How do QR codes work? What they are, whether they expire, and if your logo fits
For anyone who uses QR codes in their business or just wants to understand them: how your phone reads them, why some stop working and how much logo they can take, with our own test.
A QR code is a two-dimensional barcode. Its black and white squares, called modules, store a short piece of text, such as a web address or a Wi-Fi password. Here’s how QR codes work: your phone’s camera finds the code by the three big squares in its corners, reads each module as a 0 or a 1 and puts the text back together. It also carries spare data, so it can repair itself if part of it gets dirty or covered.
Do they expire? Regular ones don’t; “dynamic” ones depend on a company’s server. Can you add a logo? Yes, if it’s small: in our test, at the highest correction level, codes always scanned with 15% of the symbol covered and almost never with 20%. Are they safe? As safe as the link they lead to.
What is a QR code?
A QR code is a two-dimensional barcode: it stores data both across and down, so it holds far more than a traditional barcode, which tops out at around 20 characters according to the history told by DENSO WAVE, the company that created it. QR stands for “Quick Response.”
DENSO WAVE, then a division of Japan’s DENSO, released it in 1994, and the auto industry adopted it to manage production. In 2000 it became an international standard, ISO/IEC 18004, whose current edition dates from August 2024.
How does a QR code work?
Think of a sheet of graph paper: the text is turned into bits, and each bit is drawn as a black (1) or white (0) module. Spare data is added to correct errors, plus fixed markers that help the camera find the code and measure its grid.
The more data, the bigger the code. According to DENSO WAVE’s version table, there are 40 versions: version 1 is 21 × 21 modules and each one adds 4 per side, up to 177 × 177 for version 40. The smallest version that fits the data is used.
The parts of a QR code
- Three position squares in the corners. Their stripes follow a 1:1:3:1:1 ratio, the least common in print according to DENSO WAVE, and tell the reader where the code is and how it’s rotated.
- Alignment patterns: small squares that correct distortion when the photo is taken at an angle. Version 1 has none; versions 2 to 6 have one.
- Timing lines: a row and a column of alternating modules that mark out the grid.
- Format information: a few modules next to the squares, stored twice, that give the error correction level and the mask, a pattern that avoids confusing areas.
- Quiet zone: the blank margin, which DENSO WAVE sets at 4 modules on every side.
What your phone does when it scans one
- It finds the three squares by their ratio, even if the code is sideways or upside down.
- It straightens the image and maps the grid, helped by the alignment pattern if there is one.
- It reads the format: which correction level and which mask the code uses.
- It reads the modules, removes the mask and groups them into 8-bit words.
- It fixes errors with Reed–Solomon, the same math used on music CDs.
- It interprets the text: it shows you the link or offers to join the Wi-Fi network.
How much data can a QR code hold?
At most, 7,089 digits, 4,296 alphanumeric characters (capital letters, numbers and a few symbols) or 2,953 bytes, with version 40 and the lowest correction level, according to DENSO WAVE’s table. In practice, store much less: the more data, the more modules, and the smaller each one gets in the same space.
We checked it in October 2026 with the qrcode library: we generated longer and longer links at level M, the most widely used according to DENSO WAVE, and at level H, the most robust.
| Link | Level M | Level H |
|---|---|---|
| Short (21 characters) | Version 2 · 25 × 25 | Version 3 · 29 × 29 |
| With a page path (55) | Version 4 · 33 × 33 | Version 6 · 41 × 41 |
| With campaign tags (119) | Version 7 · 45 × 45 | Version 10 · 57 × 57 |
| With more tags (198) | Version 10 · 57 × 57 | Version 14 · 73 × 73 |
At the same printed size, each module of the 57 × 57 code is less than half as wide as in the 25 × 25 one. And according to DENSO WAVE, the bigger the module, the easier it is to read. Strip out campaign tags you don’t use.
Do QR codes expire?
A static QR code doesn’t expire: the text is inside the pattern, so it works as long as the page it points to exists. The ones that can fail are dynamic codes, which hold a short link to another company’s server that redirects you; if that company switches it off, the printed code stops leading to your page.
A dynamic code lets you change the destination without reprinting, but it ties the code to that service: according to QR Code Generator’s help center, its dynamic codes are deactivated when the free trial ends (checked in October 2026). And in 2024 Google announced it would shut down its goo.gl short links in August 2025; in the end, it kept only the ones still in use.
To change the destination without depending on anyone, make a static code that points to a page on your own domain, like yourbusiness.com/menu, and update that page when needed. We explain what a domain is in domain vs hosting vs DNS.
Can you put a logo on a QR code?
Yes, thanks to error correction, but within limits. There are four levels which, according to DENSO WAVE, can restore about 7% (L), 15% (M), 25% (Q) or 30% (H) of the code’s words, blocks of 8 bits. A logo in the middle counts as damage, and that percentage is not surface area.
We measured it in October 2026. With the qrcode library we generated a 28-character link at all four levels and covered its center with a white square, from 5% to 30% of the area. We read each image with jsQR, an open-source reader, and repeated the test with 50 different links of the same length.
| Level | Code size | Scanned with the center covered |
|---|---|---|
| L (7%) | Version 2 · 25 × 25 | 5%: 41 of 50 · 10%: none |
| M (15%) | Version 3 · 29 × 29 | 5%: all 50 · 10%: 10 of 50 · 15%: none |
| Q (25%) | Version 3 · 29 × 29 | 10%: all 50 · 15%: 11 of 50 · 20%: none |
| H (30%) | Version 4 · 33 × 33 | 15%: all 50 · 20%: 3 of 50 · 25%: none |
With the first link, level H even survived 20%; the 50 links show that was luck. The reason: that 30% is counted in 8-bit words, and covering part of a word ruins the whole word. With 20% covered, 32 of its 100 words were damaged, exactly as many as it can repair; with 25%, 42.
One test, one reader: jsQR read perfect computer-made images. A real photo, in poor light, blurred or at an angle, reads worse, and every phone camera decodes in its own way.
Our recommendation: level H, the smallest logo you can get away with and a printed test with several phones; DENSO WAVE warns that anything placed over the code reduces its contrast. If you use our free QR code generator, adding a logo switches it to level H, and it warns you if the code stops scanning.
Are QR codes safe?
A QR code does nothing on its own: it only stores text. The risk is where it takes you, and you can’t tell by looking: a scammer can print one that opens a fake copy of your bank’s site to ask for your details or a payment. The UK’s National Cyber Security Centre notes that this is sometimes called “quishing.”
It happens: in September 2026, the Federal Trade Commission warned about scammers covering parking meter QR codes with their own, and the FBI had flagged tampered codes back in January 2022. Their advice comes down to three things:
- Check the address before opening it. If it isn’t the site you expected, don’t go in.
- Be wary of a code that looks tampered with, such as a sticker on top of the original.
- Don’t enter passwords or card details on a page opened from a QR code; to pay, type an address you know yourself.
What changes for you and your business?
A QR code saves typing: the restaurant menu, the Wi-Fi password, payment details or your contact card go from paper to phone. If you’re going to print one:
- Choose a static code: it doesn’t depend on any subscription.
- Keep the white margin of 4 modules, with no text or images touching it.
- Mind the contrast and don’t stretch or distort the code in your design.
- Test it in print with two or three phones, at the real distance, before printing 500.
- Check it now and then to make sure nobody has stuck another code over yours, the trick the FTC warns about.
What gets exaggerated about QR codes
- “QR codes expire.” Only dynamic ones do. A static code works as long as the page it leads to exists, and that page is what can really expire.
- “Any logo will fit.” Level H’s 30% refers to data words, not surface area: with 20% covered, only 3 of our 50 codes scanned.
- “Scanning a QR code is always safe.” Scanning only shows you text; the danger comes when you open the link, install something or pay without checking who gets the money.
The bottom line
A QR code is text turned into modules, with error correction built in. Static codes don’t expire, a small logo fits at level H, and staying safe starts with reading the address.
If you’re making one, our QR code generator creates static codes with no sign-up, and it sits alongside the rest of our tools.
Frequently asked questions
Do I need an app to scan a QR code?
Usually not. On iPhone, the Camera app recognizes it and shows a link to tap, according to Apple Support; on Pixel phones the camera does the same, and Google Lens works too, according to Google’s help page. The NCSC even recommends the scanner built into your phone over one downloaded from an app store.
Do you have to pay to use QR codes?
No. DENSO WAVE chose not to exercise its patent on QR codes that follow the standard, so anyone can create them for free. What it owns is the name: “QR Code” is a registered trademark of DENSO WAVE INCORPORATED; the pattern isn’t.
What size should a printed QR code be?
It depends on its modules and on the scanning distance. DENSO WAVE gives an example: a version 2 code with 0.5 mm modules measures 12.5 mm per side, plus the margin. Print a test and scan it from where your customers will.