QR Codes, Explained

From factory floor to everywhere

The QR code — "Quick Response" code — was invented in 1994 by a Toyota subsidiary to track car parts on the assembly line, because ordinary barcodes couldn't hold enough information and were slow to scan. Three decades later they are on menus, posters, payment terminals, boarding passes and product packaging worldwide. Their explosion in everyday life came when smartphone cameras learned to read them natively. Read any of them — from your camera or an image — in theQR & Barcode Scanner.

How a QR code actually works

A QR code is a grid of black and white squares called modules, and every part of it has a job. The three large squares in the corners are finder patterns — they let a scanner locate the code and work out its orientation, which is why you can scan a QR code upside down or at an angle. Smaller alignment patterns help correct for distortion when the code is on a curved or tilted surface. Timing patterns (the dotted lines between finders) tell the scanner the size of the grid. The rest of the squares encode the actual data as binary, using black for one and white for zero.

The genuinely clever part is error correction. QR codes use a mathematical scheme (Reed–Solomon coding) that stores the data with redundancy, so the code can still be read even if a chunk of it is missing, smudged, or covered — up to around 30% depending on the level. That is why a QR code with a logo in the middle, or a torn corner, still scans. It is also why they are so robust in the messy real world.

QR codes vs barcodes

A traditional barcode is one-dimensional: a row of vertical lines of varying width that encode a number, read left to right. It is perfect for a product id at a checkout but holds very little data. A QR code is two-dimensional — it uses both width and height — so it holds vastly more, enough for a full web address, a Wi-Fi login, or a contact card.

Scanning safely

A QR code is just data, so the code itself cannot harm your device. The risk is in what it points to. Because you cannot read a QR code with your eyes, scammers exploit that blind trust — a practice sometimes called "quishing" (QR phishing). A malicious code might link to a fake login page, trigger a payment, or connect you to a rogue Wi-Fi network. A few habits keep you safe:

• Preview the URL before opening it. A good scanner shows you the link first — check the domain looks legitimate.
• Beware stickers over codes. In public places (parking meters, restaurant tables, posters), fraudsters stick their own code over the real one. If a code looks tampered with, don't scan it.
• Never enter credentials or pay on a site you reached only through an unexpected QR code, especially one in an email or a random flyer.
• Watch for urgency. "Scan to avoid a fine" or "verify your account now" are classic pressure tactics.

Because this scanner shows the decoded link before you open it — and runs entirely on your device — you stay in control of what happens next.

Why scanning on-device matters

Many scanner websites and apps send camera frames or uploaded images to a server to decode. That is an unnecessary privacy cost: your camera is pointed at your surroundings, your tickets, your documents. This scanner instead uses the browser's built-in Barcode Detection API, so every frame is analysed locally and nothing is uploaded. It is faster (no round-trip), works even on a flaky connection once loaded, and keeps whatever your camera sees private to you.

Why on-device scanning is the right default

It is worth dwelling on the privacy difference, because it is larger than it first appears. Many scanner apps and websites route camera frames or uploaded images through a server to decode them. That means whatever your camera is pointed at — a document on your desk, a room, a ticket with your name on it — leaves your device, and you are trusting an unknown party with all of it, usually to perform a computation your browser can already do instantly.

Many free scanner apps also request permissions far beyond the camera and monetise through advertising or data collection, which is a poor trade for a function the platform provides for free. A browser-based scanner using the built-in detection API avoids the whole category of problem: nothing is installed, nothing is uploaded, and the permission you grant is scoped to a single tab you can close.

Creating codes people can actually scan

If you ever generate a QR code rather than just read one, a handful of practical rules determine whether it works in the real world.

• Keep the URL short. Fewer characters means a lower version, larger modules, and a code that scans from further away and survives poor printing.
• Test on real devices before printing. A code that reads perfectly on your monitor may fail on a matte poster under dim light.
• Respect the quiet zone. Leave a clear margin of about four modules; designers frequently crop this away and break the code.
• Do not invert or tint carelessly. Dark modules on a light background is what scanners expect; low-contrast brand colours are a common failure.
• Raise error correction if you add a logo. Covering the centre only works because redundancy compensates for it.
• Tell people what it does. A short label — "scan for the menu" — dramatically increases the number of people who actually scan it.

That last point is easy to overlook and consistently the most effective. An unlabelled code asks the viewer to take a small leap of faith, and after years of QR-based scams many people simply will not. Naming the destination removes the risk they are weighing up.

The other barcode formats, and where they live

A scanner that reads several formats is more useful than a QR-only one, because the physical world is full of other codes. Each was designed for a specific job, which is why they look so different from one another.

EAN-13 and UPC-A are the retail codes on almost every product you buy — a fixed-length number identifying the manufacturer and item, deliberately simple so a laser scanner can read it in a fraction of a second at a till. Code 128 and Code 39 are the workhorses of logistics: variable length, alphanumeric, and printed on shipping labels, warehouse shelves and asset tags. ITF appears on outer cartons in distribution.

The 2D formats each solve a different constraint. Data Matrix packs data into a very small square, which is why it appears on tiny electronic components and medical vials where a QR code would not fit. Aztec needs no quiet zone around it, making it ideal for transit and airline tickets displayed on a phone screen where space is tight. PDF417 is a stacked format used on driving licences and boarding passes because it can hold several hundred bytes in a rectangular strip. Scanning a boarding pass or a product barcode with this tool reveals the raw payload behind each — often more informative than the ticket or label prints on its face.

What a QR code can actually contain

Most QR codes hold a URL, but the format is far more flexible than that. What determines the behaviour is a small prefix that tells the scanning device how to interpret the payload.

The Wi-Fi one is worth knowing about, because it is genuinely useful and slightly alarming: a QR code stuck on a café wall can contain the network password in plain text, readable by anyone who decodes it rather than connecting. That is fine for a guest network and a poor idea for a private one. Seeing the decoded payload — as this scanner shows before doing anything with it — makes what a code really contains obvious rather than hidden behind an automatic action.

Versions, capacity and error correction

QR codes come in versions from 1 to 40, and the version simply sets the grid size: version 1 is 21 × 21 modules, and each step up adds four modules per side, reaching 177 × 177 at version 40. Bigger grids hold more data — a version 40 code at the lowest error-correction level can carry several thousand characters — but they also need to be printed larger or scanned closer to remain readable.

Cutting across that is the error-correction level: L, M, Q or H, recovering roughly 7%, 15%, 25% and 30% of the data respectively. Higher correction means a more robust code that survives damage, dirt or a logo placed in the centre — which is exactly how branded QR codes work — but it consumes capacity, so the same content needs a larger grid. The practical trade-off is: use higher correction for anything printed, exposed to weather, or carrying a logo; lower correction is fine for a clean code on a screen.

Why a scan sometimes fails

When a code will not read, the cause is usually physical rather than a fault in the code itself. Understanding the common ones makes troubleshooting quick.

• Not enough quiet zone. A QR code needs a clear margin around it — about four modules wide. Codes cropped flush to their edge or butted against text often fail.
• Insufficient contrast. Dark-on-light is what scanners expect. Inverted codes, or ones printed in two similar colours, may not resolve.
• Too small for the distance. A rough rule is that a code should be about a tenth of the scanning distance across — a code read from two metres needs to be roughly 20 cm wide.
• Glare, curvature or focus. Shiny surfaces, bottles and cans distort the grid; move the camera or change the angle.
• Damaged finder patterns. Error correction protects the data, but the three corner squares must be intact for the scanner to locate the code at all.

Static versus dynamic codes

One distinction matters if you ever create codes rather than just scan them. A static QR code encodes its destination directly — the URL is literally in the pattern, so it can never be changed, and it works forever with no dependency on any service. A dynamic code encodes a short redirect URL owned by a provider, which forwards to your real destination.

Dynamic codes let you change the destination after printing and collect scan analytics, which is why marketing platforms favour them. The cost is a permanent dependency: if that provider goes away or the subscription lapses, every printed code becomes dead. For a poster campaign you will update, dynamic makes sense; for something durable like signage, packaging or a business card, a static code pointing at a domain you control is the safer choice. From the scanning side, a dynamic code is also why the URL you see may be a shortener rather than the brand you expect — which is exactly when previewing the link matters most.

QR codes turned a Toyota inventory hack into one of the most universal interfaces on the planet — a bridge between the physical world and a web link. Now you know how they store data, why they're so resilient, and how to scan them without falling for a scam. Point your camera at one in theQR & Barcode Scanner— privately, right in your browser.