How QR Codes Actually Work

QR codes look like random noise, but every square in the grid is doing specific, deliberate work. Here is what is actually encoded in one.

Invented in Japan in 1994

QR codes were created by Denso Wave, a subsidiary of Toyota, originally to track automotive parts through manufacturing faster than traditional barcodes allowed.

Two-dimensional, unlike a barcode

A standard barcode encodes data along a single line, while a QR code encodes data across a full grid in both directions, letting it pack dramatically more information into a similarly sized space.

The three corner squares are for orientation

The large nested squares in three of the four corners let a scanner instantly figure out the code's orientation and boundaries, which is why a QR code still scans correctly even rotated or photographed at an angle.

Built-in error correction can survive damage

QR codes use four error correction levels (L, M, Q, H). At the highest level, roughly 30% of the code can be smudged, torn, or covered and it will still scan correctly — which is also how codes can safely have a logo placed in the center.

Capacity depends on content type and size

A QR code can hold purely numeric data most efficiently, somewhat less as mixed letters and numbers, and less still as raw binary data — larger grid "versions" hold more of any type at the cost of a denser, harder-to-scan pattern.

40 different sizes, called versions

The QR standard defines 40 versions, from a small 21x21 module grid up to a large 177x177 module grid, with generators automatically picking the smallest version that fits the input data.

A generator tool just applies the standard

A QR generator does not create a link to itself — it mathematically encodes whatever text or URL you type directly into the pattern, following the published QR specification, so the resulting image works forever regardless of which tool made it.

Static codes vs. "dynamic" tracking codes

A plain (static) QR code has your actual destination baked in permanently. Some commercial services instead generate a "dynamic" code pointing to their own short redirect link, which lets them change the destination or track scans later — but the code stops working if that third-party service ever shuts down.

Why QR codes suddenly became unavoidable

QR codes existed for over two decades before becoming a daily fixture — the sharp jump in everyday use came from contactless necessity, particularly restaurant menus and check-in flows during the pandemic era, combined with smartphone cameras gaining built-in QR scanning without a separate app.

The security habit worth building

Scanning an unfamiliar QR code is functionally the same as clicking an unfamiliar link — it can lead anywhere, including a convincing fake login page. Most phone cameras show a preview of the destination URL before opening it; it is worth actually reading that preview instead of tapping through automatically.

Why some codes look "denser" than others

Encoding a long URL directly produces a busier, higher-version code than encoding a short one, which is part of why many QR generators quietly shorten a long link first — a shorter input produces a simpler, more reliably scannable code.

Frequently Asked Questions

Can a QR code itself contain a virus?

No — a QR code is just encoded text or a URL, not executable code. The risk comes from where that URL leads or what it asks you to install or enter, the same as any link.

Do QR codes expire?

A static QR code, with the destination encoded directly, never expires. A "dynamic" QR code from a tracking service stops working if that service is discontinued or the underlying account lapses.

Why do some QR codes have a logo in the middle?

Generators using a high error-correction level can afford to have a chunk of the code obscured by a logo and still scan correctly, since a large percentage of the data is intentionally redundant.

Does making a QR code require an internet connection?

No — encoding text into the QR pattern is a documented, offline algorithm. An internet connection is only needed if the tool you are using happens to run in a browser or app that requires one.