How QR codes work, and how to scan them safely
QR codes pack data into a square grid with error correction. Learn how they encode a URL, why some codes fail, and how to check one before you open it.
A QR code is a two-dimensional barcode. Instead of a row of bars, it uses a grid of black and white modules. A camera reads the grid, decodes the pattern and returns the stored data, usually a URL or a short piece of text.
The structure
Three large squares in the corners act as finder patterns. They let the scanner locate the code, determine its orientation and correct for perspective. Smaller alignment patterns help with curved or angled surfaces.
The rest of the grid carries data and error-correction bits. A QR code also stores its version, error-correction level and mask pattern, so the scanner knows how to interpret the modules.
Error correction
QR codes use Reed-Solomon error correction. The encoder adds redundant bits so the decoder can recover data even if part of the code is damaged, covered or poorly printed.
There are four levels, commonly labelled L, M, Q and H. Higher levels tolerate more damage but leave less room for data. A code with high error correction may need to be larger or hold less information.
Capacity and density
More data means more modules. A long URL produces a denser code that is harder to scan from a distance. Short links and simple text produce cleaner codes.
The physical size matters too. A code printed too small, with low contrast or without a quiet margin, may fail even if the data is valid. For posters and packaging, test the printed code with several phones.
Why a code might not scan
- The camera is too close or too far away.
- Glare or shadow reduces contrast.
- The code is curved or partially covered.
- The print is blurry or the modules bleed together.
- The code uses colours with insufficient contrast.
- The scanner app is not decoding the format.
Try moving back, changing the angle and improving the light. If the code is on a screen, increase the brightness.
Scanning safely
A QR code does not tell you where it leads until you decode it. Attackers can place stickers over legitimate codes or print fake ones in public places.
- Preview the URL before opening it.
- Check the domain carefully. Look-alike domains are common.
- Be wary of codes that ask for payment, login or personal details.
- Do not install an app just because a code says so.
- Use your phone's built-in scanner when possible; it often shows a preview.
If you generate your own codes, use a short destination you control and test it before printing. Our QR code generator runs in your browser. For how the link is delivered once scanned, see how the internet works.