A QR code is text written as a grid of black and white squares. Your camera photographs the grid, the software finds the three big squares in the corners to work out where the code is and which way up it sits, reads the rest of the grid as ones and zeros, repairs any unreadable parts using spare data built into the code, and turns the result back into characters. That text is usually a web address, but it can just as easily be a Wi-Fi login, a contact card or a sentence.
Scanning never runs anything. It decodes text and hands it to you, which is why reading a code is safe and tapping what it contains is the part that needs judgment.
What’s actually stored in a QR code? #
Characters. The reason your phone knows a code holds a Wi-Fi network rather than a website is a prefix at the start of the text, a convention scanners recognize:
| Kind of code | What the stored text looks like |
|---|---|
| Web link | https://example.com/menu |
| Plain text | Table 12 |
| Wi-Fi | WIFI:T:WPA;S:MyNetwork;P:mypassword;; |
| Contact card | BEGIN:VCARD … END:VCARD |
mailto:[email protected] | |
| Phone number | tel:+15551234567 |
| Text message | SMSTO:+15551234567:See you at 6 |
| Location | geo:48.8584,2.2945 |
Nothing in the pattern makes the phone act. The scanner reads the text, recognizes the prefix and offers a matching action: open this link, join this network, save this contact.
The parts of a QR code #
Only part of the grid is your data. The rest is scaffolding that makes the code findable and readable.
| Part | Where it is | What it does |
|---|---|---|
| Finder patterns | Three corners | The big square targets a scanner looks for first. They give the code’s position, size and rotation. |
| Timing patterns | Dotted lines between the finders | A ruler that tells the scanner where each row and column of squares falls. |
| Alignment patterns | Inside the code, on all but the smallest sizes | Smaller targets that correct for the code being photographed at an angle or printed on a curve. |
| Quiet zone | The blank margin around everything | Separates the code from surrounding print. Denso Wave specifies a four-module margin on all sides, a module being one small square. |
| Format information | Beside the finder patterns | Records the error correction level and which mask was applied. |
| Data and error correction | Everything left over | Your content, plus the spare data used to rebuild damaged parts. |
The fourth corner has no finder pattern, and that asymmetry is deliberate: three targets are enough to pin down the orientation, so the code can be read upside down or sideways. Denso Wave, which developed the format, lists being readable from any direction in 360 degrees as one of its defining features.
How your phone reads a QR code, step by step #
- It finds the targets. The scanner sweeps the image for the finder patterns, which have a distinctive dark-light-dark-light-dark ratio along any line crossing them. Three hits mean a probable QR code.
- It works out the grid. From the corners and the timing patterns, the software calculates how many squares across the code is and where each one sits, correcting for tilt and perspective.
- It samples each square. Every position becomes a one or a zero, light or dark.
- It reads the format information. This tells the scanner the error correction level and the mask pattern, which is a regular pattern XORed over the data to avoid large blank areas that confuse readers. The scanner reverses it.
- It repairs the damage. The bits are grouped into codewords and checked against the error correction data. Missing or misread codewords get rebuilt.
- It decodes the characters. A mode indicator says whether the bits represent digits, uppercase alphanumeric text, raw bytes or kanji, and the scanner converts accordingly.
- It hands you the text, with an action to match.
All of that happens on the device in a fraction of a second, with no internet connection involved. A connection is only needed afterwards, if the text turns out to be a link and you open it.
Why a QR code still works when it’s scratched or partly covered #
Every code carries redundant data. Denso Wave defines four error correction levels, from L, which restores about 7% of the code, up to H, at about 30%. That’s what lets a code survive a coffee ring, a crease or a logo dropped in the middle.
It also explains why the corner squares are sacred. Error correction rebuilds missing data, but if the finder patterns are covered the scanner never locates the code in the first place. Our guide to QR code error correction levels covers which level to use for what.
How much fits inside one #
QR codes come in 40 sizes, called versions. Version 1 is 21 by 21 squares; each step up adds four squares per side, ending at version 40 at 177 by 177. Denso Wave puts the ceiling at 7,089 numerals for the largest code at the lowest error correction level, or roughly 3 KB of arbitrary data.
In practice you want far less than that, because more data means more and smaller squares, and smaller squares are harder for a camera to resolve. How much data a QR code can hold goes through the real limits.
Making one, and what the code does after that #
Generating a code is the same process backwards: text in, mode and version chosen, error correction codewords calculated, mask applied, grid drawn. It’s arithmetic, and it needs no server, which is why a phone can do it offline. QR Handler builds codes on the device for links, text, Wi-Fi, contacts, email, phone and SMS, and shows any saved code full-screen and bright so another phone can read it off your display.
What happens after someone scans your code depends on what’s inside it. A static code holds your content directly, so nobody is told when it gets scanned. A dynamic code holds a short link to a company’s server that forwards visitors and counts them, which is a real difference for anyone scanning. Static vs dynamic QR codes explains both.
What a QR code can’t tell you #
The pattern carries no reputation, no signature and no proof of origin. A code printed by a city parking department and a sticker printed by a scammer are identical technology, and both can be made in seconds for free. Nothing in the encoding says who made it or whether the address inside is honest.
That’s why the one habit that matters is reading the decoded text before you act on it. A scanner that shows the whole address, rather than a truncated banner, gives you something to judge. QR Handler never opens a code by itself: every scan lands on a result screen with the full contents, and for links it names the real host and flags plain http, shortened links, raw IP addresses and look-alike characters. It has no blocklist, so a scam site with an ordinary-looking name won’t be flagged, and the decision stays yours. Checking a QR code before opening it covers what to look for.
Frequently asked questions #
Do QR codes need an internet connection? #
No. Reading and decoding a code happens entirely on your phone, which is why Wi-Fi and contact codes work in a basement with no signal. You only need a connection if the code contains a link and you choose to open it.
Can a QR code be read upside down? #
Yes. The three corner finder patterns tell the scanner the code’s orientation, so any rotation works. A steep viewing angle is a bigger problem than rotation, and alignment patterns exist to correct some of that distortion.
What are the three squares in the corners of a QR code? #
Finder patterns. They’re how a scanner spots that a QR code is present, where its edges are and which way up it sits. Covering one usually makes the code unreadable, which is why logos belong in the middle.
Who invented QR codes, and are they free to use? #
Denso Wave, a Japanese company, developed the QR code in 1994 for tracking car parts. The format is an open standard and the company states that no application or license is needed to use one, though “QR Code” itself is a registered trademark.
Can a QR code track who scans it? #
Not on its own. A static code involves no server, so nothing is recorded. If the code contains a link, the website you open sees the usual visit details, and a dynamic code’s provider logs every scan as it forwards you.