
A QR code doesn't "do" anything: it's frozen text. The action (opening a URL, joining WiFi) is your phone interpreting that text. That distinction is the entire security story below.
What's Actually Written in Common QR Codes
The payload is plain text with conventions the scanner recognises:
Website: https://2fafast.com/
WiFi: WIFI:T:WPA;S:MyNetwork;P:password123;;
Contact: BEGIN:VCARD ... END:VCARD
2FA setup: otpauth://totp/GitHub:you?secret=JBSWY3DPEHPK3PXP&issuer=GitHubThat last one deserves attention: the QR you scan when enabling 2FA contains your account label and the Base32 secret key that generates every future code (the encoding is explained in our Base32 guide, the protocol in our QR-in-2FA post). Two consequences:
- Treat setup QRs as passwords. A screenshot of one in your camera roll is your 2FA secret in plaintext. Anyone who scans it generates your codes forever.
- You can inspect before trusting. Our QR decoder reads any code from an image and shows the raw text without acting on it, and our TOTP generator will turn a secret into live codes so you can verify a setup.
The Security Angle: Quishing
Attackers exploit the fact that humans can't read QR codes: a sticker over a restaurant menu code, a fake parking meter code, a QR in a phishing email ("scan to verify your account") that routes to a credential harvesting page. The scanner shows the URL for a second, most people tap through, and the fake login does the rest.
Defences are simple: read the URL preview before opening, be extra suspicious of codes on stickers and in emails (a legitimate email can just use a link), and never enter credentials on a page you reached by QR without checking the domain. The full pattern library is in our phishing guide.
Frequently Asked Questions
Why do QR codes look different every time, even for similar content?
Beyond content differences, the encoder applies one of eight mask patterns chosen to balance black/white distribution, and may choose different versions or modes. Same content can legitimately produce different valid codes: all decode identically.
Can a QR code itself contain a virus?
The code is inert text: it can't execute anything. The risk is where it sends you (malicious sites, malware downloads) or what it asks (join this WiFi, add this contact). The scan is safe; the follow-through is where judgment applies.
Do QR codes expire?
Static codes never expire: the text is permanent. "Expiring" codes are dynamic: they encode a short redirect URL whose destination the service can change or disable. The code still scans; the server behind it stopped cooperating.
Colored and fancy QR codes: do they work?
Yes, within limits: scanners need contrast (dark modules on light background: inverted codes often fail), the quiet zone respected, and finder patterns intact. Logos work by sacrificing error correction budget. When in doubt, test with multiple phones: our generator produces clean, high contrast codes by default.
What's the smallest QR code that holds a URL?
A shortened URL (around 20 characters) fits in Version 2 (25×25 modules) comfortably. Physical size then depends on print quality and scan distance: the rule of thumb is scan distance divided by 10 for the printed width.
