QR Code Generator

QR Code Structure and Components

QR (Quick Response) codes are two-dimensional barcodes that encode data in a grid of black and white squares. The code consists of several components: position markers (large squares in three corners), alignment patterns (smaller squares for larger codes), timing patterns (alternating modules between position markers), format information (error correction level and mask pattern), and the data area. This structured layout allows scanners to quickly locate and decode the code from any angle.

The position markers (finder patterns) are the most recognizable feature—three concentric squares in the top-left, top-right, and bottom-left corners. These patterns are unique and don't appear in the data area, allowing scanners to determine orientation, position, and size. The white border (quiet zone) around the code provides visual separation from surrounding content, essential for reliable scanning.

QR codes come in 40 versions (sizes), from Version 1 (21×21 modules) to Version 40 (177×177 modules). Each version adds 4 modules per side. Higher versions hold more data but require larger physical size for reliable scanning. The version is automatically selected based on data length and error correction level—short URLs need Version 1-3, while long text or binary data requires higher versions.

Data capacity varies by content type: numeric data (up to 7,089 digits), alphanumeric (4,296 characters using 0-9, A-Z, space, and symbols), binary/byte (2,953 bytes), or Kanji (1,817 characters). Numeric mode is most efficient (3.33 bits per digit), alphanumeric uses 5.5 bits per character, and byte mode uses 8 bits per byte. The encoding mode is automatically selected to minimize code size.

Error correction uses Reed-Solomon codes to allow partial code damage without losing data. Four levels exist: L (Low, 7% recovery), M (Medium, 15%), Q (Quartile, 25%), and H (High, 30%). Higher correction means larger codes but more resilience to damage, dirt, or poor printing. Level H allows logos or images to cover part of the code. For pristine environments, Level L suffices; for harsh conditions or branding, use Level Q or H.

Encoding Process and Data Representation

Encoding starts by analyzing the input data to determine the optimal mode (numeric, alphanumeric, or byte). The mode indicator (4 bits) and character count indicator (varying bits based on version) are added to the beginning. Data is then encoded according to the mode—numeric data is grouped into 3-digit chunks encoded as 10 bits, alphanumeric pairs are encoded as 11 bits, byte data is raw 8-bit values.

Terminator and padding are added after data encoding. A terminator (0000) signals the end of data. If the bit stream doesn't fill the capacity, pad bits (0s) are added to reach a byte boundary, then alternating pad bytes (11101100 and 00010001) fill remaining capacity. This ensures the data region is completely filled, maximizing use of available space and error correction capacity.

Error correction codewords are generated using Reed-Solomon algorithm. The data is divided into blocks (number varies by version and error level), and error correction codewords are calculated for each block. These codewords allow reconstruction of lost data—even if parts of the QR code are damaged or obscured, the original data can be recovered. The error correction bytes are interleaved with data for even distribution across the code.

Module placement follows a specific pattern to distribute data evenly. Bits are placed starting from the bottom-right corner, moving upward in two-column strips, zigzagging to the top, then shifting left and moving downward. Function patterns (position markers, timing, alignment) are avoided. This zigzag pattern distributes data across the entire code, so localized damage doesn't destroy consecutive data bits.

Masking is applied to avoid problematic patterns that confuse scanners. Eight mask patterns are tried, each XORing the data area with a specific pattern. The mask producing the best score (fewest adjacent same-color modules, balanced light/dark ratio, minimal position marker-like patterns) is selected. The chosen mask pattern is encoded in format information so scanners can reverse it during decoding.

Special Data Types and Formats

URLs are the most common QR code content. Standard URL format (https://example.com/path) works universally. URL shorteners reduce QR code complexity—a short URL needs fewer modules than a long one. Deep links (app-specific URLs like myapp://action) can open mobile apps directly. For website URLs, include https:// explicitly; some scanners don't assume it, treating the content as plain text instead.

WiFi credentials use a special format: WIFI:T:WPA;S:NetworkName;P:Password;; The T field specifies security type (WPA, WEP, or blank for no password), S is SSID (network name), P is password. Scanning this QR code allows instant WiFi connection without manually typing credentials. This is popular for guest networks in cafes, offices, and homes. Characters like semicolons and backslashes must be escaped with backslash.

vCard contact information uses the vCard format (BEGIN:VCARD version 3.0, with fields like FN for full name, TEL for phone, EMAIL, ORG for organization, and END:VCARD). Scanning adds the contact directly to the phone's address book. This is common on business cards, conference badges, and email signatures. The format supports multiple fields but larger vCards create larger QR codes.

Email and SMS formats enable one-tap communication. Email format: mailto:address@example.com?subject=Subject&body=Message. SMS format: smsto:+1234567890:Message text. The SMSTO (or SMS) scheme pre-fills recipient and message in the messaging app. MATMSG format is an alternative for email: MATMSG:TO:address@example.com;SUB:Subject;BODY:Message;; Both open the appropriate app with fields pre-filled.

Calendar events use vEvent format: BEGIN:VEVENT SUMMARY:Meeting DTSTART:20240115T140000 DTEND:20240115T150000 LOCATION:Office END:VEVENT. This adds events directly to calendar apps. Geographic coordinates use geo:latitude,longitude format (geo:37.7749,-122.4194) to open maps apps at the specified location. Payment QR codes use various schemes—bitcoin:address?amount=0.01, or proprietary formats for payment processors like PayPal or Venmo.

Design Considerations and Customization

Color choice affects scannability significantly. High contrast is essential—black modules on white background is ideal. Light modules on dark background (inverted) works but with reduced reliability. Colored QR codes work if contrast is sufficient (dark blue on light yellow is fine, light pink on light blue fails). Gradients and patterns degrade reliability. Test extensively if using non-standard colors.

Logo embedding leverages error correction to replace center modules with branding. With Level H correction (30% recovery), you can cover roughly 20-25% of the code with a logo without affecting scannability. Center the logo where position markers aren't located. Ensure the logo has a white or solid border so it doesn't blend with surrounding modules. Test thoroughly—complex logos or excessive coverage causes scan failures.

Module shape can be customized for aesthetic appeal. Round dots instead of squares, rounded corners, or even images as modules create unique designs. However, unusual shapes reduce reliability—scanners expect standard square modules with sharp edges. If customizing, maintain clear spacing between modules, high contrast, and preserve position markers in standard form. Test with multiple scanner apps to ensure compatibility.

Size requirements depend on scanning distance and printing quality. For smartphone scanning at arm's length (~30cm), minimum 2×2cm (0.8×0.8 inches) works. For business cards, 2.5×2.5cm provides margin for printing variations. For posters scanned from 2-3 meters, use 10×10cm or larger. Calculate size based on: QR size = scanning distance / 10. High-resolution printing (300+ DPI) allows smaller codes than low-quality printing.

Quiet zone (white border) is mandatory for reliable scanning. The specification requires 4 modules of white space around all sides. This separates the code from surrounding text or images, preventing scanners from confusing external elements with code data. Many scan failures result from insufficient quiet zone—text printed too close to the code or colored backgrounds extending to the edge. Always preserve the quiet zone.

Scanning and Decoding Process

Detection begins with image capture by the camera. The scanning app processes the image to find position markers—the three concentric squares in corners. These markers determine code position, size, and rotation. The camera doesn't need perfect alignment; markers allow detection and perspective correction from any angle (within limits). Poor lighting, blur, or extreme angles prevent detection.

Perspective correction transforms the detected code to a square grid for accurate reading. If the code is photographed at an angle, the image is warped (perspective transformation) to make it rectangular. Alignment patterns (present in Version 2+) help correct distortion in larger codes. Timing patterns verify grid spacing. This correction allows scanning from various angles and distances without perfect positioning.

Sampling reads each module as black or white. The corrected image is divided into a grid based on detected size (21×21 for Version 1, etc.). Each cell is sampled to determine if it's a dark or light module. Threshold algorithms handle varying lighting—in bright light, gray pixels might be considered white; in dim light, they might be black. Adaptive thresholding improves reliability under challenging conditions.

Decoding reverses the encoding process. Format information identifies error correction level and mask pattern. The mask is removed by XORing with the detected pattern. Data bits are read in the correct order (zigzag from bottom-right), extracting mode, character count, and payload. Reed-Solomon error correction verifies data integrity and corrects errors if possible. Finally, the payload is decoded according to the mode (numeric, alphanumeric, or byte).

Error handling determines success or failure. If error correction can't fix all errors (damage exceeds error correction capacity), decoding fails. Multiple scans might succeed where one fails—different lighting, angles, or camera positions can capture different errors. Good QR code apps try multiple detection strategies, apply image enhancements (contrast adjustment, sharpening), and attempt decoding even with partial data.

Security and Privacy Considerations

QR code phishing is a significant threat. Malicious QR codes can link to phishing sites, malware downloads, or premium SMS numbers. Users trust QR codes without inspecting URLs, unlike typed links. Always preview URLs before visiting—most scanner apps show the URL before opening. Educate users to verify destinations match expectations. Attackers place malicious codes over legitimate ones (stickers on payment terminals, posters).

Privacy risks arise from QR code tracking. URLs can include unique identifiers tracking who scanned the code, when, and where. Marketing QR codes often include campaign parameters (utm_source, etc.) for analytics. While legitimate for marketing, it reveals user behavior. For sensitive contexts (medical info, legal documents), use codes without tracking or host content on privacy-respecting servers.

Data persistence means QR codes are hard to revoke. Once printed and distributed, a QR code's destination can't be changed. If the linked content becomes malicious or inappropriate, you can only remove it from the website—already-printed codes still point there. Use URL shorteners or redirects for important codes, allowing destination changes without reprinting. Consider expiration dates for time-sensitive content.

Best practices for secure QR usage include: use HTTPS URLs to prevent man-in-the-middle attacks, verify code destinations before widespread distribution, implement rate limiting on linked endpoints to prevent abuse, monitor access logs for unusual activity, and educate users about QR code risks. For payment codes, verify amounts and recipients before confirming. Never scan codes from untrusted sources, especially those prompting app installations or providing credentials.