How QR Codes Work: Error Correction and the Three Squares

In everyday life

Paying in a shop with your phone, e-tickets for trains and flights, ordering in a restaurant, setting up Wi-Fi. In each case, you just point your phone's camera, and a long number or a web address is read in.

What a QR code holds is just a string of letters and numbers. If it holds a web address, the phone tries to open that page. If it holds a payment number, the phone moves to a payment screen. What happens next is decided by the app that read the code, not by the QR code.

Where QR codes came from

The QR code was born in 1994 in a development division of DENSO, a car parts maker. In 2001 the division was split off and became today's DENSO WAVE. The project was led by Masahiro Hara, and the team started with just two people.

Factories at the time put barcodes on the tags attached to parts boxes. (In Japanese factories, these tags are called kanban.) But a barcode holds little information, so a single item needed several barcodes, each read in turn. What the factories needed was a code that held more data, read quickly and stood up to dirt.

QR stands for Quick Response, a name chosen because the aim was fast reading. QR Code is a registered trademark of DENSO WAVE INCORPORATED. At the same time, the company has declared that it will not exercise its patent rights for QR codes that follow the standard. So anyone can make and use QR codes without asking permission.

The rules for QR codes became a standard of AIM, an industry group for automatic identification, in 1997. They became Japan's national standard JIS X 0510 in 1999, and the international standard ISO/IEC 18004 in 2000. ISO/IEC 18004 has been revised since then, and as of October 2026 the latest edition is from 2024.

Part 1: black and white squares stand for 1 and 0

Zoom in on a QR code and you see small squares of equal size, lined up like graph paper. Each of these squares is called a module. As a basic rule, a black module means 1 and a white module means 0.

The number of modules across and down sets the size of the code. These size steps are called versions. The smallest, version 1, is 21 modules on each side. Each step up adds 4 modules on each side, so the largest, version 40, is 177×177 modules.

How much fits depends on the kind of characters. Digits come in only 10 kinds, 0 to 9. So three digits (1000 combinations) can be packed together into 10 bits (1024 combinations). Letters and kanji have many more kinds, so each character uses more bits. Here is what fits in the largest code, version 40, at level L, the weakest error correction (levels are explained later).

Japanese text goes in either with the special kanji mode or as a sequence of bytes. Kanji mode uses the numbers of a Japanese character table called Shift JIS. If the reader guesses the wrong character table, the text comes out garbled.

Part 2: the fixed patterns are landmarks for reading

Not everything in a QR code's pattern is data. Landmarks for the reading device sit in fixed places. In the figure below, only ⑤ carries data. Everything else is a landmark.

• ① Finder patterns: the large squares in three corners. They tell the reader where the code is, which way it faces and how big it is.
• ② Timing patterns: rows of alternating black and white modules that join the large squares. They work as a ruler for measuring the spacing of the modules.
• ③ Alignment pattern: a small square found in version 2 and above. It is a clue for correcting distortion when the code is photographed at an angle. Bigger versions have more of them, and version 40 has 46.
• ④ Format information: records the error correction strength and the number of the "mask" (explained later). The code cannot be read without it, so the same content is stored in two places.
• ⑥ Quiet zone: an empty margin 4 modules wide is needed all around. It separates the code from nearby text and pictures.

Version 7 and above also have an area that records the version number. The figure leaves it out.

Why the three big squares are "1:1:3:1:1"

A finder pattern is a black frame, a white frame and a black core, one inside the other. Along a line through the center, the black, white, black, white and black widths are in the ratio 1:1:3:1:1. The ratio stays the same across, down or at a slant, as long as the line goes through the center.

So even if the code is rotated, the reader only has to look for this sequence of widths to find the landmarks. According to DENSO WAVE, the team studied printing on flyers, magazines and cardboard boxes. They chose 1:1:3:1:1 as the ratio least likely to appear in printed matter. That way, photos or text around the code are unlikely to be mistaken for a landmark.

There are three big squares because three are enough to fix the direction. The corner without a square tells the reader where the bottom right of the code is. Even if the code is photographed upside down, it can be turned the right way and read.

Part 3: "error correction" lets dirty codes be read

Besides the data, a QR code holds spare information for repairing damaged parts. Dirt or a scratch may cause some modules to be misread. Even then, the original data can be worked out again from the spare information. This is called error correction.

The CRC described in "How CRC Works" only detects that an error exists. In networking, that is enough: you can ask the sender to send again. But a printed QR code has no one to ask for a resend. So it uses a method that lets the receiver fix errors on its own. This method is called forward error correction (FEC).

A QR code handles its data in chunks of 8 bits. Each chunk is called a codeword. The spare codewords are made from the data codewords by a fixed calculation.

That calculation is the Reed–Solomon code, published by Reed and Solomon in 1960. Besides QR codes, it is used in CDs and DVDs to fix errors caused by scratches. Codes that can fix errors are called error-correcting codes, and the Reed–Solomon code is one of the best-known.

Four strengths (error correction levels)

The person who makes a QR code can choose from four levels of how much spare information to add. DENSO WAVE gives the amount each level can repair as follows.

These shares count codewords, not area on paper. A single spot of dirt can touch two codewords. The company also warns that the data may not be restored, depending on the dirt or damage. And if the landmarks ① to ④ get dirty, the code may not scan even when the data is intact.

The Reed–Solomon code in plain words

The Reed–Solomon code makes spare values from the data that follow a fixed rule. The receiver works backward to find the damaged values, so that the remaining values fit the rule. Let's think it through with an analogy instead of equations.

In the analogy, when you knew which places were lost, one spare value fixed one lost value. When you don't know which value changed, you must also find which one is wrong, so you need two spare values. The QR code level percentages count errors whose positions are unknown. That is why level H, which fixes about 30%, uses more than half the code for spare information.

More spare information means better resistance to dirt, but less data fits in the same size. For example, version 1 holds 41 digits at level L, but only 17 at level H. According to DENSO WAVE, Q or H is sometimes chosen for places that get dirty easily, such as factories.

Part 4: masks even out the pattern

If the data were laid out as is, big blocks of all white or all black could appear. Big blocks make it hard to count where one module ends and the next begins. A pattern that looks like a finder pattern might also appear by chance.

So a fixed pattern is laid over the data area to swap some whites and blacks. This pattern is called a mask. It is applied with a calculation called XOR. If the two values are the same, the result is 0 (white). If they differ, it is 1 (black).

Only where the mask is black does the data flip between black and white. When the reader applies the same mask again, the flips cancel out and the original data comes back. You can try XOR with the bitwise operations calculator.

There are eight mask patterns. The encoder tries all eight and scores each one, picking the one with the fewest blocks and confusing patterns. The mask it used is recorded in the format information ④.

How a phone reads a QR code

Between pointing the camera and seeing the text, a phone does the following steps in order. The details are left out to show just the flow.

1. Take a picture: the camera's sensor chip (the image sensor) turns the brightness of light into a number for each point ("How Do Image Sensors Work?")
2. Split into black and white: it sets a brightness threshold and sorts each point into black or white
3. Find the three squares: it looks for the 1:1:3:1:1 sequence to learn the code's position, direction and size
4. Correct the distortion: a square photographed at an angle looks like a trapezoid. Using the positions of the squares and the alignment pattern, it calculates how the code would look from the front
5. Read the modules: it measures the module spacing with the timing patterns and reads each module as 0 or 1
6. Read the format information: it learns the error correction level and the mask number
7. Remove the mask: it applies the same mask again to get back the original data
8. Fix errors: it uses the Reed–Solomon code to fix codewords that dirt has changed
9. Turn it back into text: it reads the marker for the encoding type (digits, alphanumeric, bytes or kanji) and the character count, then turns the data into text

On a phone, all of this happens in an instant. The iPhone camera and others first show the link they read on the screen, and open it only when you tap. This moment before opening is the key moment for stopping the scams described next.

Watch out for QR code scams

People cannot read what a QR code says just by looking at it. Some scams abuse this to lure people to fake websites. A trick that poses as a real company to steal passwords and other details is called phishing. When it uses a QR code, it is also called "quishing."

In Japan, for example, the Council of Anti-Phishing Japan issued a warning in August 2024. It was about emails posing as a card company that lead people to fake sites through a QR code. IPA (Information-technology Promotion Agency, Japan) also reports harmful QR codes found on signs, flyers and mailed items. In the US, the FBI warned in January 2022 that real QR codes were being swapped for fake ones.

Putting the advice from these agencies together, it comes to this:

• Before opening a link, check the URL (web address) shown on the screen. Watch for fake names that differ by just one letter
• Don't log in from a QR code sent by email or text message. Open the site from the official app or from a bookmark you saved yourself
• For QR codes posted in public places, check that no other sticker has been put on top
• If the page you reach asks for a password or card number, stop for a moment

Still, looking at a URL is not always enough to be sure a site is real. The Council of Anti-Phishing Japan also says that relying only on checking URLs cannot fully prevent harm. The safest approach combines the habit of opening sites from official apps with multi-factor authentication (a second check besides your password). "What Does HTTPS Mean?" explains how fake sites relate to the padlock icon.

Relatives of the QR code

The Micro QR Code is a small version with only one finder pattern. Its margin needs only 2 modules, so it can be printed in tight spots such as on small parts. Even the largest size, M4, is only 17×17 modules and holds up to 35 digits.

The rMQR Code is a rectangular QR code. DENSO WAVE developed it, and in May 2022 it became the international standard ISO/IEC 23941. It can be printed in long, narrow spaces, and its largest size (17×139 modules) holds up to 361 digits.

Common myths

By the numbers

Learn more

• Glossary entries: Forward error correction (FEC) / ECC (error-correcting code) / Hamming code / CRC (cyclic redundancy check)
• Try it with numbers: Hamming code calculator (the simplest code that fixes errors) / CRC calculator (a code that detects errors)
• Related explainers: "How CRC Works" / "How Do Image Sensors Work?" / "How Are Passwords Cracked?"