Anatomy of a QR code
The QR code format was created by Denso Wave in 1994 and is now defined by the international standard ISO/IEC 18004, whose current edition was published in 2024. A code is a square grid of dark and light squares called modules. Some modules are fixed patterns that help a scanner find and read the code. The rest carry your data.
- Finder patterns. The three large squares in three corners. They let a scanner spot the code and work out which way up it is, from any angle.
- Separators and quiet zone. A light border around each finder pattern, and a blank margin around the whole code. The standard calls for a quiet zone four modules wide. Codes printed tight against busy artwork often fail for this reason.
- Timing patterns. Two lines of alternating dark and light modules running between the finder patterns. They tell the scanner how big each module is.
- Alignment patterns. Smaller squares that appear from version 2 upward. They help the scanner correct for a curved or tilted surface.
- Format information. Fifteen bits that record the error correction level and which of eight mask patterns was applied. They are stored twice and protected by their own error-correcting code, because nothing else can be read without them.
- Version information. From version 7 upward, two small blocks record the code's version, also stored twice.
- Data and error correction codewords. Everything else. The data is split into 8-bit codewords, followed by extra error correction codewords, laid out in a zigzag from the bottom right.
Before the code is drawn, one of eight mask patterns is applied to the data area. A mask flips modules in a fixed pattern so the code doesn't end up with large solid blocks or shapes that look like finder patterns. The encoder tries all eight and keeps the one that scores best.
Versions and capacity
QR codes come in 40 sizes called versions. Version 1 is 21 × 21 modules, and each version adds 4 modules per side, up to version 40 at 177 × 177. Data can be stored in four modes: numeric, alphanumeric (digits, capital letters and a few symbols), byte, and kanji. At version 40 with the lowest error correction, a code holds up to 7,089 digits, 4,296 alphanumeric characters, 2,953 bytes or 1,817 kanji characters.
Web links are usually stored in byte mode. Here is how many bytes fit in some common versions:
| Version | Size (modules) | L | M | Q | H |
|---|---|---|---|---|---|
| 1 | 21 × 21 | 17 | 14 | 11 | 7 |
| 2 | 25 × 25 | 32 | 26 | 20 | 14 |
| 3 | 29 × 29 | 53 | 42 | 32 | 24 |
| 4 | 33 × 33 | 78 | 62 | 46 | 34 |
| 5 | 37 × 37 | 106 | 84 | 60 | 44 |
| 7 | 45 × 45 | 154 | 122 | 86 | 64 |
| 10 | 57 × 57 | 271 | 213 | 151 | 119 |
| 40 | 177 × 177 | 2,953 | 2,331 | 1,663 | 1,273 |
The same link needs a bigger code at a higher error correction level, because more of the grid is spent on recovery data. Our own homepage address, https://checkthisqr.com/, is 24 characters. It fits in a version 2 code (25 × 25) at level L or M, and needs version 3 (29 × 29) at Q or H. A 104-character parking-payment link with marketing tracking tags on the end needs version 5 (37 × 37) at level L and version 10 (57 × 57) at level H. That H code has over five times as many modules as the homepage code at level L, so it has to be printed much larger to scan as easily.
How error correction works
QR codes use Reed–Solomon codes, the same family of error correction used on CDs and in deep-space communication. The encoder adds extra codewords calculated from the data. When a scanner reads the code, it uses them to find and repair codewords that came out wrong because of dirt, glare, a scratch or a missing piece. Larger codes split their codewords into several blocks, each repaired on its own, so damage concentrated in one spot is spread across blocks.
| Level | Roughly recoverable | Typical use |
|---|---|---|
| L (Low) | 7% | Screens and clean print, where size matters most |
| M (Medium) | 15% | The usual default for general use |
| Q (Quartile) | 25% | Outdoor signs and labels likely to get dirty |
| H (High) | 30% | Codes with a logo in the middle, or heavy wear |
A worked example: our homepage address at level H becomes a version 3 code with 70 codewords. Forty-four of them are error correction, split into two blocks, and each block can repair up to 11 damaged codewords. That is why a code with a logo printed over its centre still scans: the logo simply counts as damage the code was built to absorb.
QR size calculator
Type or paste a link to see the smallest QR code that can hold it at each error correction level. It runs entirely in your browser and nothing you type is sent anywhere. Real generators sometimes pick a more compact mode for parts of a link, so they can occasionally produce a slightly smaller code than shown here.
What it means for scams
Error correction protects the original, not the attacker. If someone covers part of a genuine code, the scanner either repairs the damage and opens the genuine link, or fails to read the code at all. A scrap of a different code stuck over one corner doesn't make the code open a different site. That's why the scams consumer agencies warn about, such as the parking-meter scams the FTC described in September 2026, use a complete replacement code stuck over the real one. A full-size sticker has edges, sits on top of the surface, and often doesn't match the sign's printing, which is exactly what our sticker-spotting guide teaches you to look for.
Editing a code module by module is possible in theory. In 2010, researchers at SBA Research in Vienna analysed attacks where someone darkens light modules, for example with a marker, to change what a code says while staying inside what error correction will accept (Kieseberg et al., QR Code Security). They showed that the mask, the mode and the data could in principle be targeted, but also that error correction limits how far a code can be changed, and they presented the work as analysis without experimental results. It is a reason not to trust a code just because it looks untouched, rather than a common street scam.
A logo proves nothing. The same tolerance that lets a business put its logo in the middle of a code lets a scammer do it too. A code with a bank's or a city's logo in the centre is no more trustworthy than a plain one.
The pattern can't be read by eye. Masking and the zigzag data layout mean there is no part of the grid you can look at to tell where a code leads. The only reliable test is to decode it and check the link before you open it.
Look for a sticker over the code, then check the link itself. The CheckThisQR checker decodes the code in your browser, follows any redirects, and shows you where it really goes before you visit.
If you make QR codes
- Use level M for most print and Q for outdoor or high-wear spots. Use H only if you are placing a logo over the code.
- Keep the link short, on your own domain. Shorter links make smaller, easier-to-scan codes. Prefer a short path on your own site over a public link shortener, which hides the destination from the people scanning.
- Leave the quiet zone. Keep a blank margin of at least four modules around the code.
- Protect the print, not the setting. No error correction level stops someone sticking a new code over yours. Laminated or engraved codes, codes behind glass, and regular checks of where your codes are posted do. Our business QR safety guide covers this in more detail.
Sources
- ISO/IEC 18004:2024, QR code bar code symbology specification (structure, versions, modes, error correction).
- Kieseberg, Leithner, Mulazzani, Munroe, Schrittwieser, Sinha and Weippl, QR Code Security, TwUC 2010.
- Federal Trade Commission consumer alert on parking QR code scams, September 2026.
- Capacity figures and worked examples were computed by CheckThisQR from the standard's codeword tables and checked against an open-source encoder. See our editorial policy.
Learn to spot the physical tells
Real sticker scams cover the whole code. Here's exactly what a replacement sticker looks like before you ever tap your phone.
See the sticker-spotting guide →