QR Codes: From the Toyota Factory to Your Restaurant Menu

Everyone recognizes the black-and-white square: on the restaurant menu, on a parcel label, on the EPC payment in online banking, on a train ticket. What hardly anyone knows: the QR code was not invented for consumers but for the warehouse logistics of the Toyota subsidiary Denso. This article tells how an industrial workshop tool from the 1990s became a globally deployed everyday medium, how the technology actually works under the hood, why the 2020 pandemic broke it through in the West, and where the security pitfalls lie today.

1994 in the Toyota workshop: the problem with the barcode

The QR code emerged in 1994 in the research lab of Denso Wave, a subsidiary of Japan's Toyota Group, under engineer Masahiro Hara. Hara and his two-person team faced a concrete production problem: in Toyota's just-in-time workshops thousands of parts had to be uniquely identified along the assembly line every day. Classical barcodes (1D) could only hold roughly 20 to 30 characters depending on the standard, which was simply too little for the part labels of the time with model number, batch, date, and component identifier. On top of that, many codes had to sit on a single part at once, which cost scan time and wore the workers out.

Hara wanted a code that, first, would store significantly more information, second, could cleanly accommodate Japanese Kanji and Katakana (standard barcodes could not), third, would be scannable from any angle, and fourth, would still work when oil, dirt, or minor damage partially obscured it. Inspired by the board game Go (with its black and white stones on a grid), he and his team developed the idea of a two-dimensional matrix with three large squares in three corners, so-called finder patterns, that immediately tell the scanner where the code begins, where it ends, and in what orientation it sits. This idea was the breakthrough and has remained the trademark of the QR code since 1994.

Anatomy of a QR code: what those black squares actually do

A QR code is built from several structural elements that the scanner evaluates in a fixed order. The three large squares in the upper-left, upper-right, and lower-left corners are called position detection patterns or finder patterns. They have a fixed ratio of black to white modules (1:1:3:1:1) that remains uniquely recognizable even when the code is photographed at an angle or distorted. From these three points the scanner calculates the precise position of the fourth corner and can read the code from any rotation. Larger versions add smaller alignment patterns that help compensate for local distortion, for example when the code sits on a curved package.

Between the finder patterns sit timing patterns, rows of alternating black and white modules that let the scanner determine the precise module size. Every QR code needs a white quiet zone of at least four modules around it; without it many scanners fail or read the code unreliably. The actual data sits in the many small black-and-white squares in between, laid out in a defined zigzag pattern starting at the lower-right corner. The code also contains format and version information that tells the scanner which size and error correction level it is dealing with. Overall the structure is remarkably elegant and survives substantial damage, a property we will look at more closely shortly.

ISO/IEC 18004: 40 versions, from stamp size to poster format

The QR code has been standardized internationally as ISO/IEC 18004 since 2000; the current revision dates from 2024 and contains, among other things, clearer requirements for reflection on printed materials. The standard defines 40 different versions (sizes) of a QR code. Version 1 is 21 by 21 modules and fits on a business card; version 40 measures 177 by 177 modules and comfortably fills an A4 sheet in print. Each version step adds four modules per side, which makes the data capacity grow roughly quadratically.

Which version an encoder picks depends on the data volume and the desired error correction level. A short URL with 30 characters usually fits in version 2 or 3 (25 by 25 or 29 by 29 modules); a vCard with a photo, a long phone number, and a website can quickly land at version 10 or 15. Anyone using our QR code generator sees the effect directly: longer inputs produce visibly denser codes. For reliable scanning the printed module size should be at least 0.25 to 0.3 millimeters, ideally a full millimeter, especially if the codes will be read from a distance.

Four encoding modes: numerics, ASCII, bytes, Kanji

To keep a QR code as compact as possible, ISO/IEC 18004 defines four modes in which data can be encoded. The encoder picks the most efficient mode for each segment and can even mix them inside the same code:

• Numeric mode: digits 0 to 9 only. Maximum capacity at version 40 with low error correction: 7,089 digits. Used for tracking numbers and bank account data.
• Alphanumeric mode: uppercase A to Z, digits, and nine special characters (space, dollar, percent, asterisk, plus, minus, period, slash, colon). Maximum capacity: 4,296 characters. Caveat: no lowercase, which is why URLs in this mode are often shorter than expected.
• Byte mode (binary): 8-bit bytes, in practice almost always interpreted as UTF-8. Maximum capacity: 2,953 bytes. This is the mode for regular URLs (mixed case), vCards, JSON, and arbitrary binary content.
• Kanji mode: stores Japanese Kanji and Katakana at 13 bits per character instead of the usual 16. Maximum capacity: 1,817 characters. This mode was Hara's main motivation, because the Toyota part labels used Japanese characters.

Four error correction levels: how a QR code repairs itself

One of the most clever features of the QR code is built-in error correction. Even if a substantial part of the modules is destroyed or obscured, the scanner can reconstruct the original data. ISO/IEC 18004 defines four levels for this, each reserving a fixed percentage of the code modules for redundant information:

• Level L (Low): recovers up to 7 percent of damaged modules. Produces the smallest code for a given payload, suitable for clean, unprotected uses such as on-screen display.
• Level M (Medium): recovers up to 15 percent. Default of most generators and the sensible compromise between size and robustness.
• Level Q (Quartile): recovers up to 25 percent. Recommended for prints on rough surfaces, exposed outdoor signage, and anything that can realistically get dirty.
• Level H (High): recovers up to 30 percent. Maximum value, intended for industrial environments with dirt, oil, heat, or mechanical stress, and for QR codes with embedded logos.

Behind that error correction lies the mathematical algorithm Reed-Solomon, named after Irving S. Reed and Gustave Solomon, who published it at MIT in 1960. Reed-Solomon is the same code used on audio CDs, DVDs, and in satellite transmissions, and not by accident: it works with polynomials over finite fields and can reconstruct damaged symbols as long as their number stays below a computable threshold. In practice that means a QR code at level H remains readable even when almost a third of its surface is covered by a logo, a stain, or a scratch. That is exactly why brand logos can be embedded in QR codes without breaking them.

Before and after COVID-19: the late breakthrough in the West

In Asia the QR code was everyday infrastructure well before the pandemic. In China, WeChat Pay and Alipay have been the dominant payment methods since around 2014, both based on QR codes that the customer scans on their phone or has the merchant scan. In Japan and Korea, QR codes have been firmly established on business cards, in subway stations, and for mobile coupons since the 2000s. In the West, by contrast, the QR code remained a niche phenomenon for roughly a decade: ad agencies stuck them on posters, but the actual scan rate was vanishingly small because most smartphones required a dedicated QR app that hardly anyone had installed.

Two developments changed that. First, Apple integrated a QR scanner directly into the camera app in iOS 11 in 2017; Google followed with Lens and default camera integration on Android. For the first time, every smartphone was a standard QR reader without the user installing anything. Second, the pandemic hit in 2020. Within weeks printed menus disappeared and were replaced by QR codes linking to online menus; cafes, bars, and takeaways followed, then supermarket checkouts, venues, and even government agencies with contact tracing forms. What had been a technical outsider became, within a year, a standard element of Western everyday infrastructure and has remained so, because the convenience for operators (instant updates, no print costs) was too large to walk back.

The most important applications today

Today the QR code is no longer a single tool but a whole family of applications, each with its own conventions for what gets encoded in the URL:

• Payments: WeChat Pay, Alipay, PayPay, Brazil's PIX. In the EU the EPC SEPA QR code for SEPA transfers is part of the banking standard itself, defined by the European Payments Council. It encodes IBAN, recipient, amount, and reference in a fixed text format that every modern banking app can read.
• Wi-Fi credentials: the format WIFI:S:networkname;T:WPA;P:password;; is recognized by iOS, Android, and many routers. The hotel guest scans the code and is connected without anyone writing the password on a board.
• vCard, calendar invites, Bitcoin addresses: standardized text formats carried by the QR code. A vCard QR code on a business card spares the recipient typing contact data by hand.
• Tickets and boarding passes: rail, bus, air, concert, stadium. Here the QR code becomes a signed or encrypted security credential. Anyone who saves a boarding pass can inspect it with our Base64 encoder/decoder to see what sits in the binary parts.

Quishing: when the QR code becomes a phishing trap

Mass adoption brought abuse along with it. Security researchers coined the term quishing (a portmanteau of QR and phishing) for the practice of pasting fake QR codes over real ones. Classic examples from 2023 to 2025: fake parking-ticket QR codes on parking meters in several European cities that did not link to the city payment page but to a cloned credit-card trap; stickers on EV charging stations leading to fake apps or credit-card forms; supposed bank QR codes in phishing letters that, instead of the genuine banking site, opened a perfectly cloned login page.

The most important rule of thumb: always check the URL preview the phone shows before opening, and never blindly tap Open. With physical QR codes on public devices it is worth looking whether one sticker is pasted over another; that is the classic quishing pattern. Be suspicious whenever the QR code leads to a URL shortener that hides the real target. If you want to inspect a target URL or decode special characters, our URL encoder/decoder helps you make special characters readable and reveal hidden parameters.

QR codes with logos and color: design freedom thanks to error correction

The fact that a QR code can carry a brand logo in its middle is not marketing magic but a direct consequence of Reed-Solomon error correction. At level H the code tolerates up to 30 percent loss, which corresponds to roughly a 25 to 28 percent logo share in the middle (with a safety margin). What matters is that the three finder patterns in the corners stay untouched; without them the scanner cannot align the code. Design variants today range from rounded modules through dot patterns to embedded photo backgrounds.

Color is also possible as long as the contrast between background and modules is high enough; the rule of thumb is a brightness ratio of at least 50 percent, ideally with dark modules on a light background, because many older scanners have trouble with inverted codes (light on dark). Multi-color background effects or gradients work in practice only when the individual modules remain compact, clearly colored points. Anyone getting creative should absolutely test the code on multiple smartphones, since different camera sensors react to contrast differently.

Static and dynamic QR codes

QR codes split into two fundamentally different classes. A static QR code encodes the target URL directly. Once printed it cannot be changed without reprinting. Static codes have the advantage that they work without a third party and cannot go offline as long as the target URL exists. They are the right choice for long-lived installations such as wayfinding signs, menus in travel magazines, or vCards on business cards, that is, anywhere the target stays stable for years.

A dynamic QR code, by contrast, encodes a short redirect URL of a QR provider that then forwards the user to the actual target. The advantage is that you can change the target at any time without reprinting, and that you can measure the number of scans, the countries, and the timing; it is effectively a URL shortener with a graphical wrapper. The downside: you depend on the availability and trustworthiness of the provider, and if the service shuts down the printed codes are suddenly dead. In marketing, dynamic codes are the default; in security or government communication they are, for exactly that reason, less popular.

Frequently asked questions

Can a QR code be hacked?

The code itself cannot be hacked; it is an openly readable data pattern defined by a published standard. What can be attacked is the target URL: through a pasted fake code (quishing), through a compromised server at the other end, or through a URL shortener that later changes its target. Security-sensitive QR codes like tickets or banking QRs therefore usually carry signed data whose authenticity the app verifies before accepting.

How small can a QR code be printed?

In theory very small; in practice it is limited by module size and the resolution of the scanning camera. Rule of thumb: the printed module size should be at least 0.25 millimeters, ideally 0.33 millimeters; at version 2 (25 by 25 modules) that produces an edge length of about 8 millimeters. For code sizes below 10 millimeters edge length, print with extra contrast and choose a low version number to keep individual modules large enough for the smartphone camera.

Why do QR codes with the same content sometimes look different?

It is due to the so-called mask patterns. ISO/IEC 18004 defines eight different mask functions that an encoder can apply over the data region to prevent random repetitions from mimicking finder patterns or other shapes that confuse a scanner. The encoder typically tries all eight masks and picks the one with the lowest confusion score according to the standard's rules. Depending on the library and version the result can therefore look slightly different even when the embedded content is identical.