How QR codes work: versions, error correction and Wi-Fi codes

A QR code is a small, well-engineered piece of error-correcting storage. You can scratch part of one, cover a corner with a logo or print it slightly crooked, and a phone still reads it in a fraction of a second. Knowing a bit about how that works helps you make codes that scan reliably, and avoid the ones that don’t.

This article looks at the structure of a QR code, what the error correction levels actually buy you, how Wi-Fi and other special codes are written, and practical rules for print. The QR code generator lets you change every setting mentioned here and download the result as PNG or SVG.

Where QR codes came from

QR (“Quick Response”) codes were invented in 1994 by Denso Wave, a Toyota group company, to track car parts on production lines. Barcodes of the time held about 20 characters and had to be scanned in one direction. The QR code stores thousands of characters and can be read from any angle. The format is standardised as ISO/IEC 18004, and Denso Wave chose not to enforce its patent, which is a big part of why QR codes are everywhere.

The anatomy of a code

Every QR code has the same fixed parts:

• Finder patterns: the three big squares in the corners. They let a scanner find the code, its size and its rotation. The missing fourth corner tells it which way is up.
• Timing patterns: alternating rows of dark and light modules between the finders, which fix the grid spacing.
• Alignment patterns: smaller squares that appear from version 2 onwards and help correct for perspective when the code is photographed at an angle.
• Format and version information: the error correction level, the mask and (for large codes) the version, stored twice for safety.
• The quiet zone: an empty margin around the code. The spec asks for 4 modules. Codes printed edge to edge without it are a common reason for failed scans.

Everything else is data and error correction.

Versions: the size of the grid

The size of a QR code is its version, from 1 to 40. A version-n code is (17 + 4n) modules square: 21 × 21 for version 1, up to 177 × 177 for version 40. The generator picks the smallest version that fits your data at the chosen error correction level.

For example, https://devtoolbox.cc fits in a version 2 code (25 × 25) at level M, and needs version 3 (29 × 29) at level H. Shorter content means bigger modules at the same printed size, which means easier scanning. That’s the main reason to shorten a URL before you encode it.

Encoding modes

QR codes store data in one of several modes, and the mode changes the capacity a lot:

Mode	Characters allowed	Max in a version 40-L code
Numeric	0–9	7,089 digits
Alphanumeric	0–9 A–Z, space and $ % * + - . / :	4,296 characters
Byte	Any bytes (UTF-8 text in practice)	2,953 bytes
Kanji	Shift JIS double-byte characters	1,817 characters

Alphanumeric mode has only uppercase letters. HTTPS://EXAMPLE.COM/ABC fits in alphanumeric mode, while the lowercase version needs byte mode, which takes more space. Scheme and host are case-insensitive, so some print campaigns write URLs in uppercase to get a smaller code. That works only if the path on the server is also case-insensitive.

Non-Latin text uses byte mode with UTF-8. A Cyrillic letter takes 2 bytes, an emoji 4, so text in those scripts fills a code faster than English.

Error correction: L, M, Q, H

QR codes use Reed-Solomon error correction, the same family of codes used on CDs and DVDs. Extra codewords let the scanner rebuild data from a damaged code:

Level	Recovers up to	Use when
L	about 7%	Clean digital display, maximum capacity
M	about 15%	The usual default
Q	about 25%	Printed on things that get worn or dirty
H	about 30%	A logo covers part of the code, harsh environments

Higher levels need more modules for the same data, so the code gets denser. That’s a real trade-off: a dense code printed small can be harder to scan than a sparse code with less error correction. For a short URL on a poster, M is enough. Choose H only when you really are going to cover part of the code.

A logo in the middle works because it destroys fewer modules than the error correction can repair. Keep it under about 20% of the area at level H, never cover the finder patterns, and test with several phones.

Masks

A large area of the same colour or a pattern that looks like a finder confuses scanners. So the encoder XORs the data with one of eight mask patterns, scores each result against penalty rules from the spec, and keeps the best one. You never choose the mask by hand, but it’s why two codes for almost identical text can look completely different.

Special content: Wi-Fi, email, phone

A QR code only stores text. Phones recognise certain formats in that text and offer an action:

https://example.com                     open a link
mailto:ann@example.com?subject=Hi       write an email
tel:+15550109988                        call a number
SMSTO:+15550109988:On my way            send an SMS
WIFI:T:WPA;S:Home;P:secret;;            join a Wi-Fi network

The Wi-Fi format started as a ZXing convention and is now understood by the cameras on iOS and Android:

• T: is the security type (WPA, WEP, or nopass for an open network)
• S: is the network name, and P: the password
• H:true marks a hidden network
• the string ends with ;;

The special characters \ ; , : " in the name or password must be escaped with a backslash. A network called Home;Net is written S:Home\;Net;. Forget the escape and the code joins the wrong network or none at all. The QR code generator has a Wi-Fi mode that builds and escapes this string for you. It keeps the password in memory only; it’s never saved in the browser.

Email subjects and bodies inside mailto: links are URL-encoded. The URL encoder shows exactly what a subject turns into.

Printing QR codes that scan

Some practical rules:

• Contrast: Dark modules on a light background. Many scanners fail on inverted codes (light on dark) and on low-contrast colour pairs. The generator warns when the contrast ratio drops below 4:1 or the colours are inverted.
• Size: A common rule of thumb is a scanning distance of about 10 times the code’s width. A code scanned from 30 cm should be at least 3 cm wide. On a billboard seen from 10 m, you need about a metre.
• Quiet zone: Leave 4 modules of margin, and don’t let text or graphics touch the code.
• Format: Use SVG for print. It’s a vector format, so it stays sharp at any size, while a small PNG scaled up gets blurry edges.
• Testing: Scan the printed proof, not the file on your screen, with at least two phones.

Static vs dynamic codes

A static code contains the final content, such as the full URL. It works forever and doesn’t depend on any service. A dynamic code contains a short redirect link run by a QR service. You can change the destination later and count scans, but the code stops working if the service shuts down or your subscription ends, and every scan passes through a third party.

For anything printed that should outlive a marketing campaign, a static code pointing to a domain you control is the safer choice. The generator on this site only makes static codes. Nothing is tracked, nothing expires, and the content is encoded directly in the image.

A note on security

A QR code is an unreadable link. Attackers stick fake codes over real ones on parking meters and restaurant tables (“quishing”) to send people to phishing pages. Before you open a scanned link, check the domain your phone shows in the preview. If you publish codes, put the human-readable URL next to them so people can check it too.