QR codes: what they actually do, and the mistakes that break them

QR codes went from a curiosity to something on every menu, poster and parcel in the space of a couple of years. They are genuinely useful, and they are also simpler than people assume, which is worth knowing because almost every problem with them comes from one of two misunderstandings.

A QR code is not a link. It is text.

The pattern encodes a short piece of text, and that is the whole mechanism. If the text happens to look like a web address, the scanning app offers to open it. If it looks like WiFi credentials, the phone offers to join the network. If it is just words, the phone shows you words.

There is no lookup, no server and no account involved. The code is self-contained, which is why a printed one keeps working forever with nobody paying anybody. That is the great strength of the format and the thing most easily lost.

Static versus dynamic, and why it matters

A static code contains your actual address. Print it and it points there permanently. Nothing can stop working, because there is nothing in between.

A dynamic code contains a third party's short address, which redirects to yours. That indirection buys two things: you can change the destination after printing, and you get scan statistics. It costs you a dependency. If that service raises its price, changes its terms, or shuts down, every code you ever printed stops working — and they are printed on things you cannot recall.

• Permanent destination, no tracking needed: use static. Nothing to maintain, nothing to pay
• Destination may change after printing: dynamic, and accept the dependency
• You need scan counts: dynamic, or point a static code at a URL you control and measure there
• Printed on packaging, signage or anything long-lived: strongly prefer static

That last option is the one people miss. A static code pointing at a page on your own site gives you permanence and analytics together, because you control the page and can change what it says or where it forwards to. The only thing you cannot change is the domain.

Why codes fail to scan

Physical failures are usually about size, contrast or quiet zone.

1. Size: as a rough rule, the code should be about a tenth of the distance it will be scanned from. Scanned at arm's length, roughly two centimetres square is a sensible minimum; on a poster read from three metres, it needs to be around thirty.
2. Contrast: dark on light, with real contrast. Light codes on dark backgrounds fail on many scanners, and low-contrast colour combinations fail on most.
3. Quiet zone: the blank margin around the code is part of the specification, not decoration. Cropping tight to the pattern breaks detection.
4. Distortion: codes stretched to fill a space, or printed across a fold or a curve, stop being readable.
5. Shorter links produce simpler patterns, which scan more reliably at small sizes and survive poor printing better.

That last point is a genuinely useful lever. The more text a code carries, the denser the pattern, and dense patterns need to be printed larger and more precisely. A short address is easier to scan than a long one.

The security problem nobody mentions

You cannot read a QR code. That is the whole point, and it is also the risk: scanning one is following a link you have not seen, which is advice everybody has been given never to do.

Codes stuck over the original on parking meters and payment terminals are a real and recurring fraud. A printed sticker looks exactly as official as the code underneath it.

So check the address your phone shows before tapping, be suspicious of a code that leads to a payment page, and look at whether a code in a public place appears to be a sticker applied over something else. If you are producing codes for customers, printing the destination address in plain text beside the code costs nothing and lets people verify where they are going.