QR (“Quick Response”) codes were invented in 1994 by Denso Wave, a Toyota subsidiary, to track car parts. Today they’re on menus, posters, parcels, tickets and payment terminals, and every modern smartphone camera reads them without an app. Making one takes seconds with our QR code generator, but understanding how they work helps you avoid codes that won’t scan once printed.
How a QR code stores data
A QR code is a square grid of modules (the small black and white squares). Key parts:
- Finder patterns: the three big squares in the corners that tell the scanner where the code is and which way up it is.
- Alignment patterns: smaller squares (in larger codes) that correct for perspective and curved surfaces.
- Timing patterns: alternating lines that help the scanner work out the grid size.
- Format information: which error correction level and mask pattern are used.
- Data and error correction modules: everything else.
Codes come in 40 versions, from version 1 (21 × 21 modules) up to version 40 (177 × 177). More data means a higher version, which means smaller modules at the same print size, which is harder to scan. At maximum, a version 40 code with the lowest error correction holds 7,089 digits, 4,296 alphanumeric characters or 2,953 bytes.
Practical takeaway: keep the content short. A short URL produces a simple, robust code; a long URL with tracking parameters produces a dense one.
Error correction levels
QR codes use Reed–Solomon error correction, so part of the code can be dirty, damaged or covered and it still scans.
| Level | Approx. data recoverable | Use when |
|---|---|---|
| L | ~7% | Clean screens and digital use, maximum capacity |
| M | ~15% | Default for most print |
| Q | ~25% | Industrial labels, outdoor print |
| H | ~30% | A logo in the middle, rough surfaces |
Higher levels add redundancy, which makes the code denser for the same content. Use M for most purposes and Q or H when you add a logo.
Static vs dynamic QR codes
| Static | Dynamic | |
|---|---|---|
| What’s encoded | The final content (URL, text, Wi-Fi details) | A short redirect URL owned by a service |
| Can you change the destination later? | No | Yes |
| Scan statistics | No (unless the URL has your own tracking) | Yes |
| Expires? | Never | When the service or subscription ends |
| Cost | Free | Often a subscription |
Static codes are best for things that won’t change: your own website, a vCard, Wi-Fi credentials, a fixed PDF on your domain. Dynamic codes make sense for printed material where the destination may change, but beware lock-in. A popular middle ground: create a static code pointing to a short URL on your own domain (e.g. example.com/menu). You can change where that page redirects at any time, you keep the analytics, and the code never dies with a third-party subscription.
Size, contrast and placement for print
Size rules of thumb:
- Minimum about 2 × 2 cm (0.8 in) for short content scanned up close.
- For distance scanning, width ≈ distance ÷ 10: 1 m away → 10 cm; 3 m away → 30 cm.
- Denser codes (more data, logo, level H) need to be larger.
Quiet zone: leave a blank margin of at least 4 modules around the code. Cropping it tightly into a design is one of the most common reasons codes fail.
Contrast: dark modules on a light background. Inverted (light on dark) codes work on many phones but not all scanners. Colours are fine if contrast is strong; avoid light yellow, pastel or gradient fills.
Surface and finish: glossy laminates reflect light, curved bottles distort the grid, and folds break modules. Test on the actual material.
Export format: use SVG or a high-resolution PNG for print. A low-resolution JPEG scaled up becomes blurry.
Popular use cases
- Website or landing page: posters, packaging, business cards.
- Wi-Fi access: a
WIFI:code lets guests join without typing the password. - vCard contact details: phone, email and address saved in one scan.
- Menus and ordering in restaurants and bars.
- Event tickets and boarding passes.
- Payments: many countries use QR-based payment systems.
- Product information: manuals, warranty registration, recycling information.
For retail products, a traditional linear barcode (EAN-13, UPC) is still what tills scan. Our barcode generator creates those formats.
Security: “quishing” and how to avoid it
Because people can’t read a QR code with their eyes, criminals use them to hide malicious links. This is called QR phishing or “quishing”. Common tactics:
- fake stickers placed over genuine codes on parking meters and EV chargers, leading to fake payment pages,
- emails with a QR code asking you to “re-verify” a bank or Microsoft 365 account, designed to bypass email link scanners,
- parcel delivery cards or letters with codes leading to fake sites.
For people scanning:
- Check the domain in the preview before opening. Is it really the council’s, the bank’s or the car park operator’s domain?
- Be suspicious of stickers over printed codes.
- Never enter passwords or card details on a site reached by an unexpected QR code; go to the official app or type the address yourself.
For businesses printing codes:
- Point codes to your own domain so customers can recognise it.
- Use tamper-evident printing for public signage and check it periodically.
- Use HTTPS, and keep destination pages simple and clearly branded.
Checklist
- Keep content short; use your own short URL where possible.
- Error correction M by default, Q/H with a logo.
- At least 2 cm wide, larger for distance; 4-module quiet zone.
- High contrast, dark on light; export as SVG or high-resolution PNG.
- Test-scan with several phones on the final printed material.
- Prefer static codes pointing to a URL you control.