Key Takeaways
- A QR code stores data in a grid of black&white squares read in two directions; its three corner finder patterns (with their unmistakable 1:1:3:1:1 stripe ratio) let a scanner read
- Built-in Reed-Solomon error correction means up to about 30% of a code's data can be damaged, dirty or covered — by a logo, say — and it still scans.
- The code itself is harmless data, the FBI stresses; the danger is where it sends you, so check the URL a scan produces before you tap, pay or log in.
Born in a Factory, Built for Speed
The QR Code was invented in 1994 by DENSO WAVE, a Japanese auto-parts company, to track components moving too fast for ordinary barcodes. A barcode reads in one direction; a QR code reads in two — a grid of black and white squares called modules — which is why it holds so much more: a maximum-size code can store 7,089 numeric characters (or 2,953 bytes of anything at all). DENSO WAVE published the specification and waived its patent rights on the standardized code; in 2000 it became the ISO international standard, which is how a factory tool ended up on every restaurant table on Earth.
Why It Scans From Any Angle, Even Damaged
Look at a QR code and you'll see three big squares in three corners. Those finder patterns are how your phone locates the code instantly in any orientation: scan a line through one and the black-white-black pattern always measures 1:1:3:1:1 — a ratio no ordinary text or image accidentally produces. A smaller alignment pattern lets the reader un-warp codes printed on curved or tilted surfaces. The symbol comes in 40 sizes ("versions"), from 21×21 modules up to 177×177.
The real magic is invisible. Alongside your data, the encoder weaves in extra Reed-Solomon check data — the same error-correction family that kept scratched CDs playing. You pick how much when you generate the code: levels restore roughly 7%, 15%, 25% or 30% of the code's data. That's why a code can be smudged, torn, or have a company logo parked in the middle of it and still scan perfectly.
Payment Codes Are a Different Animal
An ordinary QR code usually just holds a web address. A payment QR code — standardized by EMVCo, the card industry's standards body — holds structured payment data instead: merchant account, amount, currency. That's why the code on a shop counter needs your banking or wallet app to do anything (merchant-presented mode), or the merchant scans the code on your screen (consumer-presented). Your camera app alone can't complete the payment, by design.
The One Safety Rule That Matters
"Quishing" — QR phishing — works because the one thing a QR code hides is its destination. The FBI is precise about it: QR codes are not malicious in themselves; the harm sits wherever the code sends you — a fake login page, a payment redirected to a criminal. The FTC has warned about scammers pasting their own codes over real ones on parking meters, and about codes arriving by text with manufactured urgency. The defences are dull and total: preview the address your phone shows before opening it, look for a sticker slapped over a public code, never download an app a QR code offers you (your camera already has a scanner built in), and when money is involved, type the address of the service yourself instead.
The Twikup Take
A QR code is paper hypertext with an engineering safety net — brilliant at surviving damage, silent about destinations. Scan freely; just read the address before you follow it, the way you'd read street signs in a strange city.
Image: AI-generated illustration.