A QR code is a two-dimensional barcode that stores text in a grid of squares. A camera reads the grid, software decodes it back into characters, and the phone offers to do something with the result. That is the whole idea. The reason it feels like more than that is the text is usually a web address, so scanning appears to "open a link" when what actually happened was reading a string.
Denso Wave announced the format in 1994, and its own history page (accessed 2026-10-25) explains that the QR stands for "quick response" and that the company kept the patent rights but declared it would not exercise them. The specification is published as ISO/IEC 18004 (the ISO page refused our automated fetch on 2026-10-25, so I'm citing Denso Wave's standards page, accessed the same day, for the ISO approval). In practice that means anyone can generate a code without paying a fee, and every camera app can read one.
If you already know what a code is and want to make one, how to create a QR code is the practical guide. This page is the explainer underneath it.
What the Squares Actually Are
Not every module in a code is data.
The three large squares in the corners are finder patterns. They tell the scanner where the code is in the frame and how it is rotated, which is why a code works upside down or at an angle. Smaller alignment patterns keep the grid honest when the code is on a curved surface. A line of alternating modules between the corners, the timing pattern, tells the scanner how wide one module is at the current distance.
Everything else is payload plus error correction. Those correction bytes are what let a code survive a coffee ring or a logo in the middle: the decoder reconstructs the missing modules from the redundancy, up to the level the code was generated at. There are four levels, L, M, Q and H, which recover about 7, 15, 25 and 30 percent of the code respectively. Level M, the usual default, tolerates roughly 15 percent damage; error correction levels covers choosing one.
What Happens Between Scan and Page
Decoding is local and offline. The camera resolves the grid, the decoder applies error correction and turns modules into bytes, and the bytes become a string. No network involved, which is why a code still scans on a plane.
The phone then reads the start of that string and decides what to offer. https:// produces a prompt to open a page. WIFI: produces a prompt to join a network. BEGIN:VCARD produces a prompt to save a contact. If the string is just words, most camera apps show the words.
That split matters for two practical reasons. A scan cannot execute anything by itself, so the risk of a QR code lives entirely in where it sends you, which is what are QR codes safe covers. And nothing about the code changes when the destination changes, which is the whole basis of dynamic codes.
What a Code Can Hold
A URL is the common case, and the rest are more useful than people expect. A wifi QR code puts the network name, security type, and password into one string so guests join without being read a password across a room. A vCard code carries a full contact record. Tickets and industrial parts often carry a plain identifier with no protocol at all. A SEPA payment code takes the same idea further: the transfer details are the payload, so a banking app fills the form without contacting anything.
Size is bounded. Denso Wave's version table (accessed 2026-10-25) runs from Version 1, a 21 by 21 module grid, to Version 40, 177 by 177, growing four modules per side each step. At the top, a code holds at most 7,089 digits, 4,296 alphanumeric characters, or 2,953 bytes, and less at higher error-correction levels. Nobody should print anything near that.
Length has a physical consequence. More characters means a higher version of the code, which means more modules in the same printed area, which means each module is smaller and harder for a camera to resolve. That is why encoding a short link rather than a long tagged URL produces a visibly chunkier, more forgiving code, and it is the most common reason a code fails to scan.
The Blank Border Is Part of the Code
The grid needs empty space around it, called the quiet zone, and the standard asks for at least four modules on every side. Scanners use it to tell where the code ends and the page begins. Crop it or push the code against a busy photo and a correct code fails. Elido's QR designer draws the four-module quiet zone for you, as covered in branded QR codes design; keep it clear when you place the exported file.
Make One and Look at It
You can see all of this on a real code. The free QR generator tool on this site creates a static code for six kinds of content: a URL, plain text, wifi credentials, a vCard contact, an email, or an SMS. It builds the exact strings described above (WIFI:, BEGIN:VCARD, mailto:, SMSTO:) and shows a contrast ratio that warns you before a pale colour pair fails. It has no dedicated phone-call or WhatsApp type; for those, encode a tel: or https://wa.me/ link as a URL, as in QR code for a phone number and WhatsApp QR codes.
For colours, module shapes, a logo and PNG or SVG export, the dashboard designer does the styling.
Static and Dynamic: The Only Distinction That Matters Commercially
The code itself has no concept of static or dynamic. Both are the same squares.
The difference is what the string points at. A static code encodes the destination directly, so the destination is fixed at the moment of printing. A dynamic code encodes a short link you control, so the redirect behind it can be repointed later and each scan can be counted. Elido counts a scan as a click on the short link, so a scan shows up in the same analytics as any other visit and isn't labelled separately.
Everything marketers care about, scan counts by day and country, changing a campaign page after the flyers went out, comparing two placements, comes from that redirect rather than from the code. Dynamic vs static QR codes walks the trade in full, and how to track QR code scans covers reading the numbers.
Want to see the difference? Create a link on the free plan, generate a code from it, and compare it against a code made from the raw destination URL.
Where They Are Actually Used Now
Menus and payments made codes normal, but the durable uses are quieter: joining wifi without a password, a poster that leads to a booking page, product packaging that carries provenance and instructions, a code on an invoice that opens a payment page with the amount pre-filled.
Regulation is pushing the packaging case hardest. The EU's digital product passport programme puts a scannable identifier on physical goods, which is the same mechanism applied to compliance rather than marketing, and digital product passport QR codes covers what that requires.
What all of them share is that the code is the cheap half. The link behind it decides whether it can be measured, corrected, or trusted.
Strictly speaking a QR code is a two-dimensional barcode, and the practical differences between the two are laid out in barcode vs QR code.
Read the Cornerstone Series
This sits in the features cluster. Start with how to create a QR code, then dynamic vs static for the commercial decision. The QR codes feature page covers styling, and how to scan a QR code covers the reader side.
Related on the Blog
Frequently asked questions
What is a QR code?
A QR code is a two-dimensional barcode that stores text in a grid of black and white squares. A camera reads the grid, decodes it back into characters, and the phone acts on what it finds. Most codes hold a web address, but the format itself just holds text.
How does a QR code work?
Three large squares in the corners tell the scanner where the code is and how it is rotated, a timing pattern tells it how big each module is, and the remaining modules carry the data plus error-correction bytes. Decoding happens on the device, offline, in a fraction of a second.
What can a QR code store besides a link?
Wifi credentials that join a network without typing a password, a vCard that saves a contact, a phone number, an email, a calendar event, a payment string, or plain text. The scanner reads the prefix and offers the matching action, which is why a wifi code prompts to connect rather than to open a page.
Do QR codes expire?
The printed code does not. It is a static pattern of squares and it decodes the same way forever. What can expire is the destination: if the code encodes a URL and that page is taken down, the scan succeeds and the browser then fails. A dynamic code avoids that by encoding a link you can repoint.
Do you need internet to scan a QR code?
Not to decode it. The camera and decoder work entirely offline, so the phone can read the text out of any code without a connection. Internet is needed only for what happens next, which for a URL code means loading the page.
Are QR codes free to make?
The format is an open standard with no licensing fee, so generating a static code costs nothing. What you pay for, if anything, is the service behind a dynamic code: a hosted redirect that lets you change the destination after printing and reports how many times each code was scanned.
Try Elido
Paste a URL, get a working short link
No signup. Link lives for 30 days. Sign up to keep it forever.
No signup needed. Sign up free for 50 links a month.