How QR Codes Store Information
Photo: dlxmedia.hu / Pexels
A QR code looks like a random splatter of black and white squares, but every square, called a module, is a deliberate binary bit arranged according to an international standard. Masahiro Hara and his team at Denso Wave, a subsidiary of the Toyota-affiliated Denso Corporation, invented the format in 1994 to scan automotive parts faster than the 1D barcodes then used on Toyota's factory floor. What makes a QR code genuinely clever is not that it stores data, plenty of formats do that, but that it can lose almost a third of its modules to dirt, glare, or a company logo and still be read correctly, every time, by a phone camera that has never seen the code before.
This article walks through what's actually happening between the moment a camera sees a QR code and the moment your phone opens a link: how the grid orients itself, how the data is packed into the modules, and how a sixty-year-old mathematical trick borrowed from deep-space communication lets a torn, dirty, or partially covered code still work.
Where the QR code came from, and the problem it was built to solve
Before QR codes, Toyota's supply chain ran on standard 1D barcodes, the kind still printed on grocery items. A single 1D barcode can hold about 20 characters, which was not enough to track the growing number of parts and variants flowing through Japanese auto plants in the early 1990s. Workers on the line were reportedly scanning up to ten separate barcodes per box just to log a single shipment, according to accounts of the project from Denso Wave and Japan's Patent Office (Japan Patent Office). For how the older 1D codes are scanned, see how bar codes are read by lasers.
Hara's team set out to design a code that held far more data in the same footprint and, critically, could be scanned quickly from any angle, since factory workers did not have time to carefully align a scanner every time. The two-dimensional grid design, reading data in both the horizontal and vertical axes instead of just one line, solved the capacity problem. The three large squares placed in three of the four corners, called finder patterns, solved the alignment problem. Denso Wave publicly documented that the team studied the board game Go for inspiration on how to distinguish black-and-white ratios that a scanner could recognize reliably against cluttered factory backgrounds (Denso, DRIVEN BASE).
Denso Wave also made an unusual decision for a 1994 Japanese manufacturer: it chose not to enforce its patent rights against anyone using the QR code for reading purposes, which is a major reason the format became a public standard rather than staying locked to Toyota's supply chain. That decision, decades before smartphones existed, is part of why a factory-floor tracking tool from 1994 ended up on restaurant menus and payment terminals worldwide by the 2020s.
The grid is a map before it is data
Every QR code starts with three large squares in three of its four corners, the finder patterns mentioned above. A scanner locates these first, because they tell the reader where the code begins, how it's rotated, and what its outer boundary is. Without them, a phone camera would have no reliable way to know if it is looking at the code straight on, sideways, or at a steep angle, and every scan would require the user to line the camera up precisely, defeating the entire point of a fast-scanning code.
Next to the finder patterns sits a smaller square called the alignment pattern, which lets the decoder correct for warping if the code is printed on a curved surface, like a bottle or a badge. Timing patterns, alternating strips of black and white modules running between the finder squares, give the scanner a ruler: they establish exactly how large one module is in pixels, so the reader can count modules accurately even from a photo taken at a distance or a shallow angle. Without timing patterns, a slightly blurry or distant photo could cause the decoder to miscount modules and misread the entire grid.
Once the code is oriented, the scanner reads the remaining modules in a specific zigzag path defined by the QR specification, ISO/IEC 18004, converting black and white squares into binary 1s and 0s. That raw bitstream is then split into two logical layers: the actual data (numbers, text, or a URL) and the error correction information that protects it. This layered design, find the code, then read the code, then verify the code, is what separates a QR code from a simple grid of black and white pixels.
Reed-Solomon codes make the "damaged code still works" trick possible
QR codes use Reed-Solomon error correction, a mathematical scheme invented in 1960 by Irving S. Reed and Gustave Solomon while working at MIT Lincoln Laboratory. The same family of algorithms is used in CDs, DVDs, and deep-space communication systems, because all of these formats share the same underlying problem: data has to survive physical damage, whether that's a scratch on a disc, cosmic noise on a radio signal, or a coffee stain on a printed label.
The scheme works by adding redundant data blocks, called error correction codewords, that let a decoder mathematically reconstruct missing or corrupted modules. A useful, if imperfect, analogy is a sudoku puzzle: if enough of the grid's logic is intact, you can solve for the missing numbers even though several cells are blank. Reed-Solomon does something structurally similar with binary data, using polynomial mathematics over what's called a finite field (a closed system of numbers where addition, subtraction, multiplication, and division always produce another number inside that same system) to compute what the missing modules must have been.
QR codes support four error correction levels, and whoever generates the code chooses one depending on how much damage it's likely to face in the real world. The percentages below are fixed by the ISO/IEC 18004 standard itself, not a setting that varies between QR-generator apps or vendors.
| Level | Data recovery capacity | Typical use |
|---|---|---|
| L (Low) | ~7% of codewords can be lost | Clean digital display, no printing damage expected |
| M (Medium) | ~15% of codewords can be lost | Standard printed use, default in most generators |
| Q (Quartile) | ~25% of codewords can be lost | Industrial labels exposed to wear and handling |
| H (High) | ~30% of codewords can be lost | Codes with a logo overlaid in the center |
Higher error correction levels trade code capacity for durability; the more redundancy built in, the larger or denser the code needs to be to hold the same amount of actual data.
This table is also why you can put a company logo over the middle of a QR code, a common marketing trick used on packaging and posters, and it still scans. The logo intentionally destroys a controlled portion of the grid, and the error correction was designed with enough spare redundancy to absorb exactly that kind of loss. A QR code generated with low-level (L) error correction and the same logo would very likely fail to scan, because there simply isn't enough redundant data to reconstruct what the logo covered.
Why higher error correction shrinks usable capacity
Redundancy is not free. Every error correction codeword added to a QR code takes up space that could otherwise hold actual data, meaning a level-H code holding the same message as a level-L code has to be physically larger or use a higher "version" (denser grid) to fit both the payload and the extra redundancy. Designers pick the lowest level that reasonably covers expected real-world damage, rather than defaulting to maximum protection, because oversized codes with excess modules are also harder for a low-resolution phone camera to resolve cleanly.
Why the black squares aren't simple "on-off" bits the way you'd expect
A single QR module doesn't carry meaning by itself. Meaning comes from its position within the grid's defined data regions, much like a single letter means nothing until it sits in the right place inside a word. This is a subtle but important point: you cannot look at one black square in isolation and know anything about the message it's part of.
The decoder reads modules in the required zigzag sequence set by the specification, groups them into 8-bit bytes, and applies a mode indicator, a 4-bit flag near the start of the data stream that tells the decoder whether the payload is numeric, alphanumeric, byte data (typically used for URLs), or Kanji characters. Choosing the right mode matters for efficiency: a numeric-only code, like a product serial number, packs far more digits into the same grid than a byte-mode code holding arbitrary text or a URL, because the numeric mode encodes three digits into just 10 bits instead of using a full byte per character.
How much data can a QR code actually hold?
The maximum capacity of a single QR code, version 40, the largest standard size defined in ISO/IEC 18004 with a 177×177 module grid, is 7,089 numeric characters, 4,296 alphanumeric characters, or 2,953 bytes at the lowest error correction level. Most everyday QR codes use far smaller versions than this maximum, since a typical URL only needs a few dozen characters and a smaller grid is both faster to print and easier for a phone camera to resolve at a glance.
Why does a QR code need a "mode indicator" at all?
Mode indicator — a short binary flag near the start of a QR code's data stream that tells the decoder which character set the following bits represent (numeric, alphanumeric, byte, or Kanji). Without it, the decoder would have no way to know whether a given run of bits means the number "123" or the three letters "abc," since both could theoretically be represented by similar-looking binary patterns depending on the encoding chosen.
Where QR codes hit real limits
A QR code that has taken more damage than its error correction level can compensate for simply fails to scan; there is no partial or garbled read, only success or total failure. This binary outcome surprises people used to formats like JPEG images, where damage produces visible artifacts rather than an outright failure to open. Extreme glare, low contrast between the black and white modules, or a torn finder pattern are the most common real-world failure causes, not fundamentally different from the way an overexposed photograph loses recoverable detail once the sensor data is clipped.
Camera resolution matters more than most people assume. A phone camera has to resolve individual modules clearly enough to distinguish black from white at the code's printed size, which is why tiny QR codes on receipts sometimes fail to scan from arm's length but work once the phone moves closer, similar to how error-correcting memory in solid-state drives depends on precisely reading each physical cell's charge state before any error correction can even begin. If the raw signal, whether that's a camera's view of a module or an SSD's read of a memory cell, is too degraded to interpret in the first place, no amount of downstream error correction can rescue it.
Print quality is another real constraint. Low-resolution printers or cheap thermal receipt paper can blur adjacent modules together, effectively merging what should be two distinct black-and-white squares into a single ambiguous gray region. Designers who need QR codes to survive rough printing conditions, warehouse labels exposed to grease and abrasion, for example, generally choose Quartile or High error correction specifically to buy margin against this kind of print degradation, accepting a physically larger code in exchange for reliability.
What people get wrong about QR codes
A common misconception is that a QR code is simply a "square barcode," implying it's just a 1D barcode bent into two dimensions. That undersells what actually changed. The two-dimensional layout is what allowed the roughly 350-fold jump in data capacity over the traditional barcodes Denso's engineers were replacing, not merely a shape change but a fundamentally different way of packing information, reading in both axes with dedicated structural patterns dedicated purely to orientation and error correction.
Another frequent assumption is that all QR codes are equally durable. In practice, durability depends entirely on which of the four error correction levels the code's creator chose at generation time, and that choice is invisible to the person scanning it. A code with low-level protection printed on a surface exposed to scuffing will eventually fail, not because QR codes are unreliable as a format, but because the wrong level was chosen for the environment.
People also sometimes assume QR codes inherently track personal data or location by their nature, when in fact a QR code is only a container for whatever text or URL was encoded into it, similar to how a piece of paper with a phone number written on it carries no more privacy risk than the phone number itself. Any tracking capability comes from what a URL does after it's opened, such as a web server logging the visit, not from anything inherent to the QR format itself. That said, users should be cautious about scanning QR codes from unfamiliar public sources, since the code itself cannot verify where a URL actually leads before your phone opens it.
Dynamic codes and the security risk hiding inside a familiar square
Everything described so far applies to a static QR code, one where the destination data is encoded directly into the module grid at creation time and can never change without generating an entirely new code. A dynamic QR code works differently: the physical grid encodes a short, fixed URL pointing to a redirect service, and that service, controlled by whoever generated the code, can be updated at any time to point somewhere new without reprinting the code itself. This is why a single QR code on a restaurant menu or a poster can be redirected to a different landing page over its lifetime, and it's also why marketers favor dynamic codes for tracking scan counts, locations, and timestamps, data a static code has no mechanism to report back.
That same flexibility is exactly what makes dynamic codes a double-edged tool from a security standpoint. Because the physical code encodes only a redirect link rather than a fixed destination, a scanner has no way to visually verify where a dynamic code will actually send them before scanning it, and neither does the code's original creator have any guarantee the redirect service stays under their control indefinitely.
Quishing exploits a gap in how people evaluate trust online. Years of security training have taught people to hover over a link before clicking it, checking the actual URL displayed in the corner of a browser window before committing. A QR code defeats that habit entirely, because there is no visible URL to inspect before your phone's camera decodes the grid and opens whatever address is encoded inside it, static or dynamic. A malicious actor exploiting this gap doesn't need to break the Reed-Solomon math or forge a finder pattern; they only need to print a QR code that looks plausible in context, on a fake parking meter sticker, a fraudulent delivery notice, or an email attachment, and let normal human trust in a familiar-looking format do the rest.
Attackers have also physically tampered with legitimate static codes, printing a sticker with a malicious code directly over a real one on a parking meter or a public poster, a low-tech attack that requires no understanding of the QR format's internals at all. Security researchers generally recommend the same practical precautions that apply to any unfamiliar link: check for signs of tampering, such as a sticker that looks layered over original signage, avoid scanning codes from unsolicited mail or messages, and, where a phone's camera app supports it, review the destination URL preview before tapping through to open it.
What's the practical difference between a static and a dynamic QR code for everyday use?
A static QR code's destination is permanently locked in at the moment it's generated and can never be redirected elsewhere later, which makes it simpler and arguably more trustworthy for one-off uses like a Wi-Fi password or a business card. A dynamic QR code routes through an editable redirect link, letting the creator update the destination and track scan analytics after the code is already printed, at the cost of the scanner having no way to independently verify where that redirect currently points.
The takeaway
A QR code works because it separates three distinct jobs into three distinct parts of the grid: finding itself, using finder and timing patterns, surviving damage, using Reed-Solomon error correction, and carrying meaning, using the encoded bitstream and its mode indicator. That layered design, borrowed from decades-old error correction math originally built for CD players and deep-space probes, is what lets a torn, dirty, or logo-covered square of pixels reliably deliver a working link every single time, without the reader ever needing to know any of this is happening underneath.
The format's real legacy is less about the specific grid pattern and more about a design decision Masahiro Hara's team made in 1994: build enough redundancy into a system that it degrades gracefully under real-world abuse instead of failing outright. That same principle, protect information from physical damage by giving it structured redundancy rather than hoping conditions stay clean, shows up everywhere from spacecraft communication to the SSD in your laptop.
Read next:
FAQ
Q: Can a QR code still work if part of it is torn or dirty?
Yes, up to the limit of its error correction level. At the highest level (H), a QR code tolerates roughly 30% module damage using Reed-Solomon error correction, the same math family used to recover deep-space transmission data (Wikipedia).
Q: Why do QR codes have three big squares in the corners?
Those are finder patterns. They let a scanner instantly detect the code's orientation, size, and boundaries before it attempts to read any actual data, regardless of the angle the photo was taken from.
Q: How much text can one QR code hold?
A maximum-size QR code (version 40) holds up to 7,089 numeric digits or 4,296 alphanumeric characters at the lowest error correction setting, per the ISO/IEC 18004 standard, though most real-world codes use far less.
Q: Who invented the QR code?
Masahiro Hara led the team at Denso Wave, a subsidiary tied to the Toyota Group, that developed the QR code in 1994 to scan automotive parts faster than traditional 1D barcodes on the factory floor (Japan Patent Office).
Q: Why can you put a logo in the middle of a QR code?
Because doing so intentionally damages a controlled portion of the grid, and if the code was generated with high error correction, the Reed-Solomon redundancy can mathematically reconstruct the covered modules during a scan.
Q: What's the difference between a QR code and a regular barcode?
A regular 1D barcode stores data in a single line and holds roughly 20 characters. A QR code stores data across a two-dimensional grid, holding thousands of characters, and includes built-in error correction that 1D barcodes lack entirely.
Follow new articles
Add SciHub101 to your feed reader to see new science and technology stories.
About the Author
SciHub101 is an independent science and technology publication founded and edited by Buğra Sözeri, a software engineer and app developer based in Türkiye. AI tools assist with drafting and research. Source documentation in the existing archive is uneven, and articles are being reviewed and corrected. The Editorial Team byline identifies editorial responsibility; it does not certify specialist or independent human review. Where we compare products, anything built by our own team is labelled as such — see the editorial guidelines and About page for how corrections and disclosures work.
Related Articles
Best Free E-Signature Tools in 2026 (No Signer Account)
Best free e-signature tools in 2026 where signers need no account: eSignSimple, Zoho Sign, SignWell, Dropbox Sign, DocuSign and Adobe compared on limits and audit trails.
Best Free Online Tools in 2026: How to Pick Them Safely
A hub for our 17 free-tool guides, from PDFs and e-signatures to AI photo apps and prayer times, plus a checklist for privacy, file handling, free tiers, and accessibility.
Best Free PDF Tools With No Watermark in 2026
Best free PDF tools with no watermark in 2026: pdfdots, PDF24, PDFgear, Stirling-PDF, Sejda and iLovePDF compared on limits, file privacy, and price.
Best Spec Comparison Sites With Auditable Scores (2026)
Best spec comparison sites with auditable scores (2026): vsMars, GSMArena, RTINGS, DXOMARK, Technical City, and PassMark compared on method and limits.