QR code

A QR code is a grid of modules, from 21 × 21 in the smallest version to 177 × 177 in the largest. Some modules form fixed shapes that help a scanner read the code: three finder patterns in the corners, two timing patterns, alignment patterns in all but the smallest version, and two copies of the format information. The rest of the grid holds the content, split into 8-bit codewords, followed by Reed–Solomon error correction codewords, with a mask pattern applied so the result has no confusing blocks.

To read it, a scanner finds the three finder patterns, works out the code’s size, angle and which corner is missing a finder (which tells it which way up the code is), samples every module as dark or light, reads the error correction level and mask, removes the mask, repairs any damaged codewords and decodes the text. The phone then decides what to do with that text: open a link, offer to join a network or save a contact.

DENSO WAVE, then part of DENSO Corporation, released the QR code in 1994 to track automotive parts. It became an AIM standard in 1997, a Japanese Industrial Standard in 1999 and an ISO standard in 2000; the current edition is ISO/IEC 18004:2024. DENSO WAVE holds patents on the code but has said it will not exercise them, so anyone can make and read QR codes without a license.

Every QR code follows the same standard, so any phone can read any correctly made code, whoever generated it. The differences that matter all come from choices made when the code is generated:

• What it contains. Content stored directly makes a static code; a short link to a redirect service makes a dynamic code that can be edited and tracked.
• How much it contains. More content means more modules, so each module is smaller at the same print size. See data capacity.
• How robust it is. The error correction level sets how much damage the code survives.
• How it is printed. Size, contrast and a clear quiet zone decide whether a camera can read it in real conditions.

A code itself holds only text. It cannot run anything on a phone; any risk comes from the page or file the text points to, which is why quishing attacks rely on fake links rather than on the code.