What Is a QR Code?
Those black-and-white square puzzles on menus, posters and boarding passes can pack a link, Wi-Fi credentials or a ticket into a few square centimetres. Here's how they work — and how to create and scan them without getting caught out.
Pixels as data
A QR code — Quick Response code, invented in 1994 by Denso Wave for tracking car parts — is a two-dimensional barcode. Where an old supermarket barcode stores a dozen digits in one dimension, a QR code stores data in two dimensions: a grid of black and white modules, each one a bit. That's why a QR code can hold thousands of characters instead of a dozen digits.
The data can be anything bytes can represent: a URL, plain text, contact details, Wi-Fi credentials, even binary files in theory. The scanner reads the grid, reconstructs the bytes, and interprets them.
Anatomy of a QR code
Three visual landmarks make a QR code decodable from any angle:
| Element | Where | Role |
|---|---|---|
| Finder patterns | The three big corner squares | Let the scanner locate the code and its orientation |
| Alignment pattern | Small square, bottom-right area | Corrects for lens distortion on curved surfaces |
| Timing pattern | Alternating line between finders | Sets the module grid coordinates |
| Quiet zone | White margin all around | Separates the code from its surroundings — part of the standard, don't crop it |
| Data & error correction | Everything else | The payload, interleaved with redundancy |
There are 40 "versions" — sizes from 21×21 to 177×177 modules. Bigger versions hold more data; a typical URL lands around version 3–5.
Why damaged codes still scan
QR codes embed Reed–Solomon error correction — the same mathematics that protects CDs and deep-space probes. Up to a certain share of damaged modules, the decoder reconstructs the missing data instead of failing. Four levels trade capacity for resilience:
- L — recovers ~7% damage; densest code.
- M — ~15%; the everyday default.
- Q — ~25%; good for print that will be handled.
- H — ~30%; lets you slap a logo in the middle, survives rough surfaces.
This is also why the codes tolerate a logo overlay: as long as damage stays below the recovery budget, the payload survives intact.
Static vs dynamic codes
A static QR code encodes the final content directly. It works forever, costs nothing, tracks nothing — change the destination and you reprint the code. A dynamic code encodes a short redirect URL owned by a QR service: the service logs every scan and can repoint the destination later. Handy for campaigns, but it adds a dependency (the service must stay alive), privacy tracking, and often a subscription. Our QR generator produces only static codes — nothing expires, nothing phones home.
What people put inside
- URLs — posters, business cards, packaging.
- Wi-Fi — the WIFI:S:name;T:WPA;P:password;; format joins a network on scan; our generator builds it for you.
- vCards — a contact card in one scan.
- Email, phone, SMS — pre-fills the compose screen.
- Payments and tickets — one-time signatures, which is why those codes must never be reused or photographed by strangers.
Scanning safely (quishing)
Because a code is just a link someone printed, attackers use them too — the technique even has a name, quishing (QR phishing). Stickers slapped over legitimate codes on parking meters, codes in emails that lead to credential-harvesting pages: the phone opens the destination invisibly, and that's the danger.
- Use a scanner that shows the decoded content before opening — like the QR scanner on this site — instead of one that jumps straight to the browser.
- Read the domain carefully: paypa1.com is not PayPal.
- Be extra suspicious of codes that arrive covering other codes, or that demand login right after scanning.
Received a QR code as an image? Decode it without trusting it: the QR reader shows the raw content of any picture, locally, before you open anything.
Learn more
- Create one: the QR code generator (links, Wi-Fi, email, SMS — PNG download).
- Read one live: the QR scanner with your camera, or the reader for images.
- Curious about the addresses inside QR links? Start with what an IP address is.
QR code questions
Do QR codes expire?
A QR code is just data printed as pixels — it cannot expire. What can stop working is the destination behind it: a dynamic QR code points at a redirect service that might shut down, and a plain link dies if the target page does. Codes you generate locally with plain content keep working forever.
Are QR codes safe to scan?
The code itself is inert; the risk is where a URL points. Attackers print codes that lead to phishing sites, so treat a decoded link like any unknown link — read it before opening. Using a scanner that shows you the destination first, instead of jumping straight to the browser, is the safe habit.
What is the difference between static and dynamic QR codes?
A static code encodes the final content directly — a URL, Wi-Fi credentials, text — and works forever. A dynamic code encodes a short redirect URL owned by the service that made it, letting the destination be changed later; it works only as long as that service exists, and it tracks every scan.
How much data can a QR code hold?
Up to about 4,300 characters in the largest version at the lowest error-correction level. The practical limit is much lower: every extra character adds modules, making the code denser and harder to scan — keep payloads short, especially for print.