QR Codes Explained: How They Work and How to Make Your Own

October 13, 2026 · 8 min read

They're on menus, receipts, business cards, and billboards. Those black-and-white squares that open a website when you point your phone at them. QR codes look like magic, but they're just a clever encoding scheme. Here's what they actually store, how to make your own, and how to use them safely.

What a QR code actually is

QR stands for "Quick Response." The code is a two-dimensional barcode: instead of encoding data in the widths of vertical lines (like a traditional barcode), it encodes data in a grid of black and white squares, called modules. A phone camera reads the pattern, the decoding software reconstructs the data, and you get a link, some text, or contact details.

Three structural features make the whole thing work:

  • The three big squares in the corners (finder patterns) tell the scanner "this is a QR code, and here is its orientation." That's why a code scans even when it's rotated or photographed at an angle.
  • Error correction is built into the format. Depending on the setting, 7% to 30% of the code can be damaged, dirty, or covered, a logo in the middle, a coffee stain, and it still scans. Higher error correction means a denser code for the same data, so it's a tradeoff.
  • Capacity scales with version. QR codes come in 40 "versions". Larger grids hold more data. A tiny version-1 code holds a short URL; a maxed-out version-40 code can hold a few thousand characters. Most generators pick the version automatically based on what you encode.

The key insight: a QR code doesn't contain a website. It contains text. And your phone decides what to do with that text. If the text starts with https://, the phone offers to open it. If it's a WiFi credential string, the phone offers to join the network. The code itself is dumb storage; the phone is the smart part.

The four QR types you'll actually use

Technically there's one QR format with many data conventions layered on top. In practice, four types cover nearly every real-world use:

1. URL codes. The workhorse

A URL QR encodes a web address. Point, scan, tap, browse. Use them on business cards (link to your portfolio), product packaging (link to instructions or a registration page), event posters (link to tickets), and receipts (link to a review page or return policy). Make one with a QR URL generator.

Tip: use a short, stable URL. A QR code printed on 10,000 flyers can't be edited after printing. If the link dies, the code dies. If the destination might change, point the code at a URL you control (like a redirect on your own domain) so you can update where it lands later. That's the honest version of what paid "dynamic QR" services sell you.

2. WiFi codes. Skip the password dictation

A WiFi QR encodes the network name, security type, and password in a standardized format. Guests scan it and join instantly. No more spelling out "capital S, number 3, underscore…" across a noisy café. Essential for Airbnb listings, offices, cafés, and house parties. Generate one with a QR WiFi generator and print it for the fridge or the counter.

Tip: if you rotate your WiFi password, remember to reprint the code. An outdated WiFi QR fails silently. The phone just won't connect, and guests will assume the internet is broken.

3. vCard codes. The digital business card

A vCard QR encodes contact details: name, phone, email, company, address. Scanning it prompts the phone to save a new contact. No typing, no transcription errors. Put one on the back of your business card, on your email signature page, or on a conference badge. Create one with a QR vCard generator.

Tip: keep it to the fields people actually need. A vCard with twelve fields produces a dense, hard-to-scan code. Name, phone, email, company is plenty.

4. Plain text codes. For everything else

Sometimes you just need to move a chunk of text onto a phone: a coupon code, a serial number, instructions in a location with no internet, a short message. A QR text generator encodes any text directly. No website involved, works fully offline.

How to make a QR code (the right way)

  1. Choose the type. URL, WiFi, vCard, or text. Match the type to what you want the scanner's phone to do.
  2. Enter clean data. Double-check the URL (including https://), the WiFi password character by character, the phone number format. A QR code faithfully encodes your typos.
  3. Generate and download at high resolution. For print, you want a PNG at 1000px or larger, or better yet a vector format (SVG) that scales infinitely. A 200px code blown up for a poster will scan poorly.
  4. Test before you print. Scan the code with two different phones, an iPhone and an Android if you can, and confirm each one does the right thing. Test at the actual size and distance it will be used: a code on a billboard needs to be far larger than one on a business card.
  5. Print, place, re-test. Scan the printed result in its real environment, under real lighting, from a realistic distance.

Design and print tips

  • Size matters most. The rule of thumb: a QR code should be at least 2 × 2 cm (about 0.8 × 0.8 inches) for close-range scanning, and roughly 10× the expected scanning distance divided by 100 for farther use. A code scanned from 1 meter away should be about 10 cm square. When in doubt, go bigger. An oversized code always scans; an undersized one sometimes doesn't.
  • Contrast is non-negotiable. Dark modules on a light background. Black on white is the safest choice. Inverted codes (white on black) fail on many scanners. Colored codes can work if the contrast is strong, but test them. Pastel-on-pastel is a classic failure.
  • Respect the quiet zone. The blank margin around a QR code isn't wasted space. Scanners need it to find the code's edges. Keep a clear border at least as wide as one module row on all sides. Don't let text, logos, or design elements crowd it.
  • Flat beats curved. Codes on curved surfaces (mugs, bottles) or wrinkled materials distort the grid. If you must use a curved surface, keep the code small relative to the curvature and test thoroughly.
  • Be careful with logos in the center. Covering the middle works only because of error correction. And only up to about 15–20% of the area with high error-correction settings. A big logo over a dense code is the most common reason "designed" QR codes fail. Test after adding any overlay.
  • Consider the lighting. Glossy lamination creates reflections that blind phone cameras. Matte finishes scan more reliably. Outdoor codes need to survive sun glare and rain. Test in daylight, not just under office lights.

Safety: QR codes can be weapons

A QR code is just encoded text, and text can lie. Because you can't read a QR code with your eyes, attackers exploit the gap between what you see (a sticker on a parking meter, a flyer on a lamppost) and where the code actually goes. Real-world abuses include:

  • Sticker overlays. A scammer places their own QR sticker over a legitimate one, on parking meters, restaurant tables, EV chargers, redirecting payments or logins to a phishing site.
  • Phishing links. The code opens a convincing fake login page (your bank, your email) that harvests credentials. On a phone, the URL bar is small and easy to miss.
  • Malicious actions. Beyond URLs, QR codes can trigger adding contacts, sending pre-written texts, or connecting to rogue WiFi networks.

Protect yourself with habits, not paranoia:

  • Preview before you tap. Both iOS and Android show the decoded URL before opening it. Read it. If a code on a coffee shop table points to some random domain instead of the shop's site, don't tap.
  • Don't scan codes in unexpected places. A QR code texted to you out of the blue, or stuck over another code, deserves suspicion.
  • Never enter credentials after scanning. If a scanned code leads to a login page, navigate to the site yourself instead of trusting the link.
  • Check for tampering. If a printed QR looks like a sticker placed over something else, it probably is.

Common mistakes

  • Encoding a URL that requires login. A QR linking to a page behind authentication just shows scanners a login wall. Link to public pages.
  • Using URL shorteners you don't control. If the shortener shuts down or flags your link, every printed code dies with it. Use your own domain or a shortener with a long track record.
  • Too much data. Encoding a full paragraph of text plus a URL creates a dense, fragile code. Less data = larger modules = easier scanning. Split the job: put details on the landing page, keep the code minimal.
  • Forgetting mobile context. Nearly everyone scans with a phone. If your QR links to a page that's unusable on mobile, the code technically worked and practically failed.
  • No call to action. A bare QR code with no explanation gets ignored. Add "Scan for the menu" or "Scan to join WiFi". Tell people what they'll get.

Bottom line

QR codes are simple: encoded text plus a phone smart enough to act on it. Pick the right type for the job (URL, WiFi, vCard, or plain text). Keep the data clean and minimal, print big with strong contrast and a proper quiet zone, and test with real phones before you commit to print. Do that, and your codes will scan first time, every time.