QR Codes Explained: How They Work and How to Use Them Safely
QR codes went from a Japanese factory-floor inventory system in 1994 to something scanned billions of times a day on menus, parking meters, and shipping labels. Most people can scan one but couldn't explain what's actually happening — or why a sticker slapped over a legitimate QR code has become a real scam. Here's how they work, what they can hold, and how to make one that's both reliable and safe.
How a QR code actually stores data
A QR code is a grid of black and white squares called modules. Unlike a barcode, which only reads in one direction, a QR code reads in two dimensions, which is why it can pack far more information into the same space — a large one can hold a few thousand characters of text. Three of the four corners have large square "finder patterns" that tell a scanner the code's orientation even if you photograph it sideways or upside down.
The clever part is error correction. Every QR code encodes its data with redundancy using a scheme called Reed-Solomon error correction, borrowed from the same math used in CDs and satellite communication. That's why a QR code still scans with a logo stamped in the middle, a torn corner, or a bit of glare across it — the missing modules can be mathematically reconstructed from the rest, up to a limit that depends on the error correction level you choose.
| Error correction level | Data that can be recovered | When to use it |
|---|---|---|
| L (Low) | ~7% | Clean digital display, no damage risk, want the smallest/simplest code |
| M (Medium) | ~15% | Default for most uses — a reasonable balance |
| Q (Quartile) | ~25% | Printed materials that may get scuffed, folded, or partly obscured |
| H (High) | ~30% | Adding a logo in the center, outdoor signage, industrial labels |
What a QR code can hold (it's not just links)
Most people only associate QR codes with website URLs, but the format can encode several distinct data types, and your phone's camera app usually recognizes each one and offers a different action:
- URL — opens a link directly in your browser, the most common use.
- Plain text — displays a message with no action taken, useful for instructions or a short note.
- Wi-Fi credentials — encodes network name, password, and security type so scanning joins the network without typing anything, common for guest networks and cafes.
- Contact card (vCard) — scanning offers to save a name, phone number, and email straight into your contacts, handy on a business card.
- Email or SMS — pre-fills a message to a specific address or number.
There's also a distinction worth knowing before you pick a tool: a static QR code encodes your actual data directly — the URL or text is baked into the pattern itself, it never expires, and it works forever with no service in the middle. A dynamic QR code instead encodes a short redirect link controlled by a paid platform, so you can change the destination later or see scan counts — but if that company shuts down or you stop paying, the code stops working. For a one-off flyer, a menu, or a Wi-Fi sign, a free static code from a generator like the CalcPerch QR Code Generator is the simpler and more durable choice; you only need a dynamic one if you genuinely expect to redirect the same printed code to a new destination later.
The real risk: "quishing" (QR phishing)
The core weakness of a QR code is also its whole appeal: you cannot read it with your eyes. A link printed as text lets you eyeball the domain before clicking; a QR code hides that until after you've already scanned it. Scammers exploit exactly this gap, a pattern security researchers call quishing (QR phishing) — printing a malicious sticker and pasting it directly over a legitimate code on a parking meter, restaurant table tent, or delivery notice, betting that you'll scan without checking.
A few habits close most of that gap without giving up the convenience:
- Look before you tap. Every modern phone camera shows the destination URL in a preview banner before opening it — actually read it instead of tapping through on reflex.
- Check for a sticker over a sticker. On parking meters and public signage specifically, run a finger over the code; a peeling edge or slightly different material is the giveaway of an overlay.
- Be wary of QR codes that ask for payment or login credentials after scanning, especially in places you wouldn't expect it (a random flyer, an unsolicited email, a note left on your car).
- Never scan a code from an unsolicited text or email claiming to be a delivery, fine, or account issue — treat it the same as you'd treat a suspicious text link.
Making a QR code that scans reliably
A QR code that only sometimes scans is worse than no QR code — most people give up after one failed attempt. A few practical points make the difference between a code that works every time and one that's a source of complaints:
Keep the encoded data short. More characters mean a denser grid with smaller modules, which is harder for a phone camera to resolve, especially at a distance or in bad lighting. If you're encoding a long URL with tracking parameters, shortening it first with a tool like the CalcPerch URL Shortener before generating the code produces a simpler, more forgiving pattern — and it's easier to read printed underneath the code as a fallback, too.
Leave a quiet zone. QR codes need a clear white margin around the whole pattern — cropping too tight or butting other design elements against the edge is one of the most common reasons a printed code fails to scan.
Print it big enough for its distance. A rough rule: the ratio of scanning distance to code width is about 10:1, in the same unit. Ten feet of distance needs a code roughly one foot across — not one inch. Getting the units wrong here is the single most common reason a printed code will not scan, because it makes the code twelve times too small. A poster meant to be read from 10 feet needs a code about 12 inches across; a table tent read from 3 feet needs about 3.5 inches; a business card held 6 inches away needs only about half an inch. Add the quiet zone on top — a clear margin four modules wide on every side.
Test it before printing at scale. Print one copy at final size and scan it with a couple of different phones before ordering 500 flyers or a batch of table tents.
Common QR code myths
| Myth | Reality |
|---|---|
| "QR codes can install malware just by being scanned" | The code itself is inert data — the risk is entirely in what you do after scanning, like opening a malicious link or app it points to |
| "A logo in the middle breaks the code" | Only if it covers too much area — generating with a high error correction level (Q or H) leaves enough redundancy to keep working with a small centered logo |
| "All QR codes expire" | Only dynamic, service-hosted codes do; a static code generated directly from your data works indefinitely with no expiration |
| "You need an app to scan one" | Every mainstream phone camera app has scanned QR codes natively for years — no separate app is needed |
Sources
On the format itself and the scam pattern:
- ISO/IEC 18004:2024 — QR Code bar code symbology specification — the current edition of the standard defining error-correction levels and capacity.
- FTC consumer alert — Scammers hide harmful links in QR codes — the quishing pattern described in this guide.
Frequently asked questions
Can a QR code itself contain a virus?
No — a QR code is just a pattern encoding text or a link, not executable code. The danger is entirely in where that link leads or what it asks you to do next, the same as any other phishing link.
Do free QR code generators expire or stop working later?
A static QR code — one that encodes your actual URL or text directly, like the codes from the CalcPerch QR Code Generator — does not expire and needs no ongoing service to keep working. Only "dynamic" codes from paid tracking platforms depend on that company staying online.
Why won't my QR code scan even though it looks fine?
The most common causes are too little white margin around the code (the quiet zone), the code being printed too small for its scanning distance, or too much data packed in making the pattern too dense for a phone camera to resolve. Shortening the encoded link and leaving generous white space around the code fixes most scanning failures.