How QR codes work, and how to scan them safely

A barcode in two directions

A traditional barcode on a cereal box stores a number in a single row of lines. A QR code ("quick response" code) stores information in both directions, across and down, as a grid of small squares. That lets it hold much more: a web address, a Wi-Fi password, contact details or a short piece of text.

Think of each square as a tiny light that is either on (black) or off (white). Put enough of them together and they spell out letters and numbers, just as bits do inside a computer.

How your phone reads one

1. The three big squares in the corners tell the camera which way up the code is and how large it is.
2. Smaller patterns help the phone straighten the image, even if you hold it at an angle.
3. The phone reads the pattern of squares and turns it back into text.
4. Extra information built into the code lets it be read even if part of it is dirty or torn. This is called error correction, and it is why some codes have a logo in the middle.
5. The phone shows you what the code contains, such as a link, and asks what you want to do.

Where QR codes are useful

• Restaurant menus, event tickets and boarding passes.
• Joining a Wi-Fi network without typing the password.
• Setting up an authenticator app for 2-step verification.
• Paying in shops, especially in countries where QR payments are common.

The risk: you cannot read a QR code yourself

With a normal link you can at least see the address. With a QR code you cannot tell where it leads until you scan it. Criminals take advantage of this, a trick sometimes called "quishing" (QR phishing):

• Stickers on parking meters and charging points leading to fake payment pages.
• Codes in emails or letters claiming you must "verify your account" or pay a fine.
• Codes on posters or parcels offering prizes or deliveries.

How to scan safely

1. Look at the code itself. Is it a sticker on top of something else? Does it look tampered with? If so, do not use it.
2. Read the link your phone shows before opening it. Check the real website name, as explained in What is a domain name?
3. Prefer the official app. For parking or charging, use the operator's own app or website, typed in yourself, rather than a code on the machine.
4. Never enter passwords or card details on a page you reached from an unexpected QR code.
5. Be wary of codes that want to install an app or change settings.

Tip: Your phone's own camera app is fine for scanning. You do not need a separate QR scanner app, and some free ones are full of adverts.

Want to see the trick in action? Our article Scam alerts: how to spot them includes fake parking codes.