The Complete Guide to QR Codes

How QR Codes Work

QR (Quick Response) codes are two-dimensional barcodes invented by Masahiro Hara at Denso Wave in 1994. Originally designed to track automotive parts during manufacturing, they store data in a grid of black and white modules that can be read by any camera-equipped device.

A QR code encodes data using Reed-Solomon error correction. The encoded data is arranged in a matrix with three large square patterns in the corners — these are finder patterns that let a scanner locate, orient, and scale the code regardless of the angle or distance of capture. Timing patterns along the edges help determine the grid size and module positions.

Data capacity depends on the version (size) of the QR code and the error correction level. The largest standard QR codes (Version 40) can hold up to 4,296 alphanumeric characters or 7,089 numeric digits. Four modes are supported:

Static vs Dynamic QR Codes

Static QR codes embed the destination URL or data directly into the code itself. Once created, the encoded content cannot be changed — the URL is baked into the pattern of modules. If you need to update the destination, you must generate and distribute a new QR code. Static codes work without any server or service, and they never expire.

Dynamic QR codes contain a short redirect URL managed by a tracking service. When scanned, the service redirects the user to the actual destination URL. The advantage is that you can change the destination at any time without reprinting the code. Dynamic codes also enable analytics — you can track scan counts, locations, devices, and times.

The tradeoff is that dynamic codes depend on a third-party service staying online. If the redirect provider shuts down, every printed code becomes a broken link. For permanent use cases (product packaging, gravestones, printed manuals), static codes are more reliable. For marketing campaigns and events where tracking matters and the code is temporary, dynamic codes are ideal.

Error Correction Levels

QR codes use four levels of Reed-Solomon error correction, allowing the code to be read even when partially damaged or obscured:

Higher error correction levels reduce the available data capacity, since a larger portion of the code is dedicated to redundancy. When embedding a logo in a QR code, you should always use level H to ensure the code remains scannable despite the masked area.

QR Code Security Risks

QR codes are inherently opaque — a human cannot read the encoded data by looking at the pattern. This creates opportunities for abuse:

Best practices: always preview the URL before following it, use a QR scanner that shows the destination before opening it, never scan codes from untrusted sources, and prefer static codes for permanent placements where possible.

Practical Use Cases

QR codes have become ubiquitous across industries. Common applications include:

Generate a custom QR code →