How do QR codes work?

A QR code stores its data directly in its pattern of black and white squares. The three big squares in the corners tell a camera where the code is and which way up it sits. The rest holds your data plus extra error-correction data, built with a method called Reed-Solomon, which is why a code can still scan when part of it is smudged, torn or covered.

There's no chip and no signal inside, only a grid designed to survive being read badly.

It started with car parts

The QR code was announced in 1994 by Denso Wave, then a division of Denso Corporation. Its development was led by Masahiro Hara, and the auto industry took it up for electronic kanban, the cards used to manage parts moving through production. The QR stands for "quick response," a nod to how fast it was meant to read.

Two decisions helped it spread. Denso Wave kept its patent but declared it would not exercise it, and the code became an international standard, ISO/IEC 18004, in June 2000.

How does a scanner find the code?

Look at any QR code and you'll see three large nested squares, at the top left, top right and bottom left. These are finder patterns, each 7 by 7 modules, the name for the individual black or white squares.

Scan a line straight through the middle of one and you get black, white, black, white, black in widths of 1:1:3:1:1. Denso Wave says Hara's team surveyed printed material to find the black-to-white ratio that showed up least often, and that was it. A scanner sweeping across a messy image can spot that rhythm and be fairly sure it has found a QR code, whichever way it is rotated. Denso Wave lists reading "from any direction in 360°" as a core feature. With finders in three corners and not the fourth, the reader also knows which way is up.

Press Play or scrub across the center. Notice how the middle black run lasts three times as long as each outer run.

A few other fixed features help. Thin white separators surround the finders. Two lines of alternating dark and light modules, called timing patterns, run between them. From version 2 upward, smaller 5 by 5 alignment patterns add extra reference points inside the grid.

Versions and capacity

QR codes come in 40 sizes, which the standard calls versions. Version 1 is 21 by 21 modules, and each version adds four modules per side, up to version 40 at 177 by 177. Denso Wave gives the maximum capacity as 7,089 numeric characters, 4,296 alphanumeric characters, 2,953 bytes of binary data or 1,817 kanji characters.

The size you get depends on how much data you store and how much error correction you ask for. Denso Wave's own example is that 100 digits at error correction level M fits in version 3, a 29 by 29 grid.

Why does a damaged QR code still scan?

Two points fix a straight line. If you send five points that all sit on the same line and three get lost, the two survivors still tell you exactly which line it was. Reed-Solomon codes apply a far more elaborate version of that trick to bytes, using polynomials, so the missing pieces can be calculated back.

In a QR code, data is split into codewords of 8 bits each, and Reed-Solomon codewords are added on top. Denso Wave explains the arithmetic. To correct an error in one codeword, you need two extra codewords. So 100 data codewords plus 100 Reed-Solomon codewords make 200 in total, of which 50 can be corrected, which is 25%. Because Reed-Solomon works at the byte level, it is good at the kind of damage QR codes actually get, a clump of errors in one spot, like a coffee stain or a torn corner. Denso Wave notes the same family of codes is used on music CDs.

You pick how much protection to buy. Denso Wave lists four levels, restoring roughly this share of codewords.

Higher levels make the code bigger for the same data. Level M is the most common choice, according to Denso Wave, while Q or H suit dirty factory floors and L suits clean settings with lots of data.

Paint damage across the tiles, then switch levels. Compare the same damaged share with each repair budget.

Masks keep the pattern readable

Raw data can produce awkward patterns, like big blocks of one color or something that looks like a fourth finder. So after placing the data, the encoder applies a mask, flipping modules in a fixed pattern such as every even row. Thonky's QR tutorial, which walks through the standard step by step, explains that there are eight masks and the encoder tries all of them. It scores each against penalty rules for long runs of one color, 2 by 2 blocks, finder-like patterns and an imbalance between dark and light, then keeps the lowest score. Masks apply only to the data and error-correction modules, never to the finders and other fixed parts.

The scanner needs to know which mask was used. That goes in a 15-bit format string placed beside the finders, which records the error correction level and the mask number and carries its own error-correction bits.

What actually happens when you scan

In outline, the camera spots the three finder patterns, works out the code's size, angle and orientation, then reads the format string to learn the error correction level and mask. It undoes the mask, reads the codewords, uses Reed-Solomon to repair what it can, and decodes the result, which is often a web address but can be plain text or other data. Then your phone shows you what it found.

A QR code is a printed message

People sometimes treat a QR code as if it were plugged into something. It isn't. It is a printed message, and the data sits in the squares. What happens next depends on what that message tells your phone to open, and that is where the risk lives.

Scanning safely

Scammers know the destination is what matters. A 2023 FTC alert describes scammers covering QR codes on parking meters with their own, and sending codes in texts and emails with an urgent made-up reason to scan. The code can lead to a spoofed site that looks real, or to one that installs malware.

The practical advice is short. The FTC says to inspect the URL before opening it and to avoid scanning codes in unexpected messages. The FBI's 2022 warning adds checking physical codes for stickers placed over the original, getting apps from your phone's app store instead of from a QR code, and thinking twice before entering login or payment details on a site you reached by scanning. The FBI also notes most phones have a scanner built into the camera app, so a separate scanner app isn't needed.

Repairs, barcodes and logos in the middle

The two-points-on-a-line trick is only a sketch, so the obvious next question is how Reed-Solomon actually rebuilds missing bytes. From there it is a short step to why some codes carry a logo in the middle and still scan. Ask Learnfold either one and it writes a short course, then a linked page for each follow-up, and specific questions get specific pages. For more redundancy and precise timing, read how GPS knows where you are, or see how one question becomes a curiosity rabbit hole.