The Technology Hidden in QR Code Patterns
The QR code (Quick Response Code) is a two-dimensional barcode developed in 1994 by Masahiro Hara at Denso Wave. Originally designed for automotive parts inventory management, the proliferation of smartphones has made QR codes ubiquitous in payments, URL sharing, tickets, business card exchanges, and countless other everyday situations.
Those black-and-white patterns may look random, but they actually have a precisely engineered structure.
QR Code Structure - Three Landmarks
The most distinctive elements of a QR code are the large square patterns (finder patterns) in three corners.
- Finder patterns: Placed in the top-left, top-right, and bottom-left corners. These landmarks allow cameras to instantly detect the QR code's position, orientation, and tilt. The code can be read from any angle because these three points establish the coordinate system
- Alignment patterns: Small squares added to larger QR codes for distortion correction
- Timing patterns: Alternating black-and-white lines connecting finder patterns. Reference lines for precisely locating module (dot) coordinates
- Format information: An area recording the error correction level and mask pattern
- Data area: Where the actual data is stored
The fourth corner (bottom-right) has no finder pattern because three points are sufficient to determine position and orientation, and the fourth corner is more efficiently used as data area.
Error Correction - The Secret to Reading Dirty Codes
One of the QR code's greatest features is its powerful error correction capability. Using Reed-Solomon codes, data can be recovered even when parts of the QR code are dirty or damaged.
- Level L (Low): Recoverable with up to about 7% damage
- Level M (Medium): Recoverable with up to about 15% damage
- Level Q (Quartile): Recoverable with up to about 25% damage
- Level H (High): Recoverable with up to about 30% damage
The reason company logos placed in the center of QR codes don't prevent scanning is thanks to this error correction. Data hidden by the logo is recovered from the error correction codes. However, if the logo exceeds the error correction limit, the code becomes unreadable, so Level H must be used and the logo kept within 30% of the total area.
QR Code Security Risks
While convenient, QR codes carry security risks.
QR Phishing (Quishing)
Attacks that embed malicious URLs in QR codes to redirect users to phishing sites. Since humans cannot visually verify QR code contents, phishing is harder to detect compared to directly entering URLs.
- Physical attacks that paste fake QR codes over legitimate ones
- Attacks sending fake QR codes via email or social media
- Attacks replacing QR codes placed in public spaces
These attacks share similarities with supply chain attacks, where a trusted intermediary (in this case, a physical QR code) is compromised to redirect users to malicious destinations.
Countermeasures
- Always verify the destination URL after scanning a QR code
- Exercise extra caution when shortened URLs are used
- Physically check whether QR codes in public places have been pasted over
- Even if you accidentally visit a phishing site via QR code, two-factor authentication on your accounts prevents attackers from logging in with stolen credentials alone
- Use IP Check-san to verify connection information and check whether you've been redirected to a suspicious site
QR Code Capacity
The amount of data a QR code can store varies by version (size) and error correction level. For the maximum Version 40 (177x177 modules) with error correction Level L:
- Numeric only: Up to 7,089 characters
- Alphanumeric: Up to 4,296 characters
- Binary: Up to 2,953 bytes
- Kanji: Up to 1,817 characters
Reflecting QR codes' Japanese origins, an efficient encoding mode for kanji (Shift_JIS) is included as standard.
Why "Quick Response"?
The "QR" in QR code stands for Quick Response. Developer Masahiro Hara needed to scan parts at high speed on factory production lines, so he designed a two-dimensional code that could be read faster than traditional one-dimensional barcodes. The finder pattern placement is optimized for instant position detection from any angle.
Denso Wave holds the patent for QR codes but has declared it will not exercise its patent rights, allowing anyone to generate and use QR codes for free. This "open" approach has been a major driver of QR codes' worldwide adoption.
Summary
QR codes were born in a Japanese automotive factory and have permeated everyday life worldwide. High-speed detection via three finder patterns, powerful error correction using Reed-Solomon codes, and standard kanji encoding support - behind those black-and-white patterns lies a precisely crafted design philosophy.