What Happens When You Scan a QR Code, and How Does It Work?
How QR codes work: your camera finds three corner squares, reads the grid as data, fixes damage, then shows a link. A dynamic code adds a redirect.
Nookesh Karri · 7 min read 
When you scan a QR code, your phone’s camera finds the three big corner squares, reads the grid of black and white squares as data, repairs any damaged parts, and shows you what’s inside, usually a web link. That’s how QR codes work on the phone side. Nothing goes online until you tap that link. If the code is dynamic, the link first hits a redirect server, which logs the scan and sends your browser on to the real page.
What a QR code is made of
A QR code is a square grid of black and white modules that store data, plus a few fixed patterns that help a camera read it. The standard behind it is ISO/IEC 18004, maintained by DENSO WAVE, the company that created QR codes.
The parts you can see:
- Three corner squares (position patterns). They tell the scanner where the code is and which way up it sits. DENSO WAVE describes QR codes as readable from any direction in 360° for this reason.
- The data area. Each module is one bit: dark or light.
- The quiet zone. DENSO WAVE says a QR code “requires a four-module wide margin at all sides”. A border, a photo or text inside that margin is a common reason a code fails.
Codes come in sizes called versions. Version 1 is 21 x 21 modules and Version 40 is 177 x 177, with 4 more modules per side at each step. More data means a bigger grid.
How QR codes work when you scan one, step by step
The scan itself happens inside your phone.
- Find the code. The camera spots the three corner squares and uses them to work out position, size and angle.
- Straighten it. The software corrects for tilt and perspective, so a code on a poster you’re standing beside reads like one held flat.
- Read the modules. Each square becomes a 1 or a 0.
- Fix errors. Missing or smudged parts are rebuilt from the error correction data (more on that below).
- Decode the content. The bits become text: a URL, a Wi-Fi login, a contact card or plain text.
- Show you the result. On an iPhone, Apple’s instructions are to hold the device so the code appears, “then tap the link to open the content.”
Steps 1 to 6 don’t need the internet. Our post on whether QR codes work without internet explains which kinds of content work offline.
How error correction keeps damaged codes readable
Error correction is extra data added to the code so a scanner can rebuild parts it can’t read. DENSO WAVE says it works by adding a Reed-Solomon code, “a mathematical error correction method used for music CDs etc.”
There are four levels:
| Level | Codewords that can be restored |
|---|---|
| L | Approx. 7% |
| M | Approx. 15% |
| Q | Approx. 25% |
| H | Approx. 30% |
DENSO WAVE notes that “Level M (15%) is most frequently selected.” Higher levels make a code tougher, but they take space, so the grid grows. This is also why a logo in the middle can work: it covers modules the error correction can rebuild. Our guide to a logo in the middle of a QR code covers how far you can push that.
What happens after you tap the link
Once you tap, your phone’s browser makes a normal web request to the address in the code. What happens next depends on whether the code is static or dynamic.
Static code: the URL in the pattern is the final page, say a restaurant’s menu. The site sees a visitor, the same as if you’d typed the address.
Dynamic code: the pattern holds a short link that belongs to a QR service.
- Your browser requests the short link.
- The redirect server records the scan: time, rough location, device type.
- The server replies with a redirect. MDN explains that redirect responses have status codes starting with 3 and “a Location header holding the URL to redirect to.”
- Your browser follows that header to the real page.
You might see the extra hop flash in the address bar. It’s also why a dynamic code’s owner can change the destination after printing: they change what the server puts in that Location header. Our dynamic vs static QR code guide goes into when each makes sense.
What the scan reveals about you
Decoding a code shares nothing. Opening its link is a normal web visit, and with a dynamic code, the redirect service sees that visit first.
What a business can learn depends on the service. QRAnalytica, for example, records scans by country, city and device, anonymized and without cookies or storing personally identifiable information. It can’t tell the owner your name. Our post on whether you can see who scanned your QR code covers this from the owner’s side.
The limitation for owners: QRAnalytica’s dynamic codes run through QRAnalytica’s redirect servers. That’s what makes editing and scan counts possible, and it makes the redirect a single point of failure. If the service is down, the code doesn’t reach its page, even though the printed pattern is fine.
Where the risk sits when you scan
The risk in a QR code is the link it holds, not the scan. A pattern can’t run code. It hands your phone a destination, and the danger is opening a bad one.
The FTC’s December 2023 alert says: “If you see a QR code in an unexpected place, inspect the URL before you open it.” It also warns about scammers covering QR codes on parking meters with their own, and about codes in emails or texts you weren’t expecting.
My take: the preview step is the one habit worth building. Your phone shows the address before it opens anything. If a parking meter code shows a domain that isn’t the city or a payment company you recognise, close it and pay another way. If you make codes, our QR validator checks one for hijacked links before you print, and our guide on checking if a QR code is safe covers the scanning side.
FAQ
Does scanning a QR code send my data anywhere?
Reading the pattern happens in your phone’s camera app. Data only leaves the phone when you open what the code contains, such as a website. If the link goes through a redirect service, that service sees the request before the website does.
Why do QR codes have three big squares?
The three corner squares let the scanner find the code and work out which way up it is. That’s why a QR code can be read from any angle.
Can a QR code still work if part of it is damaged?
Yes, up to a point. QR codes carry Reed-Solomon error correction. At the highest level, Level H, approx. 30% of codewords can be restored.
How much information can a QR code hold?
DENSO WAVE lists a maximum of 7,089 numeric characters, 4,296 alphanumeric characters or 2,953 bytes of binary data. Most codes hold far less, usually a short web address.
What is the difference between a static and a dynamic QR code when you scan it?
A static code holds the final link, so the phone goes straight there. A dynamic code holds a short link to a redirect service, which records the scan and sends the phone on to the real page.
Sources
- What is a QR Code?, DENSO WAVE
- QR Code Standardization, DENSO WAVE
- Error correction feature, DENSO WAVE
- Information capacity and versions of QR Code, DENSO WAVE
- Point for determining the code area, DENSO WAVE
- Scan a QR code with your iPhone or iPad, Apple Support
- Redirections in HTTP, MDN
- Scammers hide harmful links in QR codes to steal your information, FTC