A QR code is not a picture of anything. It is a short piece of text — usually well under 100 characters — written in a two-dimensional grid instead of a line, with a large amount of redundancy mixed in so it still reads when part of it is damaged.

Three components do essentially all the work, and each one explains a practical rule people otherwise have to take on faith.

1. The finding pattern: the three big squares

The concentric squares in three corners are position markers. They exist so a reader can answer two questions instantly: is there a QR code in this image, and which way up is it.

Their ratio of dark to light runs 1:1:3:1:1 along any line crossing them, which is a proportion that essentially never occurs by accident in a photograph. A reader scans lines across the image looking for it, and three hits give it the corners of the grid. Three rather than four is what lets it work out the rotation — the missing corner tells it the orientation, which is why a QR code scans upside down and at an angle without any effort from you.

Practical consequence: obscure one of those three squares and the code stops being findable. Not degraded — invisible. This is why a logo goes in the middle and never over a corner.

2. The data area: the rest of the squares

Each small square, called a module, is one bit — dark or light. They are read in a zig-zag pattern from the bottom right, in interleaved blocks, and decoded according to a mode indicator at the start that says what kind of content follows: digits only, alphanumeric, raw bytes, or Kanji.

Those modes matter more than they sound. Numeric mode packs three digits into ten bits; byte mode spends eight bits per character. A code holding only numbers therefore stores far more in the same space than one holding a mixed-case URL — which is part of why URLs, with their slashes and mixed case, produce denser codes than you might expect.

Practical consequence: more text means more modules, and more modules in the same physical size means each one is smaller. That is the mechanism behind the advice to keep encoded URLs short, and the reason a dynamic QR code — which encodes a short redirect rather than a long campaign URL — usually produces a visibly chunkier, more forgiving pattern.

3. Error correction: why a scuffed code still works

This is the part that makes QR codes practical rather than merely clever. The encoded data is expanded with Reed–Solomon error correction, the same family of mathematics used on CDs and in deep-space transmission. It adds redundant symbols such that the original message can be reconstructed even when a proportion of the code is unreadable.

There are four levels, and they are a straight trade against capacity:

Higher correction means more redundant modules, so either a denser code or a larger one for the same content.

Practical consequence: this is the budget a centred logo spends. Putting a logo on a code does not work because generators are clever about placing it; it works because you are destroying modules the error correction can afford to lose. Spend it twice — a big logo and a scratched print — and the code fails. This is also why codes destined for rough environments are generated at H.

What actually happens when you scan

  1. The camera finds the 1:1:3:1:1 pattern and locates three corners.
  2. It corrects for rotation and perspective, mapping the grid to a square.
  3. It reads format information beside the corner markers: error correction level, and which mask was applied.
  4. It removes the mask — a pattern XORed over the data to avoid large blank areas that would confuse the reader.
  5. It reads the modules, applies error correction, and reconstructs the text.
  6. It hands the text to the operating system, which decides what to offer: open a link, join a network, save a contact.

All of that happens continuously, several times a second, which is why a code appears to be recognised the instant you point at it.

The quiet zone

The blank margin around a code is part of the specification, not whitespace a designer added. The reader needs somewhere to establish that the pattern has ended. Four modules wide is the standard, and crowding it is one of the most common causes of a technically perfect code that will not scan — the code is fine, but the reader cannot find its edges against surrounding artwork.

What a QR code is not

It contains no tracking of its own, and no logic. It is inert text. When a code “tracks scans”, what is really happening is that the text is a link to a redirect service, and the service counts the request as it passes through. A static code pointing straight at your website is genuinely untrackable at the code level — anything you learn comes from your own analytics after the visitor arrives.

It also cannot be changed. The squares are the message. Editing a printed code’s destination is only possible when the message was a redirect all along, which is the whole of the static versus dynamic distinction.