The black-and-white square is on the restaurant table, the parking meter, the wedding invitation and the side of a bus — the most successful piece of computer vision ever deployed, scanned billions of times a day by people who never think about it. Understanding how QR codes work rewards the curiosity: inside that square is a small masterpiece of encoding — orientation markers, compressed data, and error correction strong enough to read a code with a coffee stain through its middle. This explainer decodes the decoder.
A QR code, invented in 1994 by Denso Wave for tracking car parts, is a
A QR code, invented in 1994 by Denso Wave for tracking car parts, is a grid of modules whose arrangement encodes data in two dimensions, which is why it holds hundreds of times more than a one-dimensional barcode’s stripes. Three corners carry the famous finder patterns, the nested squares your camera locks onto first: from their relative positions the scanner knows the code’s location, size, rotation and even skew, which is why codes scan upside-down, sideways and at angles.
Smaller alignment patterns correct for distortion when the code is printed on a curved bottle or photographed in perspective. Strips of metadata near the finders announce the code’s format and error-correction level, and timing patterns give the scanner its grid coordinates. Only after this scaffolding is understood does the camera read the remaining modules as actual data, which is why a code can be recognised in a fraction of a second from a moving phone.
The payload — usually a URL, but possibly Wi-Fi credentials, contact cards, payment addresses or plain text — is first converted into a bitstream using one of several encoding modes chosen for compactness: numeric mode squeezes three digits into ten bits, alphanumeric handles capitals and basic symbols, byte mode carries arbitrary text and URLs, and kanji mode serves the code’s Japanese origins. A header declares the mode and length, the data follows, and the whole stream is laid into the grid in a zig-zag pattern that snakes around the finder patterns.
Capacity scales with size: the largest standard version, a 177 by 177
Capacity scales with size: the largest standard version, a 177 by 177 grid, holds up to about 4,300 alphanumeric characters or 7,000 digits — enough for far more than links, which is why offline payloads like boarding passes and two-factor setup keys live comfortably in QR form. Any competent QR code creator is doing this exact arithmetic behind its single download button.
The magic ingredient is redundancy. After the data bits, the encoder appends error-correction codewords computed with Reed-Solomon mathematics, the same family used on CDs and deep-space transmissions, such that the original data can be reconstructed even when part of the code is unreadable. Creators choose the level:
This is not merely defensive: it is why logos can legally sit in the middle of branded codes, since the logo is treated as damage the correction budget was spent on in advance, and why codes survive print wear, weather and partial obstruction in the real world. A final flourish, masking, shuffles the data pattern through one of eight reversible disguises, chosen by penalty rules to avoid large same-colour blocks and fake finder patterns that would confuse scanners. The code in the wild is thus not a picture of data but a fault-tolerant transmission, engineered for a hostile channel that happens to be your camera.
A QR code cannot be inspected by eye because its machine-only
A QR code cannot be inspected by eye because its machine-only readability is also its risk, and criminals noticed. A sticker over a parking meter’s genuine code leads to a look-alike payment page, and a code in an email telling a user to scan to verify an account routes around standard link-inspection habits, landing on phishing pages with the victim’s guard down in a technique known as quishing. The defences are habits rather than tools.
Users should preview before opening since most camera apps now show the URL and let you decide, reading the domain like any other link, especially checking its spelling. People should distrust codes that arrive unsolicited by email or message claiming urgency, as legitimate organisations rarely ask you to scan to fix an account. Inspect physical codes in public places for sticker-over-sticker tampering, and prefer typing the known address or using the official app when money is involved. Treat scanned Wi-Fi and payment codes with the same care as typed ones, recognising that safety lives in the user’s understanding of where technology leads.
The victory of QR over rival formats came down to engineering and economics: codes are free to create since the format is open and royalty-free for users, cost nothing but ink to deploy, need no power or network on the printed side, and every phone became a scanner without extra hardware. Knowing how QR codes work — finders and alignment, compact modes, Reed-Solomon redundancy, and a destination you should always preview — converts a black-and-white square from a mystery you obey into a tool you understand, which is the correct relationship with any technology this widespread.