What a QR code is
A QR (Quick Response) code is a two-dimensional barcode invented in 1994 by Masahiro Hara at Denso Wave to track car parts on assembly lines. The QR specification became an ISO standard in 2000 (ISO/IEC 18004) and Denso released the technology royalty-free, which is why it spread so widely. A QR code can store up to 4,296 alphanumeric characters or 7,089 numeric digits — more than enough for any URL.
Anatomy of a QR code
- Finder patterns — the three big squares at three corners help the scanner orient the code regardless of rotation.
- Alignment patterns — the smaller squares help correct for camera angle and perspective.
- Timing patterns — alternating black/white lines between the finder patterns set the module size.
- Format and version information — encodes the error-correction level and the version (size).
- Data and error-correction codewords — the actual content, plus Reed-Solomon redundancy.
- Quiet zone — the empty border around the code. At least 4 modules wide; required for reliable scanning.
Error correction — why QR codes still scan when damaged
QR codes use Reed-Solomon error correction to recover from missing or corrupted data. There are four levels:
| Level | Recoverable | Capacity overhead | Best for |
|---|---|---|---|
| L (Low) | ~7% | Lowest | Clean digital displays |
| M (Medium) | ~15% | Default for most generators | General use |
| Q (Quartile) | ~25% | Higher | Print, environments with dirt or wear |
| H (High) | ~30% | Highest | Outdoor signage, codes with custom logos |
Higher error correction means the code can survive being scratched, partially covered, or stylized with a logo — at the cost of denser modules and more black squares overall.
How big does the code need to be?
A scanner needs the camera to resolve each module (the smallest black or white square) clearly. A common rule of thumb for printed QR codes is:
- Minimum module size: roughly 0.3 mm at scan distance of 30 cm.
- Scan distance ratio: the code's side length should be about 1/10 of the typical scan distance. For a poster scanned from 1 m, that means at least 10 cm wide.
- Billboard: a billboard scanned from 10 m away needs a code roughly 1 m across.
Static vs dynamic QR codes
A static QR code encodes the destination URL directly. The URL is permanent — change it and you have to print a new code. This is the only kind a free generator produces, and it has no tracking.
A dynamic QR code encodes a short redirect URL (like qr.example.com/abc123) that a server resolves to the real destination. The code itself never changes, but the destination can be edited and per-scan analytics can be captured. Dynamic codes require an active hosting service and a subscription on most platforms.
For permanent links that won't change (your homepage, business card), static is fine. For marketing campaigns where the destination might change, dynamic is worth the cost.
Designing QR codes that scan reliably
- Keep the quiet zone empty. Four modules of blank space on every side.
- Maintain high contrast. Dark modules on a light background. Light-on-dark works but reduces scan reliability on some apps.
- Avoid inversion. Inverted-color QR codes (white modules on black) violate the spec and fail in many older scanners.
- Logo overlays are fine if you use level H error correction and keep the logo to about 20% of the code area.
- Test before printing. Scan with multiple apps and devices, including older Android phones. Scan from realistic distances.
- Avoid printing too small. Below 2 cm is often unreliable even with high error correction.
Security considerations
A QR code is just an opaque box from the user's perspective — they cannot see the destination before scanning. Attackers exploit this:
- Quishing — phishing via QR code. A sticker over a legitimate QR on a payment terminal can redirect to a fake payment site.
- Malicious downloads — codes pointing to APK or PDF downloads that bypass app-store vetting.
Best practice for users: scanning apps that preview the URL before opening it. iOS Camera and Google Lens both show the URL first; older third-party apps may auto-open.