You see them everywhere — on restaurant tables, product packaging, billboards, boarding passes, and medicine bottles. QR codes have quietly become one of the most used technologies on the planet. Around 44.6% of global internet users scan at least one QR code every month, and approximately 84% of mobile users worldwide have scanned one at least once. Yet most people could not explain how they actually work.
This guide covers everything: what QR codes are, how they encode and transmit data, how to scan and create them for free, and how to stay safe from the QR code scams that have surged in 2025 and 2026.
What is a QR Code?
A QR code — short for Quick Response code — is a two-dimensional barcode that stores data as a pattern of black squares on a white background. Unlike traditional one-dimensional barcodes that encode data only horizontally, QR codes encode data in both directions, which is why they can store significantly more information.
The technology was invented in 1994 by Denso Wave, a subsidiary of Toyota, originally to track automotive parts during manufacturing. Denso Wave made a decision that changed everything: they intentionally opened the patent for public use, betting on widespread innovation rather than licensing fees. That decision turned an industrial tool into a global communication standard.
A standard QR code can store up to 7,089 numeric characters or 4,296 alphanumeric characters. In practice, most QR codes store a short URL — well below the maximum — which keeps the pattern simple and easy to scan reliably.
How QR Codes Actually Work
When you point your camera at a QR code, a lot happens in under half a second. Every QR code contains the same structural elements:
- Finder patterns — The three square symbols in the corners. They let the scanner locate the code and read it at any angle or rotation.
- Data modules — The grid of black and white squares that encodes your content in binary.
- Error correction modules — Extra data embedded throughout the code allowing it to be read even when partially damaged.
- Quiet zone — The white border surrounding the code. The scanner uses this to identify the boundaries. Removing it causes scan failures.
Why QR codes still work when damaged
Up to 30% of a QR code's modules are Reed-Solomon error correction data. Even if a portion is smudged, torn, or obscured, the scanner reconstructs the original information mathematically. This is why a QR code on a weathered poster or a coffee-stained card still scans. It also explains why placing a logo in the centre works — as long as the logo covers under 25% of the total code area.
✅ Logo tip: To add a logo to your QR code, use Level H error correction (30% recovery). Keep the logo under 25% of the total code area and always test-scan after adding it.
How to Scan a QR Code
No app needed. Since iOS 11 (2017) and Android 9 (2018), QR scanning is built directly into the default camera app on every modern smartphone.
On iPhone
- Open the Camera app
- Point at the QR code — no need to press anything
- A notification banner appears showing the destination URL
- Tap the banner to open the link
On Android
- Open the Camera app
- Point at the QR code and hold steady
- A pop-up appears with the link
- Tap to open, or long-press for options like "Copy link"
⚠️ Always preview the URL before tapping. Both iPhone and Android show you the destination URL before you open it. Read it carefully — the domain should match the brand or location you expect. This is your primary defence against QR phishing.
How to Create a QR Code for Free
Creating a QR code takes under 30 seconds. No signup or payment needed.
- Go to a free QR code generator — ToolLoom's works instantly in your browser
- Choose your content type: URL, plain text, or WiFi credentials
- Enter your content and set the size
- Generate and download as PNG
- Always test-scan before printing — on both iPhone and Android
Create a Free QR Code Right Now
ToolLoom's QR code generator works instantly in your browser. URL, text, or WiFi — no signup, no limits, download as PNG.
📱 Open QR Code Generator →Static vs Dynamic QR Codes
This is the most important decision when creating a QR code for business use. Getting it wrong is expensive — especially after a large print run.
- Content encoded permanently
- Cannot be edited after creation
- No scan analytics
- Works forever, no subscription
- Completely free
- Best for: personal use, fixed URLs, WiFi, one-time projects
- Encodes a redirect URL
- Destination editable anytime
- Full scan analytics
- Requires paid subscription
- Best for: marketing campaigns, product packaging, large print runs
⚠️ Critical: If you print thousands of labels with a static QR code and your URL later changes, every printed code is permanently broken. For large or long-term print runs, use a dynamic QR code service like Bitly or Uniqode.
What QR Codes Are Used For in 2026
Restaurants (42% of all scans) — Over 52% of US restaurants use QR codes for menus, ordering, and payment. They eliminate printing costs and enable real-time menu updates.
Retail (28% of all scans) — Product packaging QR codes link to instructional videos, warranty registration, and sustainability data. The EU's Digital Product Passport regulation launching in 2026 requires QR codes on certain product categories.
Payments — Over 9 million merchants in India accept QR payments via UPI. Japan's QR payment market is projected to reach 19.76 trillion yen by 2026. In China, 81% of consumers use QR codes more actively than ever.
WiFi sharing — A WiFi QR code lets guests connect instantly by scanning — no password typing. Ideal for cafés, offices, hotels, and Airbnb hosts.
Marketing — QR codes on print ads, posters, and direct mail turn passive audiences into measurable digital engagements, giving print the trackability of digital advertising.
Authentication — Dynamic QR codes with expiry times are used for two-factor authentication, time-limited access passes, and anti-counterfeiting on luxury goods.
QR Code Safety: Avoiding Scams in 2026
The growth of QR codes has made them a major target for cybercriminals. The attack is called quishing — QR code phishing — and it surged fivefold in late 2025. By 2026, QR codes account for 12% of all phishing attacks globally.
How quishing works
Attackers place fake QR stickers over legitimate codes in public spaces — parking meters, restaurant tables, charging stations, and event signs. Scanning the fake code redirects to a phishing site designed to steal credentials or payment details.
How to protect yourself
- Preview the URL before tapping — read the domain carefully.
paypal-secure.ruis not PayPal. - Check for stickers over original codes — if a QR code looks placed over another, do not scan it.
- Be sceptical of QR codes in unexpected emails — this is now a primary phishing delivery method.
- Verify the domain matches the location — a restaurant's QR menu should go to that restaurant's actual domain.
🚨 Real 2026 scam: Fake parking meter QR codes are widespread in major cities. Attackers place stickers on parking machines redirecting to fake payment sites. Always verify the domain before entering card details after scanning a code on a parking meter.
Printing Tips for Reliable Scanning
- Business cards (scanned at 10–15 cm): minimum 2 × 2 cm
- Flyers (scanned at 30 cm): minimum 3 × 3 cm
- Posters (scanned at 1 metre): minimum 8 × 8 cm
- Outdoor signage (scanned at 2+ metres): minimum 20 × 20 cm
- Dark modules on white background outperform coloured variants by 35%
- Never invert colours — most scanners will fail to read it
- Keep the quiet zone (white border) intact
- Always test-scan at the actual print size before mass printing
Ready to Create Your QR Code?
ToolLoom's free generator creates QR codes for URLs, text, and WiFi. Download as PNG, use anywhere — no account needed.
⚡ Create a Free QR Code →