A QR code works by arranging encoded data and error-correction information in a standardized grid of light and dark modules. A scanner finds the symbol’s fixed patterns, corrects its perspective, samples the grid, reverses the placement rules, and reconstructs the stored bytes. Those bytes might contain text, contact data, or a web address.
What happens in five steps
1. Software converts a message into codewords
An encoder selects a QR version and one or more data modes suited to the input. Numeric, alphanumeric, byte, and other defined modes represent characters differently. The encoder adds mode and length information, turns the data into bits, fills the available capacity, and calculates error-correction codewords using the rules in the QR standard.
2. The bits enter a patterned square
The encoder places fixed function patterns before filling data modules. Three prominent finder patterns help identify the symbol and its orientation. Timing patterns establish the grid spacing; alignment patterns help correct distortion in larger versions. Format and version areas describe decoding choices. A required quiet zone around the symbol separates it from surrounding graphics.
3. A mask improves readability
Raw data can accidentally form large blank blocks, long stripes, or shapes that resemble finder patterns. The encoder evaluates defined masking patterns and applies the one that creates a more scanner-friendly distribution. Masking changes module colors according to a reversible rule; it is not encryption and does not hide the message.
4. A camera locates and samples the grid
A scanner captures an image and searches for the characteristic finder-pattern relationships. Geometry derived from those features helps rotate and flatten a symbol viewed at an angle. The decoder estimates module centers, reads their light or dark values, identifies the mask and version, then extracts codewords in the specified order.
5. Error correction reconstructs the payload
Reed-Solomon error correction lets a decoder recover from a limited number of missing or wrong codewords. The selected correction level trades capacity for resilience. After correction, the decoder interprets the mode and data. A phone may then display the text or offer an action, such as opening the decoded URL.
How a damaged code can still scan
Error correction is often described with approximate recoverable percentages, but a simple percentage does not guarantee success. Damage location, print quality, blur, glare, perspective, module size, contrast, decoder quality, and whether critical function patterns remain visible all matter. A decorative logo can consume part of the correction margin, so it should never be treated as permission to cover arbitrary areas.
A QR code is a container, not a website
The square may directly store plain text, a phone number, Wi-Fi configuration, or a URL. When it contains a URL, the website remains separate and can change or disappear. A so-called dynamic QR service usually prints a redirect address that its operator can later point somewhere else. The printed modules do not rewrite themselves.
Scanning also does not prove that the data is truthful. Anyone can encode a familiar logo’s name or a misleading address. A validly decoded message can still lead to fraud, unwanted software, a fake payment page, or a tracking redirect.
Why some QR codes fail
Insufficient quiet space, weak contrast, glossy reflections, low resolution, motion blur, extreme perspective, folds, and printing below a scanner’s useful module size can prevent reliable sampling. Reversing light and dark may work in some readers but is less dependable. Testing the final physical size, material, lighting, distance, and several reader types is more meaningful than testing only the design file.
What determines how much a code can hold
QR versions increase from small grids to much larger grids. Capacity depends on version, correction level, data mode, and the characters being stored. A short all-numeric message can be represented more compactly than the same number of arbitrary bytes. Adding data can force a higher version, making each module smaller when the printed square stays the same size. That can make scanning harder at a distance. A short, direct web address often produces a simpler physical symbol than a long address filled with tracking parameters. The practical limit is therefore not only the standard’s maximum byte count; it is the module size, contrast, viewing distance, camera, and environment in which people must scan it.
A scanning safety boundary
Preview the decoded address before opening it. Check the exact domain, especially around parking meters, payments, deliveries, account logins, or unsolicited messages. Do not assume a sticker belongs to the surface underneath it. Avoid entering passwords or financial information after an unexpected scan, keep devices updated, and navigate independently to an organization’s known site when uncertain.
The useful mental model
Think of a QR code as a tiny tiled envelope with built-in landmarks and repair clues. The landmarks tell a camera where the envelope is, the tiles carry the message, and the repair clues recover a limited amount of damage. They do not judge whether the message is safe.
