A short history
The QR code — "Quick Response" — was developed in 1994 by a team led by Masahiro Hara at Denso Wave, then part of the Toyota group, to track car parts through manufacturing faster than linear barcodes allowed. Denso Wave published the specification openly and chose not to enforce its patents on the standard format, which is a large part of why QR codes are everywhere today. The format is standardised as ISO/IEC 18004. "QR Code" remains a registered trademark of Denso Wave.
Thirty years on, the same design reads in a fraction of a second on a phone camera. Here is what is inside.
Anatomy of a symbol
A QR code is a square grid of modules — the individual black and white squares. The grid size depends on the version: version 1 is 21 × 21 modules, each version adds four per side, and version 40 is 177 × 177.
Not every module carries your data. Some are fixed structural patterns:
| Part | What it is | What it is for |
|---|---|---|
| Finder patterns | The three large squares in the corners, 7 × 7 modules | Locating the code and working out its orientation |
| Separators | A one-module white border around each finder | Isolating the finders from the data |
| Timing patterns | Alternating dark and light lines between the finders | Fixing the module grid, so the decoder knows the module size |
| Alignment patterns | Smaller 5 × 5 squares, from version 2 upwards | Correcting for perspective and curved surfaces |
| Format information | 15 bits beside the finders, stored twice | Error correction level and mask number |
| Version information | 18 bits near two finders, from version 7 upwards | The version number, stored twice |
| Quiet zone | A blank margin at least four modules wide | Separating the code from its surroundings |
The finder patterns are the clever part. Scanned across in any direction, each one produces dark and light runs in the ratio 1 : 1 : 3 : 1 : 1. That ratio was chosen because it is rare in ordinary printed material, so a decoder can find three of them quickly in a cluttered image — at any rotation — and know it has found a QR code. With three corners known, the fourth is implied, which is also how the decoder knows which way up the code is.
From text to bits: encoding modes
The encoder picks the most compact mode for the data. Each mode packs characters differently:
| Mode | Characters | Bits per character |
|---|---|---|
| Numeric | 0–9 | 10 bits per 3 digits (≈3.3 each) |
| Alphanumeric | 0–9, A–Z (upper case), space, $ % * + - . / : |
11 bits per 2 characters (5.5 each) |
| Byte | Any byte; in practice UTF-8 text | 8 bits each |
| Kanji | Shift JIS double-byte characters | 13 bits each |
The differences are large. A 20-digit number fits in a version 1 code in numeric mode; encoded as bytes, the same digits need version 2.
The bitstream for each segment is:
- a 4-bit mode indicator,
- a character count whose length depends on mode and version (for byte mode, 8 bits up to version 9 and 16 bits beyond),
- the data itself.
Then a terminator, padding to a whole byte, and — if there is still room — alternating pad bytes 11101100 and 00010001 until the version's capacity is filled.
Why URLs are usually byte mode, and when they need not be
Lower-case letters are not in the alphanumeric set, so a normal URL is encoded as bytes. But the scheme and domain of a URL are case-insensitive: HTTPS://EXAMPLE.COM and https://example.com go to the same place. For a short URL made only of upper-case letters, digits and alphanumeric-set punctuation, upper-casing can let the encoder use alphanumeric mode. In our tests, https://example.com/p/48213 needed version 3 as bytes and version 2 upper-cased.
The catch: paths are often case-sensitive. /Menu and /menu can be different pages. Only upper-case a URL if you control the server and know it does not care.
Reed–Solomon error correction
The data codewords are split into blocks, and for each block the encoder calculates Reed–Solomon error correction codewords — polynomial arithmetic over a 256-element finite field, GF(2⁸). The same mathematics protects data on CDs and in QR codes because it is extremely good at correcting burst errors: many consecutive damaged bytes, exactly the kind of damage a scratch or smudge causes.
The four error correction levels set how many correction codewords are added: roughly enough to recover 7% (L), 15% (M), 25% (Q) or 30% (H) of the codewords. The data and correction codewords from all the blocks are then interleaved, so physical damage in one area is spread across several blocks rather than destroying one completely. Our error correction guide covers which level to choose and what each costs in capacity.
Placing the bits
The final codeword sequence is laid into the grid in a fixed zigzag: starting at the bottom-right corner, moving upward in a column two modules wide, then downward in the next, snaking across the symbol and skipping the structural patterns.
Masking: making the code readable
Data placed directly into the grid can produce patterns that confuse a scanner — large solid areas, or accidental shapes resembling a finder pattern. So the encoder applies one of eight mask patterns, each a simple rule such as "invert every module where (row + column) is even", to the data area.
It tries all eight and scores each result against four penalty rules:
- runs of five or more same-coloured modules in a row or column,
- 2 × 2 blocks of a single colour,
- sequences resembling the 1 : 1 : 3 : 1 : 1 finder ratio,
- an imbalance between dark and light modules overall.
The mask with the lowest penalty wins, and its number is written into the format information so the decoder can undo it.
Format and version information
The format information is 15 bits: 2 for the error correction level, 3 for the mask number, and 10 bits of BCH error correction protecting those 5. It is XOR-ed with a fixed pattern so it is never all zeros, and written twice — once around the top-left finder, and split between the other two — so it survives damage to one copy.
From version 7 upward, the version information gets the same treatment: 6 bits of version number protected by 12 BCH bits, stored in two places.
How a phone reads it
Decoding runs the whole process backwards:
- Find the finders by scanning the image for the 1 : 1 : 3 : 1 : 1 ratio.
- Correct the perspective, using the three finders and the alignment patterns to map the tilted, possibly curved image back onto a square grid.
- Sample each module, deciding whether it is dark or light — which is why contrast matters so much.
- Read the format information to learn the error correction level and mask.
- Remove the mask and read the codewords along the zigzag path.
- De-interleave and run Reed–Solomon decoding to correct errors.
- Parse the segments by mode and hand the result to the operating system, which decides what a URL, WiFi string or contact card should do.
All of that happens in a few milliseconds.
What the data means: payload formats
The QR standard only defines how to store bytes. What those bytes mean is a set of conventions that grew up around it:
| Payload | Format | Defined by |
|---|---|---|
| Website | https://… |
URL standards |
| WiFi | WIFI:T:WPA;S:…;P:…;; |
Convention introduced by the ZXing project, adopted by iOS and Android |
| Contact | BEGIN:VCARD … |
vCard (RFC 2426 / RFC 6350) |
| Event | BEGIN:VEVENT … |
iCalendar (RFC 5545) |
mailto: |
RFC 6068 | |
| Phone | tel: |
RFC 3966 |
| Bitcoin | bitcoin: |
BIP-21 |
| Product | https://id.gs1.org/01/… |
GS1 Digital Link |
Each of our generators produces one of these, with the escaping rules each format requires. The individual guides — WiFi, vCard, Event — go into the details.
Relatives of the QR code
- Micro QR — a smaller variant with a single finder pattern, for very small parts. Few phone cameras read it.
- rMQR (rectangular Micro QR) — rectangular codes for narrow spaces such as cable labels, standardised as ISO/IEC 23941.
- Data Matrix — a different 2D code, dominant in industrial and pharmaceutical marking. See QR code vs barcode.
Frequently asked questions
How much data can a QR code hold?
At the largest size (version 40) and lowest error correction: 7,089 digits, 4,296 alphanumeric characters, or 2,953 bytes. Practical codes hold far less — a short URL uses version 2 or 3 — because smaller codes scan more reliably.
Who invented the QR code?
A team led by Masahiro Hara at Denso Wave, a Toyota group company, in 1994. It was designed for tracking automotive parts and later became an open ISO standard, ISO/IEC 18004.
Why do QR codes have three squares in the corners?
They are finder patterns. Their 1:1:3:1:1 ratio of dark and light runs is rare in other printed material, so a scanner can locate them quickly at any angle and use them to work out the code's position and orientation.
Are any two QR codes the same?
The same content with the same settings always produces the same code. Change anything — one character, the error correction level, or the mask the encoder chooses — and the pattern changes completely.
Can a QR code contain a virus?
A QR code contains only data, usually text or a URL, and cannot run code by itself. The risk is the destination: a link to a phishing site or a malicious download.
Further reading
- Do QR codes expire? — A QR code itself never expires — but a dynamic code can die when a subscription ends. How to tell which kind you have, and how to get an editable code without the risk.
- GS1 Digital Link: QR codes on products, explained — How GS1 Digital Link puts a product's GTIN, batch and expiry into a QR code that both checkouts and phones can read, what Sunrise 2027 means for brands, and how to build one correctly.
- How to scan a QR code on any device — Scan QR codes with the built-in camera on iPhone and Android, from a screenshot or photo, on a Windows or Mac computer — and what to do when a code will not scan.
- QR code design: how to customise without breaking it — Which colours, logos, dot styles and print finishes keep a branded QR code scannable — with the contrast numbers, logo limits and pre-print checklist designers need.