What is a QR code? How they work, explained

A QR code is a square pattern of black and white pixels that stores information — a URL, a phone number, a WiFi password, a calendar event, almost anything that fits in a few thousand characters. Point a phone camera at it, and the phone decodes the pattern, recognises what it represents, and offers to do something useful with it. Open a website. Add a contact. Connect to a network. Pay an invoice. The whole exchange takes about half a second from "camera sees the code" to "phone offers an action."

The format is officially called a Quick Response code — invented in 1994 by a Japanese engineering team at Denso Wave to track car parts on a factory floor — and it became globally standardised as ISO/IEC 18004 in the year 2000. The specification is open. Anyone can generate, print, and scan QR codes for free, which is part of the reason they ended up everywhere from restaurant menus to government tax forms.

This post covers exactly what a QR code is, how it actually works (the encoding, the corner squares, the error correction), what kinds of data it can hold, why phones decode them so fast, and the practical decisions any business or solo operator faces when picking the right QR for the right job. By the end you'll know what's inside a QR code well enough to design or troubleshoot one with confidence.

The short answer#

A QR code is a 2D barcode — a printed pattern that stores data in two dimensions instead of one (like the linear stripes on a supermarket barcode). Two-dimensional storage means a QR holds vastly more information per unit of printed area than a linear barcode: up to 7,089 numeric digits, 4,296 alphanumeric characters, or 2,953 bytes in a single code, per the ISO/IEC 18004:2024 specification.

The pattern is read by a camera (any modern phone has one) plus software that recognises QR codes. The software finds the three large square markers in the code's corners (the "finder patterns"), figures out the orientation and scale, then samples the pixels in the data area to recover the original information. The whole decoding pipeline runs in milliseconds on every phone made in the last decade.

The three finder patterns at the corners are the most recognisable feature. They're the same 7×7 module shape on every QR code ever made — a black square with a white inset and a black centre — because that pattern is statistically unlikely to appear randomly in any photographed scene. The decoder finds them, figures out the QR is a QR (and not just three random squares), and uses their relative positions to determine the code's orientation, size, and perspective.

How a QR code actually works#

The encoding-and-decoding pipeline in plain English:

1. Input data is converted to a binary string. Whatever you encode — https://example.com, a phone number, a 100-character message — gets turned into ones and zeros following one of four mode-specific encodings (numeric, alphanumeric, byte, or kanji), per the QR specification.

2. Reed-Solomon error correction codes are appended. This is the magic that lets QR codes scan even when partly damaged. Reed-Solomon codes (the same family used in CDs and satellite communications) add redundancy: extra bytes computed from the data that let the decoder reconstruct missing or corrupted parts. The amount of redundancy is the error correction level (L, M, Q, or H, recovering 7%, 15%, 25%, or 30% of damage respectively). We covered the trade-offs in detail in QR error correction levels.

3. The bits are placed onto a 2D grid. Following a fixed pattern (zig-zagging up and down columns from the bottom-right corner), the binary string is laid out across the QR's data region. The finder patterns, timing strips, and alignment patterns occupy fixed positions; everything else is data.

4. A masking pattern is XORed across the data. This is the step most explanations skip. Without masking, certain patterns of data could produce a code that visually resembles the corner finder patterns, confusing the decoder. Masking applies one of eight predefined patterns (chosen automatically to minimise decoder confusion) so the result always looks like noise to a scanner — which is what a scanner expects.

5. The QR code is rendered as black and white pixels. Each bit becomes one "module" — a single square in the printed pattern. The module size is fixed for a given code; printing it bigger or smaller scales the whole grid uniformly.

When a phone scans the code, this pipeline runs in reverse: find the corners, normalise the perspective, sample the pixels back to bits, undo the masking, run Reed-Solomon to recover any damaged bytes, and decode the binary string back into the original data. Modern phone CPUs do all of this in under 100 milliseconds.

A QR code isn't a barcode-with-extra-pixels. It's a self-describing data format with built-in error recovery, designed by people who already knew what would go wrong on a factory floor.

What a QR code can encode#

The QR specification supports four encoding modes, each optimised for a different kind of data:

• Numeric: digits 0–9 only. Most efficient — up to 7,089 digits in a single code at version 40 with low error correction.
• Alphanumeric: uppercase letters, digits, and a small set of symbols. Up to 4,296 characters.
• Byte: any 8-bit value, including UTF-8 encoded text. The general-purpose mode used for URLs, vCards, WiFi credentials, and most consumer applications. Up to 2,953 bytes.
• Kanji: Japanese double-byte characters using the Shift JIS encoding. Up to 1,817 characters.

In practice, almost every QR code you encounter in the wild uses byte mode — it's the only mode that supports the URL-encoded data most modern QR codes carry. The other modes are legacy or specialised.

The data inside a byte-mode QR can be just about anything. The most common payloads:

• A URL — https://example.com/whatever. The most common payload by orders of magnitude.
• A vCard — structured contact information formatted as a BEGIN:VCARD ... END:VCARD block. Covered in vCard QR codes.
• WiFi credentials — formatted as WIFI:S:NETWORK;T:WPA;P:PASSWORD;;. Covered in WiFi QR codes.
• A calendar event — VEVENT formatted as iCalendar text. Covered in calendar event QR codes.
• An email address with prefilled subject and body — a mailto: URL. Covered in email QR codes.
• A phone number — tel:+1234567890. Initiates a call.
• An SMS message — sms:+1234567890?body=Hello. Opens the messaging app with prefilled text.
• Plain text — anything that doesn't match a URI scheme; the phone displays the text and offers to copy it.

Each of these is a string. The QR code itself doesn't know what kind of payload it carries — it just stores the bytes. The scanner-side software interprets the string and decides what to do with it.

Static vs dynamic QR codes#

QR codes split into two categories that get confused all the time:

Static QR codes encode the destination directly in the printed pixels. A static URL QR code with https://example.com/spring has those characters — that exact URL — baked into the pattern. Change the URL? You re-encode and reprint. Useful for permanent destinations (a homepage, a forever-shareable contact card, a WiFi password that won't change).

Dynamic QR codes encode a short URL that redirects on the server side. The printed QR contains something like linked.codes/q/abc123. When a user scans it, the request hits a server that looks up abc123, finds the current destination URL, and redirects the user there. You can change the destination any time without reprinting.

Dynamic is the right default for almost every commercial QR use case. It gives you the editing flexibility that print campaigns demand, the analytics that justify the campaign budget, and the protection against typos and broken links that static codes can't offer. We covered the full comparison in static vs dynamic QR codes.

QR code versions and capacity#

Every QR code is one of 40 "versions" — fixed sizes ranging from 21×21 modules (version 1, the smallest) to 177×177 modules (version 40, the largest). Higher versions hold more data but require larger printed areas to maintain readability.

For most everyday QR codes:

• A short URL (under 30 characters) fits comfortably in version 2 or 3, around 25×25 modules. Tiny printed footprint.
• A long URL (100+ characters) typically lands in version 7 to 10, around 45×57 modules. Still print-friendly but visibly denser.
• A vCard with full contact details runs version 10 to 15, depending on what's included.
• A maximum-capacity payload (the rare version-40 case) is reserved for special applications — barely scannable from a phone camera at any reasonable size.

Most modern QR generators pick the version automatically based on payload size and error correction level. You almost never need to specify it manually. The relationship is just useful to understand for sizing your printed code: the more you stuff into the QR, the more modules it needs, and the larger it must be printed to stay scannable.

When to use a QR code#

Three honest signals say a QR is the right answer:

1. The user has a phone in hand (or will pull one out without resistance) and the destination is faster to reach via QR than typing.
2. The destination changes over time — a campaign, a menu, a versioned document — and you want one printed surface to keep working.
3. The print surface allows roughly 20mm or more of QR area, with reasonable lighting, where the user can hold the camera steady for half a second.

When QRs don't work well: hostile audiences (older demographics, audiences in regions where QR phishing is common), high-friction scan environments (cluttered visual surroundings, poor lighting, moving users), and contexts where a short typed URL would actually be faster (example.com is faster than scanning).

Pair the QR with a printed short URL underneath. That gives users a fallback, removes the QR-suspicion barrier, and recovers a meaningful percentage of leads who don't engage with QRs.

How modern phones decode QR codes#

iPhones (since iOS 11, 2017) decode QRs natively in the Camera app. Point the camera, the phone recognises the code, a notification appears at the top of the screen, tap it. No app needed. Same on iPads.

Android handles QR codes through Google Lens, which is built into the Camera app on most Pixel phones and Samsung devices made after 2018. Older or budget Android phones may need a third-party scanner app, but coverage is now over 90% of active phones globally.

The decoding library in both platforms is essentially the same algorithm published in the original QR specification, refined over decades to handle real-world camera input — perspective distortion, motion blur, lens warp, low light. The performance gap between "this code scans instantly" and "this code refuses to scan" is rarely about the phone — it's usually about the QR's print quality, size, or colour contrast.

Related reading#

• Static vs dynamic QR codes — the fundamental QR-type decision
• QR error correction levels — the redundancy choice that affects scan rate
• Custom QR code shapes — visual modifications the standard allows
• QR codes vs NFC tags — the alternative tap-to-link technology
• vCard QR codes — encoding a contact card
• WiFi QR codes — sharing network access without exposing the password
• Email QR codes — the underrated business-card replacement
• Calendar event QR codes — getting events into a phone in one tap