How Do QR Codes Work?
A QR code is a piece of text — usually a web address — drawn as a grid of black and white squares. Your phone's camera finds the grid, reads the squares back into text, and acts on whatever it finds: opening a link, joining a WiFi network, saving a contact. That's the whole trick. The interesting parts are how the grid is laid out so a camera can read it from any angle, and how it survives being scuffed, folded, or printed badly.
This guide covers the pattern itself (modules, finder patterns, timing patterns), error correction levels and what they mean in practice, the difference between static and dynamic codes, and why every modern phone reads QR codes straight from the camera app.
The grid: modules, finder patterns, and timing patterns
Each small square in a QR code is called a module, and each module is one bit: dark means 1, light means 0. The smallest QR code (Version 1) is a 21×21 grid; the largest (Version 40) is 177×177. More data means more modules, which is why a code holding a long URL looks denser than one holding a short one.
The three large squares in the corners are finder patterns. Each is a 7×7 bullseye with a fixed dark-light-dark ratio that almost never occurs by accident in a photo, so scanning software can spot all three quickly, work out which corner is which, and read the code even if it's rotated, tilted, or mirrored. That's why you don't have to hold your phone straight.
Between the finder patterns run timing patterns — single rows and columns of strictly alternating dark and light modules. They tell the scanner exactly how big one module is and where each row and column falls, so it can map the photographed image back onto a clean grid. Larger codes also include smaller alignment squares scattered through the middle to correct for curved or warped surfaces, and every code needs a quiet zone: a blank margin around the outside so the scanner can tell where the code ends.
Error correction: why a scuffed code still scans
QR codes use Reed–Solomon error correction, the same math that let scratched CDs keep playing. Redundant data is woven into the grid so the scanner can reconstruct the original message even when part of the code is dirty, torn, or covered.
There are four levels, chosen when the code is generated: L recovers up to about 7% damage, M about 15%, Q about 25%, and H about 30%. Higher levels aren't free — the redundancy takes up space, so an H-level code is visibly denser than an L-level code holding the same text.
Practically: L is fine for a code shown on a screen, M is a sensible default for print, and Q or H make sense for stickers, packaging, or anything that will live outdoors. Level H is also what makes logo-in-the-middle QR codes possible — the logo simply covers part of the pattern, and error correction fills in the gap. Keep the logo well under that 30% budget, because real-world dirt and glare eat into the same allowance.
Static vs. dynamic: what the code actually stores
A static QR code encodes your content directly in the pattern. If it points to https://example.com/spring-menu, those exact characters are baked into the squares. It needs no service to keep working and will scan forever — but it can never change. If the page moves, every printed copy is dead.
A dynamic QR code encodes a short redirect link instead. The pattern itself never changes, but the short link's destination lives on a server and can be updated anytime. This is how services like ScanTrail work: the printed code points to a permanent short URL, and you can repoint that URL — this month's menu, next month's event page — without reprinting anything. Because every scan passes through the redirect, the server can also count scans and log time of day, country, and device type, which is where scan analytics come from.
Neither is 'better' — they're different tools. Static suits things that will never change (a WiFi password poster, a contact card). Dynamic suits anything printed in quantity or pointing at content that might move.
Why your phone scans QR codes without an app
For years, scanning a QR code meant downloading a separate scanner app, which is a big part of why QR codes flopped in the West the first time around. That changed in 2017, when Apple built QR detection directly into the iOS camera; Android cameras and Google Lens followed. Now the camera app on essentially every phone watches for finder patterns continuously, and when it spots a code it decodes it on-device and shows a tap-to-open prompt.
Detection happens entirely on your phone — no photo is sent anywhere just to read the code. If the payload is a URL, nothing loads until you tap the prompt, which is also your chance to check where the link actually goes before opening it.
What a QR code can carry: URLs, WiFi, contact cards, and more
A QR code just carries text, and phones recognize a handful of standard formats and act on them. A URL opens in the browser. A WiFi payload uses a simple text convention (network name, security type, password) and prompts the phone to join the network — handy for guest WiFi, since nobody has to type a 16-character password. A vCard payload is a plain-text contact record; scanning it offers to save the person straight to your contacts.
Other recognized formats include mailto: links that open a pre-addressed email, tel: links that dial a number, calendar events, and geo coordinates that open in maps. Anything the phone doesn't recognize is just displayed as text.
Because these are open text formats, generating them requires no server at all — ScanTrail's free WiFi and vCard generators, for example, build the code entirely in your browser, so the password or contact details never leave your machine. That's worth looking for in any generator you use for sensitive payloads.
Common questions
Do QR codes expire?
Static QR codes never expire — the data is in the pattern itself, so the code works as long as whatever it points to still exists. Dynamic QR codes depend on the redirect service staying online: the printed code is permanent, but it only resolves while the short link behind it is maintained.
How much data can a QR code hold?
The largest version can hold up to 7,089 digits or about 4,296 alphanumeric characters, but you almost never want to get near that. More data means smaller, denser modules, which scan poorly from a distance or on small prints. For URLs, shorter is better — one reason redirect-based dynamic codes stay sparse and easy to scan.
Will a QR code still scan if it's partially damaged or covered?
Usually, yes. Reed–Solomon error correction can rebuild the message from a damaged pattern — up to roughly 7% damage at level L and up to about 30% at level H. The finder patterns in the corners are the exception: if those are destroyed, the scanner can't locate the code at all.
Are QR codes safe to scan?
Scanning itself is harmless — it just reads text on your own phone. The risk is the same as clicking any unknown link: where it takes you. Modern phones show you the URL before opening it, so check the domain, and be wary of stickers pasted over original codes on parking meters or menus.
What's the difference between a QR code and a barcode?
A traditional barcode is one-dimensional — it encodes a short number in the widths of vertical lines and needs a database to mean anything. A QR code is two-dimensional, holds hundreds of times more data, carries the full content itself (like a complete URL), and includes error correction, so it can be read from any angle even when damaged.
Need a QR code that never goes stale?
ScanTrail codes can be re-pointed after printing — free to start.