QR codes: making one, and checking one before you scan

A QR code is a barcode that stores text — usually a URL, sometimes a phone number, a Wi-Fi password, a contact card or a payment string. Your phone reads one with the camera app, no scanner app required, and you can make one in about thirty seconds without installing anything.

Both halves of that are worth knowing properly. Making one badly produces a code that half the room cannot scan; scanning one carelessly is a genuinely effective way to end up somewhere you did not intend, because the code is unreadable to humans by design.

How do you make a QR code that actually scans?

The generator matters less than four decisions you make before using it.

• Keep the content short. A QR code encodes more data by adding more modules — the small squares — which makes each one smaller and harder for a camera to resolve. A 40-character link produces a sparse, robust code; a 300-character link with tracking parameters produces a dense one that fails at distance or in poor light. Shorten the URL first.

• Decide static or dynamic. A static code contains the destination itself and can never be changed. A dynamic code contains a redirect through a service, which means you can change where it points afterwards — and it stops working if that service disappears. For anything printed in volume, this is the decision to think about, not the colours.

• Give it quiet space and contrast. The blank margin around a code is part of the specification, not decoration; cameras use it to find the boundary. Dark on light, with real contrast — inverted codes fail on many readers.

• Make it big enough for its distance. The working rule is roughly a tenth of the scanning distance: a code read from two metres wants about 20 cm across. Codes on posters fail most often for this reason alone.

A QR code has no human-readable layer. Whatever it points to, the user finds out after arriving.

Error correction is the one setting worth understanding. Higher levels let a damaged or partly obscured code still resolve — useful if a logo sits in the middle or the code will be printed on something that scuffs — at the cost of a denser pattern. For a sticker on a window, higher is right; for a code in a clean digital document, the default is fine.

What else a code can carry

Not everything needs to be a link, and the non-URL types are underused.

The Wi-Fi one is worth adopting for a guest network: a printed code that joins the network without anyone reading a password aloud. It also encodes the password in plain text inside the code, so it belongs on a wall you control rather than anywhere it can be photographed and taken away.

The same mechanism is how device pairing works in tools like loopStream: a scan carries the connection details directly, which is faster and less error-prone than typing a code, and it stays entirely on the local network.

Where should a printed code actually go?

Placement decides whether a code is used at all, and it is the part that gets settled last and worst — usually by whoever is laying out the page rather than by anyone thinking about the scan.

Three constraints govern it:

• Within arm's reach, or sized for the distance it is actually at. A code at the top of a shop window is scanned from three metres away, whichever size looked balanced in the design. Measure the real distance and size from that.
• Not in a fold, a curve or a gutter. Codes across the spine of a booklet, around a bottle or on a folded flyer distort enough to fail. Flat surfaces only.
• Where a phone can physically be held up. A code beside a till with a queue behind it, or low on a wall behind furniture, is technically scannable and practically not.

There is also a labelling point that costs one line and changes the response rate: say what the code does. "Scan to see the menu" is acted on far more than a bare square, because a code with no explanation asks the reader to take an action with an unknown outcome — which is precisely the objection the safety half of this article is about.

For anything printed at volume, add a short human-readable URL underneath. It costs a line of type and it rescues every scan that fails: a cracked screen, an old phone, a camera that will not focus, a person who would simply rather type. It also lets someone verify that the code and the printed address agree, which is the simplest possible defence against a sticker placed over the original.

Checking one before you scan

This is where the risk sits, and it is a real one — a printed code can be covered with a sticker of a different code, and nothing about the surface looks wrong.

Four habits, in order of how much they help.

1. Read the preview before opening. Both iOS and Android show the destination as a banner rather than opening it immediately. Read it. This single pause defeats most misuse, and it is the step that gets skipped because the banner appears where you are already about to tap.
2. Check the domain right to left. The real domain is the last two parts before the first single slash. paypal.secure-billing.co/pay belongs to secure-billing.co.
3. Be suspicious of a shortened link in a physical place. A poster has room for a full domain. A shortener on a printed code hides the destination for no legitimate reason.
4. Look at the sticker itself. A code stuck over another code, a sticker on a parking meter, a fresh label on a restaurant table — physical tampering is the delivery mechanism, and it is visible if you look.

The parking meter and restaurant table are not hypothetical categories. Payment-related codes in public places are the common case precisely because people expect to pay at them, and the expectation does the work.

Two rules that cover the rest: never enter payment details on a page you reached by scanning a code in a public place — navigate to the merchant yourself instead — and treat a code that leads to a login screen the same way. Reaching a sign-in page by scanning is how credentials are collected, and no legitimate flow requires that specific path.

Why did the code stop working?

Four causes, and only one of them is the code itself.

Too small for the distance. Covered above, and by far the most common.

Poor contrast or a busy background. A code printed over a photograph, or in a brand colour with insufficient contrast, is often unreadable to older cameras even when it looks fine to you.

Screen glare and curvature. A code on a glossy screen or a curved bottle needs more margin and a larger size than the same code on flat paper.

A broken destination. The code scans perfectly and the link 404s, which is not a QR problem at all — but it is the one that happens after printing, when it is expensive.

The fourth argues for a dynamic code on anything printed in quantity: the redirect can be repointed when the page inevitably moves, and it costs nothing to have that option.

Always test before printing: scan the final artwork at its final size, on two different phones, in ordinary indoor light. A test on your own desk under a lamp is not a test.

More on the surrounding tasks in guides, link inspection habits in online tools, and image preparation in image tools. The format itself is standardised as ISO/IEC 18004 if you want the specification.

The short version

To make a QR code: keep the content short, choose static or dynamic deliberately, keep real contrast and a clear margin, and size it at roughly a tenth of the scanning distance. Test the final artwork on two phones before printing.

To scan one safely: read the destination banner before opening, check the domain right to left, distrust shorteners on printed codes, and look at whether the sticker has been placed over something else — and never enter payment or login details on a page you arrived at by scanning in a public place.