What is a QR Code? How They Work and Why They're Everywhere

History: Denso Wave and 1994

The QR code was invented in 1994 by Masahiro Hara, an engineer at Denso Wave (then a division of Denso Corporation, a Toyota group supplier). The motivation was practical: traditional 1D barcodes could only store about 20 alphanumeric characters and required a perfectly aligned scanner. Automotive manufacturing needed a system that could encode far more information — part numbers, serial codes, supplier IDs — and be read from any angle by a moving camera on an assembly line.

The solution was a two-dimensional matrix barcode that could be scanned from any orientation, tolerant of physical damage, and capable of storing hundreds of times more data than a 1D barcode. Denso Wave released the QR code as an open standard and published it as ISO/IEC 18004, which made it freely usable by anyone without licensing fees.

For over a decade, QR codes were mostly limited to Japan. The global explosion came with the smartphone era (2007–2012) when every phone acquired a camera capable of real-time code scanning, and the COVID-19 pandemic (2020) accelerated adoption dramatically through contactless menus and check-ins.

QR Code Structure

A QR code is a square grid of black and white modules (squares). Each module represents one bit — black for 1, white for 0. The overall size of the grid depends on the "version" of the QR code (larger versions hold more data). The modules are organised into several functional regions:

• Finder patterns — three squares in the corners for orientation detection
• Alignment patterns — additional smaller squares for distortion correction (present in versions 2 and above)
• Timing patterns — alternating black/white strips for calibration
• Format information — encodes the error correction level and mask pattern
• Data area — the actual encoded content, interleaved with error correction codewords
• Quiet zone — a four-module white border around the entire code for scanner isolation

Finder Patterns

The three finder patterns are the most visually distinctive feature of a QR code: three identical square-within-a-square patterns in the top-left, top-right, and bottom-left corners. Each consists of a 7×7 square of dark modules, surrounded by a border of light modules, then another border of dark modules.

The finder patterns serve a single purpose: they allow the scanner to locate the QR code within the camera frame and determine its orientation (right-side up, upside down, rotated 90°, or rotated 270°), regardless of the scanner's angle. The three-corner arrangement creates an unambiguous marker that can be detected from any direction.

A separator (one white module wide) surrounds each finder pattern to isolate it from the data area. Between the finder patterns, a "timing pattern" alternates black and white to let the decoder determine the size and position of individual modules.

Data Modules and Encoding

The remaining modules after the functional regions form the data area. QR codes support four encoding modes, each suited to different content:

• Numeric mode: Digits 0–9. Most compact for numbers — 10 bits per 3 digits.
• Alphanumeric mode: 45 characters (0–9, A–Z, space, and 8 symbols). 11 bits per 2 characters.
• Byte mode: Any byte value. 8 bits per character. Required for lowercase, Unicode, or binary data.
• Kanji mode: Japanese Kanji characters (Shift JIS encoding). 13 bits per character.

A QR code can use multiple encoding modes in a single code — switching to numeric mode for digits within an otherwise byte-mode code, for example, to save space.

Error Correction Levels

QR codes use Reed-Solomon error correction, the same error correction algorithm used in CDs, DVDs, and QR codes' descendant, the Data Matrix. This allows data to be recovered even if part of the code is damaged, dirty, or obscured.

Four error correction levels are defined in the ISO/IEC 18004 standard:

Level	Name	Recovery Capacity	Use Case
L	Low	~7% data recovery	Maximum data density, clean environments
M	Medium	~15% data recovery	General purpose (default for most generators)
Q	Quartile	~25% data recovery	Environments where physical damage is expected
H	High	~30% data recovery	Dirty environments, decorative QR codes with logos

Higher error correction means more modules devoted to redundancy, which requires a larger QR code (or reduces the amount of data that can be stored at a given version). Level M is the most common default, balancing data capacity and resilience. Level H is used when a logo or image is embedded in the centre of the QR code — the overlaid logo "damages" up to 30% of the code, and H-level error correction recovers it.

Versions and Capacity

QR codes come in 40 "versions," each increasing the grid size by 4 modules per side:

• Version 1: 21×21 modules
• Version 10: 57×57 modules
• Version 20: 97×97 modules
• Version 40: 177×177 modules

A Version 40 QR code at error correction Level L can store up to 7,089 numeric characters, 4,296 alphanumeric characters, or 2,953 bytes. Most QR codes you encounter are Version 3–7, handling URLs of typical length.

Practically, keep URLs short for QR codes. A 30-character URL produces a small, clean Version 2 code that scans easily. A 200-character URL may require a Version 10+ code with dense modules that strain lower-quality cameras.

QR Code Types

URL / Website

The most common type. Stores a URL, and the phone's QR scanner automatically opens the URL in the default browser. Used on menus, posters, business cards, and product packaging.

WiFi Network

Encodes the WiFi SSID, security type, and password in a standardised format: WIFI:S:NetworkName;T:WPA;P:password;;. Scanning on Android or iOS automatically prompts to join the network — no password typing required. Ideal for guest WiFi in hotels, offices, and events.

vCard / Contact Information

Encodes a full contact card (name, phone, email, address, website) in vCard 3.0 format. Scanning on a phone prompts to add the contact to the address book. Used on business cards to replace manual data entry.

Plain Text

Any text string up to the data capacity limit. Used for serial numbers, product codes, error messages, and any scenario where a URL is not appropriate.

Email / SMS / Phone

Encodes a mailto:, smsto:, or tel: URI, which opens the corresponding app (email client, messaging app, phone dialler) when scanned.

How Phones Scan QR Codes

Modern smartphones (iOS 11+, Android with Google Lens or Samsung's camera) detect QR codes natively in the camera app without any additional software. The scanning process:

1. Image capture: Camera captures a frame
2. Finder pattern detection: The algorithm searches for the three finder pattern squares. Their unique aspect ratio (1:1:3:1:1 light/dark module ratio across any scan line) is distinctive and fast to detect.
3. Perspective correction: The position of the three finder patterns defines a quadrilateral that is transformed into a normalised square grid
4. Module sampling: The timing patterns determine module size and position; each module is sampled for black/white value
5. Error correction: Reed-Solomon decoding recovers any damaged bits
6. Data decoding: The data area is decoded according to the encoding modes indicated in the format information
7. Action: The phone presents the decoded content to the user (open URL, join WiFi, add contact, etc.)

Security Risks of QR Codes

QR codes themselves are neutral — they are just a data encoding format. The risks come from the actions they trigger:

Quishing (QR Phishing)

Attackers print malicious QR codes on stickers and place them over legitimate ones (e.g., parking meters, restaurant menus). The code redirects to a phishing site that impersonates a bank, payment service, or login page. Always preview the URL shown by your phone before tapping "Open".

Malware Distribution

QR codes can link directly to malicious app downloads or exploit URLs targeting browser vulnerabilities. Keep your phone's OS and browser updated to reduce exposure.

Data Exfiltration

A QR code in a corporate environment could encode a URL that exfiltrates sensitive clipboard or cookie data when scanned. Avoid scanning QR codes from untrusted sources on devices with access to sensitive data.

Safe practices:

• Preview the full URL before opening it
• Be suspicious of QR codes on stickers (they may cover the original)
• Verify that shortened URLs match the expected domain
• Use a QR scanner app that displays the URL before navigating