QR Codes Explained: How They Actually Work

A QR code looks like static, but every one of those black-and-white squares is doing real work: encoding data, marking its own orientation, and carrying enough redundancy to survive a coffee stain or a torn corner. Here's how a pattern that a camera can read in a fraction of a second actually gets built, and why it's so much more capable than the barcodes it replaced.

From barcodes to a two-dimensional code

Traditional barcodes store information in one dimension: the widths of a series of parallel lines. That limits how much they can hold, and a scanner has to sweep across them in the right direction to read them at all. In 1994, the Japanese company Denso Wave, a subsidiary of Toyota, set out to solve a specific problem on the factory floor: workers needed a code that held more data than a barcode, took up less space, and could be scanned quickly from any angle. The result was the "Quick Response" code, built as a grid instead of a line, so it could store information both horizontally and vertically. That two-dimensional structure is the whole reason a QR code can hold roughly a hundred times more data than a standard barcode in about the same footprint.

The anatomy of a QR code

Look closely at any QR code and you'll notice the same structural elements no matter what it encodes:

• Finder patterns — the three bold squares in the top-left, top-right, and bottom-left corners. These let a scanner instantly locate the code and determine its orientation, even if the image is rotated or photographed at an angle.
• Alignment patterns — smaller square markers scattered through larger codes that help correct for distortion, such as when the code is printed on a curved surface or scanned off-angle.
• Timing patterns — alternating black-and-white lines connecting the finder patterns, used to help the scanner count out the grid's rows and columns precisely.
• Format and version information — small encoded strips near the finder patterns that tell the scanner which error-correction level and which of the 40 possible "versions" (grid sizes, from 21x21 to 177x177 modules) it's looking at.
• The data and error-correction region — everything else, which is where your actual content and its redundancy data live.

How the data actually gets encoded

Once a scanner has located and oriented the code, it reads the remaining modules (the individual black or white squares) as binary data. But before that data was ever printed, it went through several stages of encoding.

First, the content is analyzed to see which encoding mode fits best: numeric mode for digits only, alphanumeric for a limited character set, byte mode for arbitrary text or binary data (including full Unicode), or kanji mode for double-byte Japanese characters. Numeric mode is the most space-efficient, which is why a QR code containing only a phone number can be noticeably smaller and simpler than one containing a long URL.

The data is then broken into codewords, and — this is the clever part — passed through Reed-Solomon error correction. This algorithm adds mathematically derived redundant codewords alongside the original data. If some of those modules later become unreadable, the decoder can reconstruct the missing or corrupted data from what remains, the same way it's possible to solve for missing terms in an equation as long as you have enough other information.

QR codes offer four levels of error correction, each trading data capacity for resilience: Level L (recovers about 7% of the code), Level M (about 15%), Level Q (about 25%), and Level H (about 30%). That's why some QR codes still scan correctly even with a logo placed in the middle, or after being printed on a wrinkled sticker — the missing region falls within the error-correction budget.

Finally, the encoded data is arranged into the grid using a specific zigzag pattern, and one of several masking patterns is applied. Masking exists to avoid large blocks of identical color or patterns that could confuse the finder and alignment markers, and the encoder tests several masks to pick whichever produces the most scanner-friendly result.

Why QR codes are everywhere now

QR codes existed for over two decades before becoming a daily habit for most people. What changed wasn't the technology — it was the hardware. Once smartphone cameras could decode QR codes natively, without a separate scanning app, the barrier to using them essentially disappeared. Restaurant menus, payment links, Wi-Fi credentials, event tickets, and product packaging all adopted them because they solve a genuinely useful problem: getting a URL or a chunk of structured data from a physical surface into a phone without anyone typing anything.

If you want to see the structure described above for yourself, generating one is a good way to do it — try Pythous's QR code generator and watch how the pattern changes as you switch between a short numeric string and a long URL.

The security angle worth knowing

Because a QR code's content isn't human-readable before you scan it, it's also become a vector for phishing, sometimes called "quishing." A malicious QR code looks identical to a legitimate one, but points your phone to a fraudulent site instead. The same property that makes QR codes convenient — encoding a destination invisibly — is what makes them exploitable. It's worth checking the URL your phone previews before tapping through, the same way you'd hover over a suspicious link in an email, particularly for QR codes appearing in public places like parking meters or posters where anyone could paste a sticker over the original.

None of this requires memorizing the encoding tables Denso Wave published, but understanding the shape of the system — finder patterns for orientation, Reed-Solomon codewords for resilience, masking for readability — makes it a lot less mysterious the next time your phone reads one instantly, from an odd angle, off a slightly crumpled receipt.

Frequently asked questions

Can a QR code work if part of it is damaged or covered?

Yes, within limits. Thanks to Reed-Solomon error correction, a QR code can still scan correctly even if up to roughly 30% of it (at the highest error-correction level) is missing, smudged, or covered by something like a logo. Beyond that threshold, the decoder no longer has enough redundant data to reconstruct the original.

What's the maximum amount of data a QR code can hold?

It depends on the version (grid size) and encoding mode. At the largest standard size (version 40) with the lowest error correction, a QR code can hold up to about 7,089 numeric digits, around 4,296 alphanumeric characters, or roughly 2,953 bytes of binary/text data. In practice, most QR codes use much smaller grids since they typically encode a short URL or a few lines of text.

Do QR codes expire?

A static QR code — one that directly encodes text, a phone number, or a fixed URL — never expires; it will scan to the same content indefinitely. Some services generate "dynamic" QR codes that redirect through a URL they control, which lets the destination be changed later, but that redirect can stop working if the service is discontinued. If you need a QR code to remain readable long-term, a static one pointing directly to its final destination is more durable.