QR Codes: How They Survived From 1994 to Pandemic-Era Ubiquity

QR codes had a long, slow rise to ubiquity. They were invented in 1994 by Denso Wave, a subsidiary of Toyota, specifically to track auto parts on assembly lines. For about 25 years they lived in industrial settings, occasional marketing campaigns, and Japanese phone apps - never really catching on in the West. Then 2020 happened, restaurants needed contactless menus, and within six months QR codes went from curiosity to universal.

If you have a phone made in the last five years, the camera app recognizes QR codes by default and offers to open whatever URL they contain. This works so well that QR codes are now the default way to share short pieces of information across the physical-digital boundary: Wi-Fi credentials, payment details, contact info, event tickets, restaurant menus, building check-in. Making your own takes a few seconds; understanding the trade-offs takes a bit more.

How a QR code works, briefly

A QR code is a 2D barcode that encodes binary data as a grid of black and white squares. The "QR" stands for "Quick Response" - the design goal was a barcode that could be scanned at high speed from any angle, unlike traditional 1D barcodes that need to be roughly aligned with the scanner.

The three large squares in the corners are "position markers" that let the scanner identify the code's orientation. The smaller alignment marker (in larger codes) helps with skew correction. The rest of the squares are data plus error-correction bytes.

The interesting bit is the error correction. QR codes use Reed-Solomon coding, which is the same family of error correction used in CDs and DVDs. Each code has redundant data that allows the scanner to recover the original message even if part of the code is damaged, smudged, or covered.

The four error correction levels

QR codes support four levels of error correction:

L (Low): 7% recovery. The code can lose up to 7% of its area and still be readable. Smallest code size for a given data length.
M (Medium): 15% recovery. The default for most uses.
Q (Quartile): 25% recovery. Good for printed materials that might get smudged.
H (High): 30% recovery. Maximum redundancy. Often used when a logo is overlaid in the center of the code.

Higher correction levels make the code denser (more squares for the same data) but more resilient to damage. For purely digital use (a QR code displayed on a screen), L or M is plenty. For print, M or Q. For print where the code might get damaged or covered with a logo, H.

The logo-overlay trick

You have seen QR codes with a logo in the middle - a company icon, a brand mark, an Instagram logo. This works because of the error correction. The logo covers some percentage of the data area; the error correction recovers the lost bytes.

The trick is to use error correction level H (30%) and keep the logo to under 25% of the code area. Beyond that, the error correction cannot recover enough to make the code reliably scannable. There are tools that calculate the exact safe size of a logo overlay; for casual use, "keep it small relative to the whole code" is the right heuristic.

Sizes for print

QR codes have a minimum readable size, determined by the phone camera's resolution and the viewing distance. The rule of thumb: the QR code's side should be at least 1/10 of the expected scanning distance.

Practical sizes:

Table tent at a restaurant (scanned from arm's length, ~60 cm): 2.5 cm side minimum, 4 cm comfortable.
Poster at standing distance (~1.5 m): 15 cm side minimum.
Billboard at driving distance (~30 m): 3 m side minimum (and at that point you probably want a URL instead, because nobody scans a billboard).
Business card: 2 cm side. Just barely readable; bigger is better if you have the space.

The Toolium QR Code Generator produces codes at 512x512 pixels by default, which prints cleanly at any of these sizes when scaled.

What to put in a QR code

The most common content types:

URLs. The default for marketing materials. Keep them short - a long URL produces a denser code that is harder to scan.
Plain text. Messages, instructions, serial numbers.
Wi-Fi credentials. Format: WIFI:T:WPA;S:NetworkName;P:Password;;. Phones that scan this offer to join the network directly.
vCard contact info. A multi-line vCard format with name, phone, email. Scanning it adds the contact to the phone's address book.
Phone number. Format: tel:+15551234567. Scanning opens the phone dialer.
Email. Format: mailto:user@example.com. Scanning opens the email composer.

The dynamic-vs-static distinction

A "static" QR code encodes the data directly. The URL is embedded in the code; scanning takes you to that URL. If you ever want to change the destination, you have to print a new code.

A "dynamic" QR code encodes a short URL that redirects to the actual destination. The redirect target can be changed without reprinting the code. Dynamic codes are usually a paid service (since the operator has to host the redirect indefinitely).

For most personal use, static codes are fine and free. For marketing campaigns where the destination might change, dynamic codes are worth the cost.

QR code privacy

QR codes themselves are not tracking devices. They are just images. But many published QR codes encode URLs with unique IDs that the destination site uses to track scans. If a restaurant menu has a QR code, scanning it likely tells the restaurant (and possibly their analytics provider) that someone scanned that specific code at that specific table.

This is a feature, not a bug, from the restaurant's perspective. From the customer's, it is the same kind of tracking that happens when you click any URL.

The Toolium QR code generator does not include any tracking - the codes it produces encode exactly the content you provide, with no Toolium-specific identifiers. The generation runs in your browser; nothing is logged.