How QR codes work, and how to scan them safely

6 min read

QR codes are everywhere, from menus and parking meters to posters and parcels. They are simple and useful, but because you cannot read one by eye, it pays to know what is inside and how to avoid the bad ones.

What a QR code is

A QR code is a square pattern of black and white modules that stores data, usually a web address, some text, a Wi-Fi login or a contact card. Your phone camera finds the pattern, reads the modules and turns them back into the stored data.

The three large squares in the corners are finder patterns. They tell a scanner where the code is and which way up it is, which is why a code scans from any angle.

How much a QR code can hold

The largest QR code, version 40, can hold up to 7,089 digits, 4,296 letters and digits, or 2,953 bytes of ordinary text at the lowest error correction level. More data means a denser code with smaller modules, which is harder to scan.

For this reason, a short web address makes a much easier code than a long one. If your link is long, a shorter address gives a cleaner, more reliable code.

Error correction

QR codes include extra data so that the code can still be read when part of it is dirty, damaged or covered. There are four levels, which can recover about 7% (L), 15% (M), 25% (Q) or 30% (H) of the code.

Higher levels are more forgiving but make the code denser. Use a high level for printed codes and codes that will have a logo placed over the middle.

Static codes and tracked codes

A static code stores your data directly inside the pattern. It never expires and works without any website or account. Codes made by the Toolstia generator are static and are not tracked.

Some services create dynamic codes that point to their own address, which then redirects to yours. These can be edited later and counted, but they stop working if the service stops or you stop paying.

Making a good QR code

Keep strong contrast: dark modules on a light background. Inverted codes scan poorly on some phones.
Leave a quiet border of blank space around the code, about four modules wide.
Print it large enough. A code on a business card needs to be about 2 cm across, and one on a poster much bigger.
Test it on more than one phone before printing a large batch.
Use SVG for print, since it stays sharp at any size.

QR code scams to avoid

Because a QR code hides its destination, criminals sometimes put fake codes on parking meters, posters or letters, or stick a new code over a real one. The link leads to a page that copies a payment or login screen. This is sometimes called quishing.

How to scan safely

Look at the address before you open it. A trustworthy code leads to the website you expect.
Be suspicious of codes on stickers that sit on top of another code, and of unexpected codes sent by post or email.
Never enter a password, card number or one-time code on a page you reached from a code unless you are sure it is genuine.
For payments, use your bank’s own app instead of a website opened from a code.
If a code asks you to install an app, stop and check where it came from.

Reading a code without opening it

The QR code scanner on Toolstia reads a code from a photo or your camera and shows you the raw contents, so you can read the address first and decide whether to open it. The video is analysed on your own device and is never recorded or sent anywhere.