use-cases · 5 min read
QR codes explained: how they work and when to use one
A QR code encodes text as a grid of dark and light modules, with position markers that let a camera find and straighten the pattern. The payload can be a website address, Wi-Fi credentials, an email draft, a contact card or plain text.
Most scanning failures are mechanical: too small, too low contrast, no quiet zone, or the wrong error-correction level. Most security problems come from opening the destination without checking it first.
What is actually inside a QR code
A QR code is made of modules, finder patterns in three corners, timing patterns that mark the grid, alignment patterns on larger versions, and format information that tells a scanner which error-correction level and mask are in use. The payload is encoded together with Reed-Solomon error-correction data, so damage or a missing section can be reconstructed up to a point.
There are 40 sizes, called versions, and four data modes: numeric, alphanumeric, byte and Kanji. Byte mode carries UTF-8 text, which is what URLs and most real payloads use. Capacity depends on the version, the mode and the error-correction level; the largest version at the lowest error correction can hold roughly 2,950 bytes, while realistic marketing codes stay far below that.
Error correction: redundancy you pay for
The four levels recover different amounts of damaged data: L about 7 percent, M about 15 percent, Q about 25 percent and H about 30 percent. Higher recovery means more redundant codewords, which leaves less room for the payload and produces a denser code at the same physical size.
M is a sensible default for ordinary screen and print use. Choose H when the code will be small, curved, applied to a rough surface, exposed to weather, or has a logo placed over its centre. Choose L when you need maximum capacity and the surface is clean and well controlled.
The encoder picks the smallest version that fits, so adding one long tracking parameter can push the code into a denser version with smaller modules. That is another reason to keep the payload short and stable rather than packing every campaign variable into the code itself.
Print size, quiet zone and contrast
The quiet zone is the blank border around the pattern, and the standard asks for at least four modules of it. Without that margin a scanner may fail to find the code at all, so never crop a QR image tightly to its dark squares.
A common rule of thumb is that the printed code should be about one tenth of the intended scanning distance, and a couple of centimeters square is a practical minimum for a phone held close. Those are starting points, not guarantees: test the actual print with several phones. Keep dark modules on a light background, use a matte surface, avoid glare and busy backgrounds, and do not invert the colors without testing, because some scanners refuse inverted codes.
Payloads people actually use
A URL payload should include its scheme, such as https://, so the scanner opens it as a link rather than searching for the text. Wi-Fi codes use a compact format with fields for the network name, password, security type and hidden status. Email codes use a mailto: address with optional subject and body, and phone codes use tel:.
The payload is baked into the pattern. A static code cannot be edited after it is printed, so plan for the content to be final: a short, stable URL is far more robust than a long tracking URL that may change.
Security and static versus dynamic codes
Scanning a QR code only reads data; the risk is what the data does. Look at the preview most camera apps show before opening a link, check the domain, and be suspicious of codes stuck over existing ones on posters, parking meters or restaurant tables. Avoid entering a password or payment detail on a page you reached from an unknown code.
Never put a secret in a code you will print or share publicly. A Wi-Fi password inside a code is readable by anyone who scans it, and a code that encodes an admin URL is effectively an unlisted key. Dynamic QR services can change the destination and count scans, which is convenient for campaigns but adds a dependency, a subscription and a privacy cost because the redirect sees every scan.
A QR code is also the wrong tool when the content is long, sensitive or still changing. A plain printed URL is easier for people who cannot use a camera, a longer message belongs on a page the code points to, and a password belongs in a password manager rather than on a printed square. If the code has to serve everyone, print the destination in text next to it.