The QR code was invented in 1994 by Denso, a Toyota parts supplier with a simple goal: make its vehicle production lines more efficient. The idea was to replace traditional barcodes with something that could hold far more information and be scanned faster.
It took nearly a decade for QR codes to escape the factory floor, first in Japan through camera phones, and more than 20 years to really catch on elsewhere.
These days QR codes are everywhere. We use them to join Wi-Fi networks, log into websites and messaging apps, share contact information, make mobile payments, activate eSIMs, and carry plane and train tickets on our phones.
They've also had one of the stranger arcs in consumer tech. Written off as a marketing gimmick in the early 2010s, QR codes were rescued by phone cameras. Now they're gunning for the checkout counter, lining up to succeed the UPC barcode, while also becoming one of the fastest-growing tools in the phishing playbook.
Here's how they work, and what's changed over the years.
How a Board Game Gave Us the QR Code
QR codes (short for Quick Response codes) were the work of a small team led by Denso engineer Masahiro Hara, who started on the project in 1992. Factory workers were scanning several barcodes per box of parts, because each one held only about 20 characters, and it was slowing production down. Hara, a keen player of the board game Go, took inspiration from the grid of black and white stones: a two-dimensional pattern could hold vastly more data than a single row of bars.
The hard part was getting a scanner to find the code amid the clutter of a factory, at any angle. Hara's team scanned newspapers, magazines and other printed material looking for a black-to-white ratio that almost never occurs by accident, and settled on 1:1:3:1:1. That ratio became the basis for the three square targets in the corners of every QR code, and it's the reason your phone can lock onto one almost instantly. The invention has since been recognized as an IEEE Milestone.
QR codes were internationally standardized in 2000 as ISO/IEC 18004, and by 2002 mobile phone users in Japan had widely adopted the technology. Denso Wave still holds patents over the technology and "QR Code" remains its registered trademark. But anyone can use QR codes without paying a license fee, as long as they stick to the defined ISO/JIS standards. That decision goes a long way toward explaining how they ended up everywhere.
As with any other barcode, using a QR code is simple enough. You scan it with a camera, like the one in your smartphone, and the software converts the pattern into binary. It then displays the information or performs a programmed action, such as opening a website. In effect, QR codes let you hyperlink real-world objects to digital places.
Outside of Asia, adoption was slower. For years, scanning a QR code meant installing a dedicated app for it, and most people didn't bother. Microsoft even pushed its own proprietary alternative before giving up on it in 2013. Instead, popular apps began integrating scanners for specific features. Around 2016, Snapchat, FB Messenger and Twitter adopted scannable codes as a way of adding new friends, WhatsApp used QR codes as a quick way to access the desktop version of its chat application, and Android introduced similar functionality for sending SMS and MMS messages from a PC.
A big turning point came in 2017, when Apple built QR scanning directly into the iPhone's camera app with iOS 11. Android phones followed through Google Lens and their own camera apps, and suddenly nobody needed a separate reader.
Then the pandemic did the rest. Restaurants swapped printed menus for codes on the table, governments rolled out QR check-in systems, and vaccination certificates were issued as QR codes. In 2022, Coinbase ran a Super Bowl ad that was little more than a QR code bouncing around the screen, and it drew so much traffic that the company's site briefly buckled. By then, the format had gone fully mainstream.
What's With All the Squares?
A QR code is made up of black and white squares called modules, and each one is a single bit: dark for 1, light for 0. Not all of them carry your data, though. A good chunk of every QR is there purely to help the scanner find it, line it up and figure out how to read it:
- Finder / position patterns: The three big squares in the corners, built around that 1:1:3:1:1 ratio. Because there are only three of them, the scanner can tell which way up the code is, allowing it to be read from any direction.
- Timing patterns: Two dotted lines of alternating modules connecting the finder patterns, which tell the scanner how big each module is.
- Alignment patterns: Smaller squares that help correct for distortion when a code is curved or photographed at an angle. The smallest codes don't need one.
- Format and version info: A few reserved strips that record how the code was built, including its error correction level. This info is stored twice, just in case.
- Quiet zone: The blank border around the code. It needs to be at least four modules wide, which is why codes crammed against other graphics often won't scan.
Everything else is your data plus error correction, packed in a zigzag that snakes up and down the code starting from the bottom-right corner. Before the code is finalized, the encoder also applies one of eight "masks." These flip certain modules to break up large solid blocks and any shapes that could be mistaken for a finder pattern. The encoder tries all eight and keeps whichever produces the cleanest result.
Whereas most of the barcodes you come across are one-dimensional, such as UPC labels on items at the store, QR codes are two-dimensional and offer many advantages. For instance, QR codes can be scanned in any direction instead of only one, they can contain thousands of alphanumeric characters versus only a dozen or so, and when configured with a high level of error correction they are particularly capable at continuing to function after sustaining damage.
Anatomy of the QR Code
That resilience comes from Reed-Solomon error correction, the same math that lets scratched CDs keep playing and deep-space probes phone home. QR codes offer four levels: L can recover about 7% of the data, M about 15%, Q about 25% and H about 30%.
The trade-off is that more error correction leaves less room for data, so the code needs more squares to hold the same content. It's also why you can slap a logo in the middle of a QR code and it still works. The scanner treats the logo as damage, and error correction fills in the gaps.
How Much Can a QR Code Hold?
QR codes come in 40 sizes, called versions. The smallest, version 1, is a 21 x 21 grid, and each version adds four modules per side, up to version 40 at 177 x 177. At the lowest error correction level, a version 1 code holds just 41 digits or 17 bytes. A version 40 code can store up to 7,089 digits, 4,296 alphanumeric characters or 2,953 bytes of data. At the highest error correction level, that drops to 1,273 bytes.
To squeeze in as much as possible, QR codes can switch between encoding modes, even within the same code:
- Numeric: 10 bits for every three digits
- Alphanumeric: 11 bits for every two characters, but can't store lowercase letters
- Byte: 8 bits per character, used for most URLs and UTF-8 text
- Kanji: 13 bits per character
- A few more specialized modes, such as ECI for declaring a character set, FNC1 for GS1 supply chain data, and Structured Append, which spreads one message across up to 16 codes
A neat trick for the technically inclined: because domain names aren't case-sensitive, a URL written in all caps can often be squeezed into the more compact alphanumeric mode, producing a smaller code that's easier to scan. Just be careful with paths and query strings, which frequently are case-sensitive.
The Extended QR Family
Along with different standards for conventional QR codes, specifications for new iterations have been approved over the years, including Micro QR, iQR Code, and a few others:
- Micro QR uses a single finder pattern, holding up to 35 digits
- iQR Code holds 80% more data in the same space as a regular QR code
- Frame QR leaves a blank canvas inside the code for an image
- SQRC stores both public and private data, with the private part readable only by authorized scanners
The newest addition is the Rectangular Micro QR Code, or rMQR. Denso Wave designed it for long, narrow spaces like box edges, cable wraps and test tubes, where a square code won't fit and a regular barcode can't hold enough. Industrial scanners support it, but don't expect your phone's camera to read one just yet.
Everything a QR Code Can Do
Under the hood, a QR code is simply a container for a string of text. What makes it useful is what your phone decides to do with that string, and over the years a set of conventions has grown up around it.
A code containing a URL opens the browser. One formatted as WIFI:T:WPA;S:network;P:password;; prompts your phone to join a network. Others hold vCard contact details, pre-addressed emails and text messages, phone numbers or map coordinates.
Increasingly, QR codes are also the bridge between devices. Setting up two-factor authentication usually involves scanning a code containing an otpauth:// URI with a shared secret for an authenticator app like Proton Authenticator. Carriers often deliver eSIM profiles as QR codes carrying an activation string, and smart home gear built on the Matter standard ships with a QR code on the device or packaging for pairing.
Messaging apps such as WhatsApp, Signal and Google Messages use them to link desktop and tablet clients to your phone.
Passkeys lean on them, too. When you sign in on a laptop using a passkey stored on your phone, the browser displays a QR code. Scanning it sets up an encrypted link between the two devices, while a Bluetooth proximity check confirms the phone is physically nearby, which stops a remote attacker from relaying the code from somewhere else. The private key itself never leaves your phone.
QR Codes Are Coming for the Checkout Counter
In much of the world, QR codes are now the default way to pay. China's Alipay and WeChat Pay made scanning a merchant's code the norm for everything from restaurant bills to street food. In India, where you'll find a QR sticker at almost every shop, the UPI network processed a record 24.5 billion transactions in August 2026 alone, that's an average of 791 million transaction scans per day.
Brazil's Pix and a growing list of national instant payment systems follow the same model. For merchants, the appeal is obvious: a printed sticker costs next to nothing compared to a card terminal.
The next big shift is happening at the checkout counter. Under an industry initiative called Sunrise 2027, standards body GS1 and retailers are working toward point-of-sale systems that can read 2D barcodes by the end of 2027. Specifically, that means QR codes carrying a GS1 Digital Link URI, as well as GS1 DataMatrix codes.
Here's how it works. A Digital Link QR code encodes a web address with the product's GTIN (the same number behind the UPC) built into it. The register pulls out the product number and rings it up, while a shopper's phone just sees a regular link. That link can lead to product details, ingredients, recall notices or recycling instructions. One code, two audiences.
The classic UPC isn't going away overnight. Sunrise 2027 is about teaching registers to read 2D codes, not retiring 1D barcodes, and most retailers are expected to accept both for years. Still, it's the biggest change to retail product labeling in half a century.
Regulators are pushing, too. Under the EU's Batteries Regulation, every battery sold in the bloc must carry a QR code starting February 2027. For EV batteries, light vehicle batteries, and industrial batteries above 2 kWh, that code must lead to a digital battery "passport" that covers details like materials, carbon footprint, and end-of-life handling.
When QR Codes Go Bad
Generally speaking, QR codes are safe to use. A code is just data and can't infect your phone on its own. The danger lies in where it sends you, usually a phishing page built to steal your credentials or a site that tries to exploit a vulnerability in your browser or other apps.
In the early days, malicious codes were also used to push malware onto Android phones that quietly racked up premium SMS charges or stole banking details.
The problem has only grown since, enough to earn its own name: quishing. Microsoft reported that QR code phishing attacks in email jumped from 7 million in January 2026 to over 18 million in March, a dramatic increase in a very short time earlier this year. Codes embedded directly in the body of emails surged 336% in March alone, though PDF attachments remain the favored delivery method.
Why QR codes? The appeal for attackers is simple.
A QR code is an image rather than a clickable link, so it slips past many email filters that scan for malicious URLs. Scanning it also moves the victim from a managed work computer to a personal phone, often outside the reach of corporate security tools. And unlike a regular link, you can't hover over a QR code to see where it leads before you commit.
Out in the real world, scammers have been placing stickers over the codes on parking meters to harvest payment details. The same scheme has turned up at train stations and on restaurant tables.
In the US, the FTC has warned about unsolicited packages with QR codes that promise to reveal who sent the item or how to return it. Instead, they lead to sites built to steal credit card numbers and login credentials.
The sneakiest attacks abuse legitimate features. In early 2025, Google's Threat Intelligence Group detailed how hackers targeted Signal users with malicious QR codes disguised as group invites, security alerts or device pairing instructions.
Scanning one quietly linked the victim's account to a device controlled by the attackers, who then received a copy of every new message in real time, without having to break Signal's encryption or hack the phone itself. Any app that uses QR codes to log in or pair devices carries the same risk.
A few habits go a long way:
- Check the URL preview your camera app shows before tapping it. Be wary of shortened links, or domains that look close to, but not quite like, the real thing.
- Treat QR codes in emails and text messages with extra suspicion, especially if they ask you to sign in, reset a password or pay a fee.
- On parking meters, EV chargers and other public kiosks, look for stickers placed over the original code, and use the operator's official app when you can.
- Only scan device-linking codes that you generated yourself on your own screen.
How to Make a QR Code
Depending on what you're trying to accomplish, you probably don't need a website for this anymore.
In Chrome, you can generate a code for any page from the three-dot menu under "Cast, save, and share," or by right-clicking the page. Microsoft Edge has the same option in its right-click menu. Firefox needs an add-on, and Mac users on Safari can turn to the Shortcuts app. On an iPhone, the Passwords app can show a QR code for any saved Wi-Fi network. Android has offered the same in its Wi-Fi settings since Android 10.
Now, before reaching for one of the many QR generator websites, it's worth knowing the difference between static and dynamic codes. A static QR code stores its destination directly in the pattern, and it will keep working for as long as that destination exists. A dynamic QR code stores a short redirect link hosted by the generator company. That lets you change where the code points after it's been printed, and track how many people scan it.
The catch is that dynamic codes only work as long as the vendor keeps forwarding them. Many "free" generators quietly create dynamic codes, then deactivate them when a trial ends or a subscription lapses.
Static codes can go stale, too. If the domain they point to expires, someone else can buy it. That's how a QR code on a Heinz ketchup bottle ended up sending a customer to an adult website. For anything you plan to print, your safest bet is a static code pointing to a domain you control, with any redirects handled on your own server.
If you'd rather use a website, there are a few long-running generators we've used over the years. QRCode Monkey is our pick for quick static codes: it's free, doesn't require an account, lets you add your own logo and exports vector files for print. The QR Code Generator, QR Creator, and QRStuff offer more content types and dynamic codes, but read the fine print, as free dynamic codes on some services stop working after a trial period.
Generative AI has taken artistic QR codes much further. In 2023, artists began using Stable Diffusion with ControlNet models trained on QR codes to create images, from anime scenes to landscapes. The code is woven right into the artwork, and it still scans.
These work best with the highest (H) error correction level and can be finicky, so make sure you test them on several phones, at the final print size, before committing to a print run.
Small Squares, Big Future
QR codes are more capable, and more contested, than ever. Enthusiasts have crammed Snake into a single code (the 2020 experiment used the full 2,953-byte capacity of a version 40 symbol). Someone even built a Doom-inspired game that fits inside one.
Researchers at TU Wien etched the world's smallest QR code into a ceramic film, covering just 1.98 square micrometers with pixels 49 nanometers across. It's so small that it can only be read with an electron microscope. At the other extreme, one corn maze turned seven acres of crops into a working code.
The more serious story is what comes next. Between the Sunrise initiative at the checkout, battery passports in Europe, and payment networks handling billions of transactions a month, QR codes are turning into actual infrastructure. That makes the old advice more relevant than ever. QR codes remain a remarkably clever way to link the physical and digital worlds. Just make sure you know where the link leads before you follow it.