QR codes explained: what they hold, how to print them and how to scan safely

What a QR code can hold

A QR code stores text, or raw bytes. What happens when you scan it depends on how that text is written: phone camera apps recognise a few common formats and offer a matching action, such as opening a link, joining a network or saving a contact.

The QR Code Generator has one Content box rather than separate forms, so you type the formats below yourself; the box accepts several lines, which a contact card needs. The QR Code Reader labels what it decodes, for example web link, Wi-Fi network, contact card or phone number, which is a quick way to check you got the format right.

• Web link: https://example.com/menu. Shorter is better: less text gives a simpler pattern with bigger squares at the same printed size.
• Plain text: shown as text, with nothing to open.
• Wi-Fi: WIFI:T:WPA;S:HomeGuest;P:yourpassword;;. Use T:nopass for an open network, and put a backslash before any ;, ,, :, \ or " in the network name or password.
• Contact card (vCard): separate lines starting with BEGIN:VCARD and VERSION:3.0, then fields such as N:Patil;Asha, FN:Asha Patil, TEL:+15555550123 and EMAIL:asha@example.com, and finally END:VCARD.
• Phone, SMS and email: tel:+15555550123, SMSTO:+15555550123:Hello and mailto:asha@example.com.

Static and dynamic QR codes

A static code contains your actual content. Nothing sits between the scan and the content, so there is no service that can count the scans, redirect them or switch the code off. It also can’t be edited: if the address changes, you need a new code. The FlexyPdf generator makes static codes, built in your browser.

A dynamic QR code is technically a static code too, but what it contains is a short link run by a QR service. The service redirects each scan to an address you set, so you can change the destination later and see scan counts. The catch is the dependency: if the service shuts down, changes its terms or you stop paying, every printed code can stop working, and every scan passes through a third party.

For printed material there is a middle path: encode a short, stable address on your own website, such as example.com/menu, and change what that page shows, or where it redirects, whenever you need to.

Error correction: L, M, Q and H

QR codes use Reed–Solomon error correction. Part of the code holds redundant data, so a scanner can rebuild the content when some of it is dirty, scratched or covered. The standard percentages below are roughly how much of the code’s data each level can restore.

The price is density. A higher level spends more of the code on redundancy, so the same text may need a bigger grid of smaller squares; at the same printed size each square is then smaller and harder to read from a distance or with a poor camera. The generator’s Error Correction menu offers all four levels, starts on Medium, and tells you when your text no longer fits at the chosen level.

As a starting point:

• L (Low, about 7%): the least dense pattern, useful when the content is long and the code must be small. It tolerates little damage.
• M (Medium, about 15%): a sensible default for screens and most print.
• Q (Quartile, about 25%): printed codes that will be handled, folded or exposed to weather.
• H (High, about 30%): harsh conditions, or when a logo will be placed over part of the code, which uses up some of the redundancy.

Size, density and the quiet zone

A QR code is a grid of squares called modules, from 21 × 21 in the smallest version to 177 × 177 in the largest. More content or a higher error-correction level can mean more modules. What matters most for scanning is the printed size of each module, not of the whole code.

There is no single official minimum print size, but two rules of thumb are common: keep a code that holds a short link at least about 2 cm (0.8 in) wide for close-up scanning, and make it roughly a tenth of the scanning distance, so about 10 cm wide for a poster read from 1 m away. Go bigger for dense codes, and test.

The quiet zone is the blank margin that tells a scanner where the code ends. The QR specification calls for 4 modules on every side, and the generator’s downloads include exactly that. Keep the margin when you place the code in a design, and don’t let text or other graphics run into it, especially on a coloured or busy background. For print, use Download SVG, which scales without blurring; the PNG downloads are 200 to 500 pixels wide.

Colours, contrast and inverted codes

Scanners work from brightness, not colour. Dark modules on a light background with strong contrast work best: black on white, or a dark brand colour on white or a pale tint. A pale foreground such as yellow, or two colours of similar brightness, can fail even when they look clearly different to you.

An inverted code has light modules on a dark background. Support for it varies between scanner apps, so if you use one, test it with several phones. The QR Code Reader tries both the normal and the inverted reading of every image you choose and every camera frame.

The generator accepts any foreground and background colour as hex values, including 8-digit values with transparency, and doesn’t check the contrast for you. A code with a transparent background takes its contrast from whatever it is printed on, so check it on the final surface.

Test before you print

A printed mistake is expensive, so check the real thing:

• Decode the exported file with the QR Code Reader and compare the text with what you meant, character by character for links and Wi-Fi passwords.
• Print a test copy at the final size and scan it with at least two different phones, including an older one, from where people will actually stand.
• Try it in the real light and on the real material: glossy lamination, curved bottles and folds all cause trouble.
• Open the link on mobile data, not only on office Wi-Fi, to catch addresses that work only inside your network or land on a login page.
• Test again after any design change, such as resizing in layout software, recolouring or adding a logo.

Scanning safely

A QR code hides its destination until you scan it, and scammers use that. QR phishing, sometimes called quishing, includes stickers placed over genuine codes on parking meters and posters, and emails that put a malicious link inside a QR code, where email link filters may not look. Treat a scanned link like a link in an unexpected email.

• Read the address your camera shows before opening it. Check the domain for misspellings and odd endings, and be wary of short links that hide the destination.
• Don’t enter passwords or card details on a page reached from a code you didn’t expect; go to the site or app directly instead.
• In India, remember that receiving money by UPI never requires scanning a code or entering your UPI PIN. A code that asks for your PIN is taking money from your account.
• Look for a sticker on top of a printed code, especially on anything that takes payments.
• To inspect a code without visiting the link, load a photo or screenshot into the QR Code Reader. It shows the decoded text and never opens links by itself.