How QR codes actually work (and why they're not just for links)

QR stands for "quick response." Toyota's manufacturing division invented it in 1994 to track car parts moving through assembly. The original goal had nothing to do with phones or links. It was a faster barcode.

That history matters because it explains the most common misconception about these things: a QR code does not contain a link. It contains text. Sometimes that text happens to be a URL. But it could be a wifi password, a mailing address, a phone number, or a message written for one specific person. The format is neutral. The code just holds characters.

The three squares in the corners

Those three large squares you see in every QR code's corners are called finder patterns. They exist so a scanner can locate and orient the code regardless of the angle it's held at. Unlike a barcode (which has to be lined up with its stripes running a specific direction), a QR code can be rotated, tilted, or photographed slightly crooked and still scan correctly. A smaller alignment marker in the fourth corner helps the algorithm correct for distortion.

Between the finder patterns sit timing strips: alternating dark and light squares that establish a precise grid. Every module (each individual square in the grid) maps to one bit. Dark is 1, light is 0. The scanner reads the grid, interprets the bits in sequence, and the QR standard tells it how to decode them into characters.

Why a ripped QR code still scans

QR codes use Reed-Solomon error correction. Depending on the error level set when the code was generated, somewhere between 7 and 30 percent of the data is redundant. If part of the code is torn, covered, or printed badly, the scanner can reconstruct the missing bits from that redundancy. This is why QR codes often have logos placed over their centers without breaking the scan: the logo sits in the zone the error correction can afford to lose.

The tradeoff is size. Higher error correction means more redundant modules, which means the code has to be larger to hold the same payload. A code generated at the highest error level looks noticeably denser than one at the lowest.

What a QR code actually holds

At maximum capacity a QR code can hold 7,089 digits, 4,296 alphanumeric characters, or roughly 2,953 bytes of binary data. In practice most codes carry far less. A link to a restaurant menu is maybe 50 characters. A wifi password might be 30 to 60. A short personal message could be a few hundred.

The interesting part is that those characters do not have to form a URL. A scanner app that reads a QR and finds plain text will usually just show you the text. No redirect. No browser opening. Just the characters the code was built from.

The link assumption

The assumption that QR codes are for links is reasonable because most of the codes people encounter in the wild do encode URLs. Menus, payment pages, event registrations: every major QR code generator is built around the URL use case, so that's what people see.

But it's a convention, not a technical requirement. The code has no idea what it's supposed to be. It stores characters. A QR that opens to a poem, an address, or a clue for a scavenger hunt is exactly as valid as one that opens a website. This neutrality is also what makes things like a decoy link possible: one code that shows a public URL to most scanners while carrying something else entirely for the person who opens it in the right app.

Questions people ask

Do I need an app to scan a QR code?

On most recent iPhones and Android phones, the built-in camera handles QR scanning without a separate app. Point it at the code and it reads it. Whether the phone shows plain text clearly or immediately tries to open a browser depends on the OS version and how the code was built. Third-party scanner apps tend to surface raw text more usefully, especially for codes that aren't links.

Can QR codes expire?

The code itself does not expire. The characters encoded in it are fixed the moment the code is generated. What can expire is whatever the code points to: if a URL gets taken down, the code scans fine but goes nowhere. If a code holds a wifi password that gets changed, the scan works but the password is wrong. The code is a container. It has no clock.

Can a QR code carry a private message instead of a link?

It can. GhostCode uses QR codes to carry an encrypted message, one that only opens for the person who has the key you gave them separately. The code looks like any other QR. Someone who scans it without the app sees a standard link to the install page. The actual message is hidden. That works because the QR format never required its contents to be a public address to begin with.

If that idea interests you, the post on how to put a hidden message in a QR code covers it in more depth.