How do QR codes work? The squares, decoded

A QR code is a two-dimensional barcode that stores data, usually a web address, as a grid of black and white squares called modules. How do QR codes work? Three large squares in the corners let a camera find the code and tell which way up it is, fixed patterns help it map the grid, and extra error-correction data lets it read the code even when up to 30% is dirty or torn.

In short

• Each black or white module is one bit. The code's corners, stripes and small fixed blocks tell the reader where the bits are.
• Built-in error correction, the same mathematics used on CDs, rebuilds missing parts of the code.
• A QR code is only a link: it can point to a fake site as easily as a real one, which is how QR scams work.

Where did QR codes come from?

QR stands for "quick response". The code was developed at Denso Wave, then part of the Japanese car-parts maker Denso, by a two-person team led by Masahiro Hara, and announced in 1994. Ordinary barcodes held only about 20 characters, and factories tracking car parts wanted something that held far more, including Japanese kanji and kana characters, and that a scanner could read quickly. The first working version took about a year and a half to build, and Denso Wave says it could be read more than 10 times faster than other codes of the time.

Two decisions made it universal. The code became a formal standard, approved by the automatic-identification industry body AIM in 1997, in Japan in 1999 and by the international ISO in 2000. And Denso Wave kept its patent but declared it would not exercise it, so anyone could make and read QR codes free. When phone cameras became good enough to scan them, and phone software began reading them without a separate app, QR codes spread to menus, tickets, payments and packaging.

What's inside the squares?

A QR code is a square grid. The smallest, version 1, is 21 modules by 21; each version up adds 4 modules a side, to version 40 at 177 by 177, according to Denso Wave's specification summary. Only part of the grid holds your data. The rest is structure that helps a camera read it:

Part	What it looks like	What it's for
Finder patterns	Three large squares-in-squares in the corners	Let the reader find the code and its orientation
Separators	White borders around the finders	Keep the finders distinct from the data
Timing patterns	Dotted lines of alternating modules between the finders	Show the reader the size of each module and the grid's spacing
Alignment patterns	Smaller squares, from version 2 up	Correct for a code that's curved or photographed at an angle
Format information	Strips beside the finders	Say which error-correction level and mask are used
Quiet zone	A blank margin around the code, 4 modules wide	Separate the code from whatever is around it
Data and error correction	Everything else	The message itself, plus spare data to repair damage

The finder patterns are cleverer than they look. A line drawn through the center of one crosses black, white, black, white and black bands in widths of 1:1:3:1:1. Denso Wave's team surveyed fliers, magazines and boxes to find the ratio least likely to occur by chance in printed material, so the reader can spot it quickly from any angle.

A worked example: how much of version 1 is data?

Version 1 has 21 × 21 = 441 modules. The three finder patterns take 7 × 7 = 49 modules each, 147 in all. Their white separators take 45 more. The two timing lines between the finders take 10, and the format information and one fixed dark module take 31. That's 233 modules of structure, leaving 208 for content: 208 bits, or 26 bytes, called codewords.

Those 26 codewords are shared between the message and its error correction. The more you spend on repair, the less is left for the message. Here is how version 1 divides them, from Thonky's widely used QR tables and character capacities:

Error-correction level	Can recover about	Data codewords	Repair codewords	Capital letters and digits it holds
L	7%	19	7	25
M	15%	16	10	20
Q	25%	13	13	16
H	30%	9	17	10

So "HELLO WORLD", 11 characters, fits in the smallest code at levels L, M and Q, but not at H, where it would need version 2. At the other extreme, version 40 at level L holds 7,089 digits or 2,953 bytes of any data. A typical web address needs a version of 2 to 5 or so, which is why most codes you see have a few more squares than the smallest.

How does a phone read a QR code?

Your phone's camera software reads the code in a series of steps, many times a second:

1. Find it. Scan the image for the 1:1:3:1:1 pattern in three places that form a right angle. The missing fourth corner tells it which way up the code is.
2. Square it up. Use the finders and alignment patterns to undo perspective and curvature, then use the timing lines to work out the grid.
3. Read the format. The format strips say the error-correction level and which of eight masks was applied. A mask is a fixed pattern that flips certain modules so the code avoids large blank areas or shapes that look like finders; the reader flips them back.
4. Read the bits. Collect the data modules in a fixed zigzag order, starting from the bottom right, and group them into codewords.
5. Repair them. Apply Reed-Solomon error correction, which Denso Wave's error-correction page names as the method, to fix codewords that were misread or missing.
6. Decode. The first bits say what kind of data follows, digits, letters, bytes or kanji, and how long it is. The phone then turns the bits into text and, if it's a link, offers to open it.

Error correction is why a QR code can carry a logo in its middle. The designer knowingly covers some modules and relies on the repair data, usually at level Q or H, to rebuild them. It's the same family of mathematics that lets a scratched CD still play. The whole decoding takes a phone a fraction of a second, a small task for the kind of chip described in how computers work.

Are QR codes safe to scan?

The code itself can't do anything harmful: it is only text, most often a web address. The risk is where that address leads. Scanning a code is clicking a link you can't read, and scammers exploit that, a trick sometimes called "quishing", a form of phishing.

The U.S. Federal Trade Commission warned in December 2023 about scammers sticking their own codes over the real ones on parking meters, and sending emails and texts with codes that claim a package couldn't be delivered, an account has a problem, or a password must be changed. The fake site then asks for card details or a login.

How to tell a code is safe

• Check the address your phone previews before opening it, and look for misspellings or odd domains.
• On a parking meter, poster or restaurant table, see whether the code is a sticker placed over something else.
• Be wary of a code in an unexpected email or text, especially one that is urgent. Go to the company's site by typing an address you already know.
• Never enter payment or login details on a site you reached through a code unless you're sure it's genuine.

Once you've opened the link, everything that follows is ordinary web traffic, the same journey described in how the internet works.

Check yourself

• Without looking back: what do the three corner squares do, and why is there no fourth?
• Why does choosing more error correction make a code hold less data?
• Explain why a QR code can't harm your phone by itself, yet scanning one can still be risky.

Sources

• History of QR Code — Denso Wave
• Information capacity and versions of the QR Code — Denso Wave
• Error correction feature — Denso Wave
• QR Code Tutorial, character capacities and error correction tables — Thonky.com
• Scammers hide harmful links in QR codes to steal your information — Alvaro Puig, U.S. Federal Trade Commission, 2023