Inside a QR Code: Error Correction and Why It Matters for Security

Basic structure

A QR code encodes data as a grid of black and white modules, bounded by three large square "finder patterns" in three corners that let a scanner identify orientation instantly, plus smaller alignment patterns for larger codes. The actual data — a URL, text, Wi-Fi credentials — is encoded across the remaining modules using a defined binary format specified by the ISO/IEC 18004 standard.

Error correction levels

QR codes use Reed-Solomon error correction, encoded at one of four levels:

Level	Recovery capacity	Typical use
L (Low)	~7%	Clean digital contexts, maximum data density
M (Medium)	~15%	Common default for general use
Q (Quartile)	~25%	Codes likely to get dirty or slightly damaged
H (High)	~30%	Codes with a logo overlay, or expected wear

Higher error correction means the code can tolerate more physical damage, dirt, or even an intentional logo placed in the center, while still decoding correctly.

The security angle most guides skip

This same resilience is exactly what makes a partial sticker overlay attack viable. An attacker doesn't need to perfectly replicate or fully cover a legitimate code — because of error correction, covering even a meaningful portion of a high-correction-level code can still leave it scannable, meaning a sloppier, faster physical tampering job is more likely to actually succeed than it would be without this built-in tolerance.

What this means for you

If you're generating QR codes for your own use (see our business QR safety guide), choosing a higher error-correction level makes your codes more durable against wear — but also means a would-be attacker's overlay has a better chance of preserving scannability. There's no way to disable this trade-off entirely; it's inherent to the format. The mitigation is physical security of the printed code, not the error-correction setting itself.