QR Codes Explained: The Encoding Hiding in Plain Sight on Every Product

A QR code can store up to 7,089 numeric characters in a square matrix of black and white modules that a phone camera reads in under a second. The encoding is specified by ISO/IEC 18004, a standard published in 2000 and revised in 2006 and 2015. Every QR code on every product, poster, and boarding pass follows that same specification.

The code was invented in 1994 by Masahiro Hara at Denso Wave, a Toyota subsidiary, for tracking automotive parts on the factory floor. The design had to solve a specific problem: 1D barcodes could not encode enough data and could not be read quickly enough on a moving assembly line. Hara's team built a 2D matrix with built-in error correction so that a damaged or partially obscured code would still scan.

You can generate and decode QR codes with the QR Code Generator to see the structure described below.

A QR code is a square grid of modules. The grid size depends on the version: Version 1 is 21x21 modules, and Version 40 is 177x177. Each version adds 4 modules per side, so Version N is (17 + 4N) x (17 + 4N) modules. The version number is encoded directly into the code so the decoder knows the grid size.

The code contains several fixed structural elements that the decoder locates before reading any data:

Finder patterns: Three large squares in the top-left, top-right, and bottom-left corners. Each is a 7x7 module pattern with a 3x3 black center surrounded by a white border and a black border. These patterns tell the decoder where the code is and how it is oriented. The three-finder-pattern arrangement also tells the decoder which way is up, since the fourth corner (bottom-right) has no finder pattern.

Alignment patterns: Smaller 5x5 squares placed at specific positions in larger QR codes (Version 2 and above). Version 2 has no alignment patterns. Version 7 has six. Version 40 has 29. These correct for geometric distortion when the code is printed on a curved surface or photographed at an angle.

Timing patterns: Alternating black and white modules in a single row and column connecting the finder patterns. These tell the decoder the module size and the spacing of the data grid.

Format information: 15 bits placed next to the finder patterns. This encodes two things: the error correction level (L, M, Q, or H) and the mask pattern applied to the data. Format information is encoded with BCH error correction so the decoder can recover it even if part of the code is damaged.

Version information: 18 bits in Version 7 and above, placed near the top-right and bottom-left finder patterns. This encodes the version number with BCH error correction.

Everything else is data and error correction codewords. The Barcode Generator produces 1D barcodes for comparison, which lack this structural complexity.

QR codes support four encoding modes, each with different capacity and character sets:

Numeric mode encodes digits 0-9. It packs three digits into 10 bits, giving a density of 3.33 bits per character. A Version 40 QR code at low error correction holds 7,089 numeric characters. This is the most efficient mode and is used for things like product serial numbers.

Alphanumeric mode encodes 45 characters: digits 0-9, uppercase A-Z, and nine symbols (space, $, %, *, +, -, ., /, :). It packs two characters into 11 bits, giving 5.5 bits per character. A Version 40 code at low error correction holds 4,296 alphanumeric characters. Lowercase letters are not in this set, so encoding lowercase text requires byte mode.

Byte mode encodes 8 bits per character, supporting any byte value. This is the mode used for UTF-8 text, URLs with mixed case, and binary data. A Version 40 code at low error correction holds 2,953 bytes. Most QR codes you encounter in practice use byte mode because URLs contain lowercase letters and special characters.

Kanji mode encodes Shift JIS double-byte characters used in Japanese. It packs one Kanji into 13 bits. A Version 40 code at low error correction holds 1,817 Kanji characters. This mode is rarely seen outside Japan.

The encoder selects the most efficient mode for the input data. Many QR codes use mixed modes, switching between numeric, alphanumeric, and byte segments within a single code. The mode is indicated by a 4-bit mode indicator at the start of each segment.

The ISO/IEC 18004:2015 standard defines all of this. The full specification is available from the ISO store. Denso Wave maintains a technical reference covering the design rationale.

QR codes use Reed-Solomon error correction over GF(256), the same family of codes used on CDs, DVDs, and in QR's cousin format Data Matrix. The error correction level determines how many codewords can be damaged before the code becomes unreadable:

- Level L: 7% of codewords can be restored - Level M: 15% of codewords can be restored - Level Q: 25% of codewords can be restored - Level H: 30% of codewords can be restored

The tradeoff is simple: higher error correction means more redundancy, which means fewer data codewords fit in the same grid. A Version 5 QR code (37x37 modules) holds 106 data codewords at level L but only 64 at level H.

Reed-Solomon works by appending parity codewords to the data. The encoder treats the data as a polynomial over GF(256) and divides by a generator polynomial to produce the parity. The decoder uses the parity to detect and correct errors. If too many codewords are damaged (beyond the code's capacity), the decoder fails.

QR codes use a structured extension of Reed-Solomon called block interleaving. The data is split into blocks, each block gets its own Reed-Solomon parity, and the blocks are interleaved. This means a vertical scratch across the code damages a few codewords in each block rather than destroying one entire block, which improves the chances of successful correction.

You can see the same error correction principle in the Data Matrix Generator, which also uses Reed-Solomon over GF(256).

After the data and error correction codewords are placed in the grid, the encoder applies a mask. Masking flips certain modules (black becomes white, white becomes black) according to one of eight mask patterns. The purpose is to break up large blocks of same-colored modules that confuse the decoder's grid detection.

The eight mask patterns are defined by formulas evaluated at each module's (row, column) position:

- Mask 0: (row + column) mod 2 == 0 - Mask 1: row mod 2 == 0 - Mask 2: column mod 3 == 0 - Mask 3: (row + column) mod 3 == 0 - Mask 4: (floor(row/2) + floor(column/3)) mod 2 == 0 - Mask 5: (row column) mod 2 + (row column) mod 3 == 0 - Mask 6: ((row column) mod 2 + (row column) mod 3) mod 2 == 0 - Mask 7: ((row + column) mod 2 + (row * column) mod 3) mod 2 == 0

The encoder tries all eight masks and scores each result using a penalty system defined in the standard. The penalty rules check for long runs of same-colored modules, for patterns that look like finder patterns, and for large blocks of same-colored modules. The mask with the lowest penalty score is selected, and its number (0-7) is encoded in the format information so the decoder knows which mask to undo.

This step is what makes QR codes look "noisy" compared to the clean finder and alignment patterns. The data area appears random because the mask has scrambled it.

QR codes appear in payment systems (Alipay, WeChat Pay, PayPal), ticketing (airline boarding passes, concert tickets), product packaging, restaurant menus, and advertising. The pandemic accelerated adoption: restaurant QR code menus went from novelty to standard between 2020 and 2022.

For developers, the practical considerations are version selection and error correction level. If you are encoding a URL, byte mode is almost always required because URLs contain lowercase letters. A typical URL of 30-50 characters fits in a Version 3 or 4 QR code at level M. For print applications where the code might be smudged or partially torn, level Q or H is worth the extra size.

The main limitation is that QR codes are not secure by themselves. A QR code can encode any URL, including malicious ones. Scanning a QR code that resolves to a phishing site is a real attack vector. The encoding provides no authentication. If you need to verify that a QR code is legitimate, you need an additional layer such as a digital signature embedded in the encoded data or a server-side verification step.

Micro QR codes (defined in ISO/IEC 18004 Annex D) are a smaller variant for applications with limited space. They have only one finder pattern and support fewer encoding modes. iQR codes (a Denso Wave extension) support rectangular shapes and higher data density. Neither is as widely supported as standard QR codes.