How QR Codes Work: Structure, Capacity, and Safety
You scan QR codes for menus, payment terminals, WiFi logins, and event tickets. A QR code is a two-dimensional data format with orientation markers, version metadata, masking, and Reed-Solomon error correction.
Developers need to understand the structure, capacity limits, error correction trade-offs, and security risks before generating codes for real users.
1. The Anatomy of a QR Code
Every QR code is built from a fixed set of structural elements that a scanner uses to orient itself before extracting data:
- Finder Patterns (the three big squares in the corners): These give the scanner orientation. They use a specific 1:1:3:1:1 black-white-black-white-black ratio that rarely occurs in surrounding content, so the scanner can locate the code even when it is rotated or tilted.
- Alignment Pattern (the smaller square): Used in larger QR codes to correct for lens distortion and curvature. Version 1 codes (21×21 modules) don't need them. As the code gets bigger, more alignment markers are added in a grid pattern. A Version 40 code (177×177) contains 46 alignment patterns distributed across its surface.
- Timing Pattern (the alternating dotted lines): These run between the finder patterns and tell the scanner the size of each module (the individual black/white cells). They act as a ruler — the scanner counts the alternating modules to determine the code's version and module pitch.
- Format Information: Encodes the error correction level and mask pattern — critical metadata that determines how the data is decoded, stored redundantly in two locations so it survives partial damage.
- Quiet Zone: The white border (4 modules wide) around the code. Without it, the scanner can't distinguish the QR code from surrounding content. This is the most common mistake in QR code generation for print: shrinking the quiet zone to save space makes the code unscannable.
2. QR Code Versions and Capacity
QR codes come in 40 standard versions, growing from 21×21 modules (Version 1) to 177×177 modules (Version 40). Each version adds 4 modules per side. Higher versions store more data but require better print resolution and camera quality to scan reliably.
Maximum data capacities at the lowest error correction level (L):
| Data Type | Version 1 (21×21) | Version 10 (57×57) | Version 40 (177×177) |
|---|
| Numeric | 41 digits | 652 digits | 7,089 digits |
| Alphanumeric | 25 characters | 395 characters | 4,296 characters |
| Binary/Byte | 17 bytes | 271 bytes | 2,953 bytes |
| Kanji | 10 characters | 167 characters | 1,817 characters |
For most practical applications — URLs, WiFi credentials, contact cards — Version 1 through Version 6 (41×41) are more than sufficient. A typical URL with 50-70 characters fits comfortably in Version 3 or 4. Larger versions are needed for vCards with photos, signed documents, and structured data payloads.
3. How Data Is Encoded
QR codes turn text into a binary grid through a fixed pipeline:
- Character encoding: The input text is converted to bytes. QR codes support four encoding modes — Numeric (0-9, 3.33 bits per character), Alphanumeric (0-9, A-Z, and a few symbols, 5.5 bits per char), Byte (any data, including UTF-8, 8 bits per char), and Kanji (optimized for Japanese Shift JIS characters, 13 bits per char). The encoder automatically selects the most efficient mode for each segment of input, and can switch modes mid-code.
- Data structuring: The bytes are arranged into codewords (8-bit chunks). Error correction codewords are calculated using Reed-Solomon mathematics and appended. The number of error correction codewords depends on the chosen level.
- Module placement: The bits are laid out in a specific zigzag pattern, starting from the bottom-right corner and snaking upward in two-column-wide strips. This pattern was chosen to make scanning robust even when modules are slightly misaligned.
- Masking: A XOR mask is applied to break up problematic patterns — areas that might confuse the scanner (like large blocks of the same color, or patterns that resemble the finder markers). The QR specification defines 8 standard mask patterns, and the encoder tries all of them, selecting the one that produces the fewest penalty points under the specification's scoring rules (which penalize large same-color blocks, finder-pattern-like ratios, and unbalanced black/white distribution).
4. Reed-Solomon Error Correction
Reed-Solomon error correction lets QR codes work when part of the code is damaged, obscured, or poorly lit. Reed-Solomon codes were also used in deep-space communications, including systems that protected data from the Voyager probes.
QR codes offer four levels of error correction:
- L (Low): ~7% of codewords can be restored
- M (Medium): ~15% restoration
- Q (Quartile): ~25% restoration
- H (High): ~30% restoration
The trade-off is density: higher error correction means more redundant data, which means a larger physical code for the same payload. That's why a restaurant menu QR code (simple URL, low correction) can be tiny, while a boarding pass QR code (dense structured data, high correction) is larger.
A QR code with Level H correction can lose up to 30% of its modules — holes punched through it, coffee stains, crumpled paper — and still scan correctly. The same code at Level L might become unreadable with 10% damage.
5. Why QR Codes Beat Barcodes
One-dimensional barcodes store data horizontally in varying-width bars. A QR code stores data both horizontally and vertically. That design changes capacity and scanning behavior:
- Density: A standard UPC barcode holds 12 numeric digits. A Version 40 QR code (the maximum) can hold up to 7,089 numeric characters or 4,296 alphanumeric characters.
- Error correction: Barcodes have no error correction. A single smudge on a critical bar renders the entire code unreadable.
- Omnidirectional readability: Barcodes must be oriented correctly relative to the scanner. QR codes can be read at any angle — the finder patterns handle rotation instantly.
6. Security: The Rise of Quishing
QR codes have a dark side. Because the human eye cannot read a QR code's payload, users must trust that a printed code leads where it claims to lead. Quishing (QR phishing) exploits this blind spot. Attackers place malicious QR code stickers over legitimate ones in public places — a parking meter, a restaurant table, a conference badge. The victim scans the code, sees a URL that looks legitimate, and enters credentials or payment information on a fake page.
Defensive practices: preview the URL before opening it (most modern camera apps show the decoded URL and require a tap to navigate), avoid scanning QR codes in unverified physical locations, and never enter login credentials on a page reached via QR code unless you independently verified the destination. For developers generating QR codes: log and monitor the URLs you encode, and consider using your own short URLs so you can audit click-through patterns.
ToolOrbit's QR Scanner decodes QR codes locally in the browser without uploading images to a server, and the Barcode Generator creates scannable codes for both one-dimensional and two-dimensional formats.
7. Why QR Codes Became Common
QR codes were invented in 1994 by Denso Wave, a subsidiary of Toyota, to track automotive parts. They languished in relative obscurity (at least in Western markets) for two decades. Three things changed that:
- Smartphone cameras became good enough: Early phone cameras couldn't reliably resolve QR code modules at close range. Modern autofocus, higher resolution sensors, and improved low-light performance eliminated this barrier.
- Operating systems integrated scanning: Apple added native QR scanning to the iOS camera in 2017. Android followed. Suddenly, nobody needed a dedicated app.
- The pandemic accelerated contactless everything: Menus, payments, check-ins — QR codes became the default interface between the physical and digital worlds overnight.
Denso Wave made a prescient decision: they open-sourced the QR code specification and chose not to enforce their patent rights. This allowed QR codes to become a universal standard rather than a proprietary lock-in technology — a decision that likely contributed more to their eventual ubiquity than any technical feature.
Conclusion
QR codes work because the format combines clear orientation markers, compact encoding, and error correction in a small printed area. For developers, that means generation choices matter: keep the quiet zone, choose an error correction level that fits the environment, preview URLs, and treat public QR codes as a phishing surface.