How QR codes work
Learn what a QR code stores, how scanners orient and recover it, and how to create codes that remain easy to scan.
A QR code is a two-dimensional grid that encodes data as light and dark modules. It can hold text directly, including a URL, but it is not a remote redirect service by itself. Reliable codes depend on enough contrast, a clear quiet zone and a sensible amount of content.
A QR code stores data in a matrix
The recognisable squares in three corners help a scanner find and orient the symbol. Other fixed patterns help it determine spacing and version information. The remaining modules encode the payload plus error-correction data.
When the payload is a web address, the scanner decodes that address and offers to open it. The QR code has not contacted a server during decoding. If the destination URL later changes or disappears, a static code still contains the old URL.
- Plain text is displayed directly by a compatible scanner.
- A URL should include its scheme, usually https://, to reduce ambiguity.
- More input generally produces a denser matrix with smaller modules at the same image size.
Error correction adds redundancy
QR error-correction levels add different amounts of recovery information. Higher correction can help when a code is slightly dirty or damaged, but it also increases density or the required physical size. It cannot rescue poor contrast, severe cropping or a code printed too small.
Choose a moderate level for ordinary digital and clean print uses. Consider a higher level where minor wear is expected, then scan-test the exact final artwork. Decorative logos placed over the matrix deliberately obscure data and are not guaranteed safe merely because correction is enabled.
Contrast and the quiet zone are essential
A conventional dark foreground on a light background is the most dependable combination. Similar-brightness colours may look stylish but give a camera little information to separate modules. Transparency can also create unpredictable contrast when the image is placed elsewhere.
The empty border around a code is called the quiet zone. It separates the matrix from nearby text, borders and patterns. Do not crop it tightly or place controls against it. Increasing image dimensions does not help if a design tool later removes that clear margin.
- Prefer a dark foreground and light, opaque background.
- Keep a consistent margin on every side.
- Avoid stretching the image non-proportionally after export.
Pick PNG or SVG for the destination
PNG is convenient for documents, messages and interfaces that expect a bitmap. Export it at the intended pixel dimensions or larger, then scale down cleanly. Scaling a small PNG up can blur module edges.
SVG is resolution-independent and is usually better for print layouts and large signage. Treat an SVG as a file asset rather than copying unknown markup into a page. Whichever format you use, preserve square proportions and let the browser or design application scale both dimensions together.
Test the final code, not only the preview
Scan with more than one current phone if the code is important. Test from the likely distance, in realistic light and after printing or embedding it in the final design. Confirm that the decoded text is exact and that a URL uses the correct domain and secure scheme.
Be cautious about encoding private information: anyone who can see the code can decode its contents. A QR code is a convenient representation, not encryption or access control.
Avoid common QR mistakes and privacy surprises
A frequent mistake is testing the generator preview and then modifying the exported code until it is no longer equivalent. Cropping, low-resolution screenshots, non-proportional resizing, a busy background and print bleed can all damage the module grid or quiet zone. Test after every material design or production change, including lamination, placement behind glass and display on a dim screen.
Scanners normally show decoded content to the person holding the device, but not every scanning interface makes a destination obvious before opening it. Use a recognisable HTTPS domain, avoid unnecessary tracking parameters and provide the destination in readable text nearby when space allows. Never place a password, access token or private personal record in a public code: encoding changes the appearance, not who can read it.
- Do not promise that error correction makes an altered code reliable.
- Do not invert colours unless the final combination has been tested widely.
- Remember that a static code cannot update its embedded destination by itself.
- Keep a human-readable alternative for people who cannot or prefer not to scan.