October 10, 2026 Security

How QR Codes Work: Error Correction Levels, Data Capacity, and Security Risks in 2026

By FastUtilz Security Team

Quick Response (QR) codes have become ubiquitous across payments, restaurant menus, two-factor authentication (TOTP/2FA), Wi-Fi logins, and logistics. Invented in 1994 by Masahiro Hara of Denso Wave to track automotive components, the 2D matrix barcode is capable of holding hundreds of times more data than a standard linear UPC barcode.

Yet, most developers and consumers view QR codes as black boxes: How does a QR code remain scan-able even when 30% of it is covered by a company logo or scratched? What are the hard data limits? And why has QR code phishing (“Quishing”) become one of the fastest-growing cybersecurity vectors?

In this guide, we dive into the mathematics of QR code error correction, data density formulas, and essential security precautions.

1. The Anatomy of a QR Code

A QR code is not just a random grid of black and white squares (termed modules). It contains standardized geometric zones:

+-----------------------+
| [###]           [###] |  <- Finder Patterns (Top-Left & Top-Right)
| [# #]           [# #] |
| [###]           [###] |
|                       |
|   ... Timing ...      |  <- Timing Patterns (Alternating modules for coordinate grid)
|                       |
| [###]                 |  <- Finder Pattern (Bottom-Left)
| [# #]     [Data &     |
| [###]     Parity]     |  <- Alignment Patterns & Encoded Data Payload
+-----------------------+
  1. Finder Patterns (Three Big Squares): Located at the top-left, top-right, and bottom-left corners. Their ratio of black-white-black rings (1:1:3:1:1) allows scanner cameras to detect orientation at any 360-degree angle.
  2. Timing Patterns: Alternating black and white dots running horizontally and vertically between the finder patterns, defining the grid size.
  3. Alignment Patterns: Smaller concentric squares inside larger versions (Version 2 and up) that correct for perspective skew when scanned on curved surfaces like cups or cans.
  4. Format Information: Encodes the mask pattern and the Error Correction Level.

2. Reed-Solomon Error Correction Levels (L, M, Q, H)

The defining genius of QR codes is the implementation of Reed-Solomon error correction—the same mathematical algorithm used in NASA deep-space transmissions, satellite communication, and audio CDs.

When generating a QR code, you can select one of four error correction levels depending on your operating environment:

LevelCodeError Correction RecoveryBest Use Case
Level LLow~7% of codewords can be restoredHigh-density data on clean, crisp digital screens.
Level MMedium (Default)~15% of codewords can be restoredGeneral purpose marketing materials, receipts.
Level QQuartile~25% of codewords can be restoredIndustrial factory floors, logistics boxes prone to smudges.
Level HHigh~30% of codewords can be restoredCustom branded codes with logos placed in the center.

The Logo Embedding Trick

Have you ever wondered how brands put their logo in the center of a QR code without breaking it? They generate the QR code with Level H (High - 30%) error correction, and simply paint over the middle 20% with an image. The scanner camera literally reads the logo as “damage or dirt,” and Reed-Solomon polynomial math mathematically reconstructs the missing bits!

3. Data Capacity: How Much Can a QR Code Store?

QR codes range from Version 1 ($21 \times 21$ modules) up to Version 40 ($177 \times 177$ modules).

The maximum possible storage capacity of a Version 40 QR code at Level L error correction is:

  • Numeric only (0–9): Up to 7,089 characters
  • Alphanumeric (0–9, A–Z, punctuation): Up to 4,296 characters
  • Binary / Byte (UTF-8 strings, URLs, raw data): Up to 2,953 bytes
  • Kanji: Up to 1,817 characters

Pro Tip for URLs:

Never put a 250-character tracking URL directly into a QR code if you want it to scan quickly from across the room. More characters create smaller, denser modules that cheap phone cameras fail to focus on in low light. Keep URLs short, or use clean vanity links.

4. The Threat of “Quishing” (QR Phishing)

Unlike human-readable URLs (https://paypal.com), human eyes cannot decode binary matrix pixels. You cannot visually verify whether a QR code directs you to a legitimate portal or a credential harvester.

Cybercriminals exploit this blind spot through Quishing:

  1. Physical Sticker Replacement: Sticking fraudulent QR code decals over parking meters, electric vehicle charging stations, or restaurant payment kiosks.
  2. Bypassing Corporate Email Filters: Secure Email Gateways (SEGs) scan inbound emails for malicious hyperlinks. When attackers attach a PNG of a QR code containing the link, legacy email filters often fail to parse the image, allowing the phishing attack straight into the employee inbox.

Golden Rules for QR Code Security:

  • Never scan public payment codes that look like physical stickers pasted over existing signs.
  • Inspect the camera preview URL before clicking through on your smartphone.
  • Use client-side generator tools that generate QR codes inside your browser without logging your target URLs on third-party tracking servers.

Conclusion

Understanding error correction levels allows you to balance scan reliability with custom styling and logos.

Need to create a high-resolution, custom QR code for a URL, Wi-Fi network, or business contact? Use our free, private QR Code Generator on FastUtilz. It generates vector-quality QR codes 100% locally in your web browser with zero server tracking.