Making QR Codes That Always Scan: Error Correction Levels, Payload Formats and Print Rules
A practical guide to QR codes: their structure, versions and capacity, error correction levels L/M/Q/H, Wi-Fi and vCard formats, and design rules for codes that scan reliably on screen and in print.
QR codes are everywhere: restaurant menus, payment terminals, event tickets, Wi-Fi stickers, product packaging. Generating one takes a second, but making one that scans reliably on every phone, in bad lighting and on a printed flyer is a different story. This article explains how a QR code works internally and turns that knowledge into practical rules.
A short history
The QR code ("Quick Response") was invented in 1994 by Denso Wave, a Toyota group company, to track automotive parts faster than classic barcodes allowed. It became an international standard (ISO/IEC 18004) and exploded in popularity once smartphone cameras could read it natively, without a separate app.
Anatomy of a QR code
A QR code is a grid of black and white squares called modules. Some of them have fixed jobs:
- Finder patterns: the three large squares in the corners. They let a scanner find the code and work out its rotation.
- Alignment patterns: smaller squares (from version 2 upward) that help correct distortion when the code is photographed at an angle or printed on a curved surface.
- Timing patterns: alternating lines between the finder patterns that tell the scanner the size of one module.
- Format and version information: small areas that store the error correction level, the mask pattern and, for large codes, the version.
- Quiet zone: the empty margin around the code. The standard asks for 4 modules on every side.
Everything else holds your data plus error correction codewords.
Versions and capacity
QR codes come in 40 versions. Version 1 is 21 × 21 modules, and every version adds 4 modules per side, up to 177 × 177 for version 40. The more data you encode, the higher the version and the smaller each module becomes at the same printed size.
The maximum capacity (version 40 with the lowest error correction) is:
| Mode | Maximum characters |
|---|---|
| Numeric (0-9) | 7,089 |
| Alphanumeric (0-9, A-Z, space, $ % * + - . / :) | 4,296 |
| Bytes (UTF-8 text, URLs) | 2,953 |
| Kanji | 1,817 |
In practice you should stay far below these limits. A short URL produces a version 2-4 code that scans instantly; a long URL with tracking parameters can easily push it to version 8 or higher, which is much harder to read from a distance.
Error correction: L, M, Q and H
QR codes use Reed-Solomon error correction, the same family of algorithms used on CDs and in deep-space communication. Part of the code is redundant data that lets a scanner rebuild what is missing when the code is dirty, scratched or partially covered.
| Level | Approximate damage it can recover | Typical use |
|---|---|---|
| L | ~7% | Clean digital screens, maximum data |
| M | ~15% | Good default for most codes |
| Q | ~25% | Printed material, outdoor use |
| H | ~30% | Codes with a logo, harsh environments |
Higher levels are not free: more redundancy means more modules, so the same content needs a larger version. M is a good balance for most cases. Choose H if you put a logo in the middle, because the logo literally destroys part of the data and error correction has to fill the gap. Our QR Code Generator switches to level H automatically when you upload a logo.
Masking
You may notice that two codes with almost the same content look completely different. Before finalizing a code, the encoder tries 8 mask patterns that flip modules in a regular way and picks the one that avoids large solid areas and patterns that look like finder squares. This makes the code easier for cameras to read.
What you can put inside a QR code
A QR code only stores text. Phones decide what to do based on the format of that text:
| Content | Payload example |
|---|---|
| Website | https://nicetool.dev |
| Phone call | tel:+84901234567 |
mailto:[email protected]?subject=Hi |
|
| SMS | SMSTO:+84901234567:Hello |
| Wi-Fi | WIFI:T:WPA;S:MyNetwork;P:secret123;; |
| Contact card | vCard (BEGIN:VCARD ... END:VCARD) |
Wi-Fi QR codes
The Wi-Fi format is very handy for offices, cafes and guest rooms:
WIFI:T:WPA;S:Cafe Guest;P:coffee2026;;
Tis the security type:WPA(also used for WPA2/WPA3),WEPornopass.Sis the network name (SSID) andPthe password.- Add
H:trueif the network is hidden. - Special characters
\ ; , : "inside the name or password must be escaped with a backslash.
Both iOS and Android can join the network directly from the camera app, with no typing.
vCard contact codes
A vCard QR code lets people save your name, phone, email, company and website in one scan. Keep it short: every extra field increases the version and density of the code.
Design rules for codes that always scan
- Keep strong contrast. Dark modules on a light background work everywhere. Light-on-dark ("inverted") codes and low-contrast brand colors fail on some scanners.
- Respect the quiet zone. Leave at least 4 modules of empty space around the code. Placing it right against an image or text is one of the most common reasons scans fail.
- Size it for the distance. A rough rule is a code width of about 1/10 of the scanning distance: 2-3 cm on a business card, 10 cm on a poster read from 1 meter, much larger on a billboard.
- Shorten the content. Use a short URL without unnecessary parameters. Fewer characters mean bigger modules and faster scans.
- Use the right file format. Use SVG for print, because it scales without blurring. Use PNG for websites and documents.
- Logos: small and centered, with level H. Keep the logo under roughly 20% of the code area and never cover the finder patterns.
- Test before printing. Scan with at least two different phones (iOS and Android), in normal and dim light, from the real distance.
Static vs dynamic QR codes
- A static QR code contains the final data directly, for example your URL. It works forever, needs no service and cannot be changed after printing.
- A dynamic QR code contains a short redirect link managed by a third-party service. You can change the destination and see scan statistics, but the code stops working if the service shuts down or you stop paying.
For most personal and small-business use, a static code pointing to a URL you control is the safest choice: if the content moves, you update the redirect on your own website, not the printed code.
Security: watch out for "quishing"
Because people cannot read a QR code with their eyes, attackers stick fake codes over real ones on parking meters, posters and payment stands to send victims to phishing pages ("QR phishing" or quishing).
- As a user, check the URL preview before opening it, and be careful with codes that ask you to log in or pay.
- As a publisher, prefer your own domain over unknown short-link services, and check printed codes in public places regularly.
Conclusion
A reliable QR code comes down to a few principles: short content, the right error correction level, high contrast, a clear quiet zone and real-world testing. With these in mind you can create codes that work on every phone, from a tiny business card to a large poster.
You can try everything from this article with our free QR Code Generator: URLs, Wi-Fi, vCard, email, phone and SMS, error correction levels, custom colors and logos, and PNG or SVG export. Everything is generated locally in your browser.
Written by
Nguyễn Thành Nam
Full-Stack Engineer · Backend & Platform
Full-stack engineer with 9+ years of experience building high-traffic APIs and platforms with Go, NestJS, PHP (Laravel, Phalcon) and Node.js. Specializes in GraphQL API design, real-time systems and performance optimization, and builds NICETOOL.dev for the developer community.