Three corners, eight masks, and enough redundancy to lose a third of the symbol.
A QR code is a far more ambitious object than a retail barcode. A barcode stores thirteen digits in a single line and needs a reasonably clean read. A QR code stores up to several thousand characters in two dimensions, can be read at any rotation, and will still decode with a chunk of it missing, a logo pasted over the middle, or a coffee ring across one corner. All of that is designed in, and the design is worth understanding.
If you have read the guide on how a barcode encodes a number, the underlying philosophy will look familiar: fixed structural landmarks, a strict module grid, and heavy redundancy. QR simply takes each idea considerably further.
As with a linear barcode, the unit is the module — here a single square, black or white, in a square grid. The grid size is set by the symbol's version, of which there are forty.
Version 1 is 21×21 modules. Each subsequent version adds four modules to each side, so version 2 is 25×25, version 3 is 29×29, and version 40 is 177×177. The version is chosen by the encoder to fit the data at the requested error-correction level, which is why a QR code holding a long URL looks visibly denser than one holding a short one.
Around the whole symbol there must be a quiet zone of four modules of blank space. This is not decoration and it is the single most common cause of a code that will not scan: crop a QR code tight to its edges, or print it flush against a coloured background, and decoders lose the boundary they need to find the symbol at all.
A meaningful fraction of a QR symbol is not data. It is scaffolding that lets a decoder locate, orient and calibrate the grid from a photograph taken at an arbitrary angle.
The three large concentric squares in the corners are the finder patterns. Each is 7×7 modules: a dark 7×7 square containing a light 5×5 square containing a dark 3×3 square.
The proportions are the point. Scan a straight line through the centre of one in any direction — horizontally, vertically, diagonally — and you cross dark, light, dark, light, dark in the ratio 1:1:3:1:1. That ratio is rare in ordinary imagery and is preserved under rotation and perspective, so a decoder can sweep an image for it cheaply and reliably.
There are three rather than four for a reason that is easy to miss: the missing corner is what establishes orientation. Three corners marked and one bare tells the decoder unambiguously which way up the symbol is, which is why a QR code reads upside down, sideways, or mirrored in a shop window.
Each finder is wrapped in a one-module light separator so it cannot merge visually with adjacent data.
Running between the finders, along row 6 and column 6, are the timing patterns: strict alternating dark-light-dark-light lines. These let a decoder work out exactly where each module boundary falls, which matters because a photograph of a curved or tilted surface does not have evenly spaced modules. The timing pattern is the ruler.
From version 2 upward, smaller 5×5 concentric squares appear at defined positions across the symbol. These are alignment patterns, and their job is to correct for perspective distortion in the interior. On a large symbol photographed at an angle, knowing the corners is not enough — the middle bows. The alignment patterns give the decoder known reference points inside the grid so it can un-warp it. Larger versions carry more of them.
Beside the finder patterns sits the format information: fifteen bits recording the error-correction level and which mask pattern was applied. This is critical — without it nothing else can be decoded — so it is protected by its own BCH error-correcting code and written twice, in two different places. Symbols of version 7 and above similarly carry version information twice.
The theme is consistent: anything the decoder needs before it can start is duplicated and independently protected.
This is what makes QR codes remarkable. The data is encoded with Reed-Solomon error correction, the same family of codes used on compact discs and in deep-space communication.
Reed-Solomon works over blocks of symbols and can do two different things: correct errors at unknown positions, and fill in erasures at known positions. Because it is defined algebraically rather than by a lookup table, it can reconstruct missing data outright rather than merely detecting that something is wrong.
QR offers four levels, chosen when the code is generated:
| Level | Approximate recovery | Typical use |
|---|---|---|
| L (Low) | ~7% | Clean digital display, maximum data in minimum size |
| M (Medium) | ~15% | General printing — the usual default |
| Q (Quartile) | ~25% | Industrial labels, or a logo overlay |
| H (High) | ~30% | Harsh environments, or a large logo overlay |
The trade is straightforward: correction data occupies space that could hold payload, so at a fixed symbol size, higher correction means less capacity. Push the level up without shortening the data and the encoder simply picks a larger version, producing a denser code.
The popular trick of covering the centre of a QR code with a brand logo is not a clever hack that happens to work — it is error correction being used exactly as designed. The covered modules become erasures, and provided they stay within the correction budget, Reed-Solomon reconstructs them.
The practical rules follow directly. Use level Q or H if you intend to cover anything. Keep the logo genuinely central, because the centre is the region least likely to hold structural patterns. Never cover a finder pattern, a timing pattern or the format information — those are not protected by the data error correction, and losing them means the symbol cannot be located or interpreted at all. And test the finished code with more than one phone, because decoders vary in how aggressively they attempt recovery.
The budget is also shared. Error correction spent on the logo is not available for the scuffing, glare and poor focus that a real-world scan will add on top.
Here is a subtlety that surprises people: encode the same URL twice and you may get two visually different symbols.
Raw encoded data frequently produces awkward patterns — large blank areas, long runs of identical modules, or accidental shapes that resemble a finder pattern. Any of these makes a decoder's job harder, and a false finder pattern in the data can defeat it entirely.
QR solves this with masking. Eight predefined mask patterns are available, each a simple formula over module coordinates. The encoder applies every one of the eight, scores each result with a penalty function — punishing long same-colour runs, large solid blocks, finder-like sequences, and a badly skewed overall dark-to-light ratio — and keeps whichever scores best. Which mask was used is then recorded in the format information so the decoder can reverse it.
So the appearance of a QR code is the product of an optimisation, and different encoders may legitimately choose differently for identical input.
QR does not store everything as bytes. It picks the cheapest mode for the content:
| Mode | Character set | Cost per character |
|---|---|---|
| Numeric | 0–9 | ~3.33 bits |
| Alphanumeric | 45 characters: digits, A–Z uppercase, space, $ % * + - . / : | ~5.5 bits |
| Byte | Any byte, typically UTF-8 | 8 bits |
| Kanji | Shift-JIS double-byte | 13 bits |
Numeric mode packs three digits into ten bits and alphanumeric packs two characters into eleven, which is why a numeric payload fits far more data than the same length of mixed text.
This has a genuinely useful practical consequence for URLs. The alphanumeric set contains uppercase letters only. A URL written HTTPS://EXAMPLE.COM/PAGE can use alphanumeric mode; the same URL in lowercase forces byte mode and costs noticeably more space. Since the scheme and host are case-insensitive, writing them in uppercase produces a smaller, less dense, easier-to-scan code. The path is case-sensitive, so that part cannot be changed — but shortening a URL, or using a redirect, reduces symbol density more than any other single adjustment.
In rough order of how often each is the actual culprit:
One security note worth stating plainly, because it has nothing to do with the format's cleverness: a QR code is opaque to humans. You cannot look at one and know where it leads, which makes stickers placed over legitimate codes — on parking meters, restaurant tables, posters — an effective and increasingly common tactic. Check the URL your phone previews before opening it, and be suspicious of any code that leads straight to a payment or login page.