1. Introduction

In this tutorial, we’ll look at QR codes, also known as Quick Response codes. We’ll be looking into how they work and a tiny part of how to decode them.

2. What Is a QR Code?

QR Codes are similar in concept to barcodes, only working in two dimensions instead of only one. Where barcodes are a series of dark and light bars of varying widths, QR codes are instead a grid of dark and light dots.

Because of how QR codes work, we need a more sophisticated means to read them. We can no longer rely on simply reading a straight line of bars to decode them and instead need to read the entire 2D grid. This means we need something with a real camera instead of just a scanning laser. However, modern technology means these cameras are ubiquitous – smartphones, for example, have helped ensure that many people have this ability in their pockets.

So, what can we do with them? The potential capacity and reliability of QR codes allow for many uses. As with traditional barcodes, we can use them for product codes and representing simple pieces of information. But we can do so much more as well. For example, using them to represent URLs is very common, which gives an extensive range of uses. We can also use them to share configuration settings – e.g., connecting to WiFi networks.

3. QR Code Capacity

QR codes support several different sizes, also known as versions. The largest supported QR code is version 40, which is (40 * 4) + 17 = 177 dots on each side. The number of dots on each side of the QR code is (version  * 4) + 17. So the most minor supported QR code is (1 * 4) + 17 = 21 dots on each side.

We also have support for error correction built into the encoded QR code. This allows for some of the code to be unreadable but for the entire code to still work. We have four different levels of error correction that can be supported:

Error Correction Level

Error Correction Capabilities

Low (L)

7% of data bytes can be restored

Medium (M)

15% of data bytes can be restored

Quartile (Q)

25% of data bytes can be restored

High (H)

30% of data bytes can be restored

Depending on our grid size, the data format they’re using, and error correction details, we can feasibly store up to 7,089 characters in a single QR code. For example, in a 177 x 177 grid, using the lowest possible error correction, we can store the following:

Data Format

Number of Characters

Data Format

Number of Characters

Numeric

7,089

Selected Alphanumeric

4,296

ISO/IEC 8859-1

2,953

Shift JIS X 0208

1,817

4. Decoding QR Codes

Let’s have a look at how to decode a QR code. We won’t go into all the details – the error correction processing is very involved. But we’ll see enough to be able to understand how it all fits together:

QR code

4.1. Orientation, Timing and Version

The first thing we need to do is orient the QR code correctly. Three of the four corners have timing patterns – a 7 x 7 square of dark dots with a smaller square inside it and a light border around them. The corner without one of these should be the bottom right. Then we have some regularly spaced dots joining these, which allows the reader to know how big our dots are.

There’s also an alignment pattern towards the bottom right corner, allowing the reader to detect any distortion in the code. On larger QR codes, there may be a number of these alignment patterns located in various places on the code:

alignment patterns

Next, we need to know what version QR code we’re looking at. For this, we need to count the number of dots across and reverse what we saw earlier. In this case, we have a 25 x 25 QR code. From this, we can get the version using (dots - 17) / 4 = 2. So now we know we have a version 2 QR code.

Larger QR codes – version 7 and above, so at least 45 dots across – will have additional sections with the version number encoded in it, again to allow for redundancy if the code is damaged.

4.2. Format Information

After this, we need to determine the format information. This will tell us the error correction level and a mask pattern that the underlying data is combined with. This mask is to help break up solid areas so they don’t get confused with any of the unique patterns in the QR code. This information is contained in the dots around the top-left corner. The same data is then repeated adjacent to the top-right corner and bottom-left corner in case the top-right corner isn’t viable:

format information

From this, the blue dots are our error correction level, the green dots are our mask, and the red dots are used as error correction for the format data. We’ll ignore the error correction details here, but the other two we can use as lookups to see precisely what’s going on.

The error correction level gives us one of 4 values:

Pattern

Error Correction Level

Dark, Dark

Low (L)

Dark, Light

Medium (M)

Light, Dark

Quartile (Q)

Light, Light

High (H)

In this case, our dots are both dark. This means the error correction level for the QR code is set to Low.

The mask pattern can be looked up similarly. This gives us details of a masking formula, expressed in terms of the coordinates of the dots in the QR code, to determine which dots are masked:

Pattern

Mask Formula

Dark, Dark, Dark

x mod 3 = 0

Dark, Dark, Light

(x + y) mod 3 = 0

Dark, Light, Dark

(x + y) mod 2 = 0

Dark, Light, Light

y mod 2 = 0

Light, Dark, Dark

((xy mod 3) + xy) mod 2 = 0

Light, Dark, Light

((xy mod 3) + x + y) mod 2 = 0

Light, Light, Dark

(x/2 + y/3) mod 2 = 0

Light, Light, Light

(xy mod 2) + (xy mod 3) = 0

Every dot in our masked QR code will be inverted, whereas all the other dots in the QR code will be left alone.

Our mask pattern was described by three dark dots, which means that we’ll be using x mod 3 = 0. This means that every third column will be masked – 0, 3, 6, 9, etc. This, in turn, means that when we’re decoding our data, we need to invert any dots on every third column.

4.3. Data Encoding and Length

Now that we have all of the QR code control sequences, we can start looking at the actual data. A QR code will comprise several data sections – at least 1, but potentially many. Each of these will begin with a particular sequence that tells us the encoding of that section. We start in the bottom right corner and work our way through the dots in the code in a particular sequence:

section encoding

Remember that these are masked, and our mask formula was x mod 3 = 0. This means that the very last column needs to be inverted since it corresponds with our mask:

inverted

We’ve also indicated here the order to read the dots so that we can decode them. So our encoding decodes to Light, Dark, Light, Light. We can then look this up to see what this means:

Pattern

Mask Formula

Light, Light, Light, Dark

Numeric

Light, Light, Dark, Light

Alphanumeric

Light, Dark, Light, Light

Byte encoding

Dark, Light, Light, Light

Kanji encoding

Light, Light, Dark, Dark

Structured append

Light, Dark, Dark, Dark

ECI

Light, Dark, Light, Dark

FNC1 in first position

Dark, Light, Light, Dark

FNC1 in second position

Light, Light, Light, Light

End of message

So we can see that our QR code is encoded as “Byte encoding”.

Next, we need to know the length of this data block. We work this out by taking several dots, defined by the encoding type and the QR code version, and treating that as a binary number:

Encoding

Versions 1-9

Versions 10-26

Versions 27-40

Numeric

10

12

14

Alphanumeric

9

11

13

Byte

8

16

16

Kanji

8

10

12

So, because we have a version 2 QR code and a byte encoding, we have 8 bits for our length. Again, these are masked, so we need to take that into account when understanding them:

2 QR code

This gives us a value of 00010111, or 23 characters.

4.4. Encoded Data

Now we’re at the point of actually decoding the data. The number of bits that we need for each character depends on our encoding but not on our version, so this is a straight lookup:

Encoding

Number of Bits

Numeric

10 bits per 3 digits

Alphanumeric

11 bits per 2 characters

Byte

8 bits per character

Kanji

13 bits per character

So in our case, it’s a straight 8 bits per character. We then follow a snake pattern starting from the end of the length block:

snake pattern

The red dots in this aren’t part of the data and are highlighted to exclude them. Our data are the dots surrounded in blue borders and numbered in the order they need to be read. All of the other dots are outside of this data section. Most of them are used for error correction, but in larger QR codes, they may be additional data sections.

Understanding each block depends on the direction that we’re reading in, as follows:

data sections

This equates to reading all of the dots in two concurrent columns, reading those columns from right to left and moving in the direction we’re going. This is important when we get to areas that don’t quite fit the patterns, as we’ll see soon.

We must also remember to apply our mask to the dots as we decode them. So, for example, after we’ve applied the mask and determined which bit is which, the first block is:

first block

This is then 01101000, which is byte 0x68. This is the ASCII code for “h”, so we now know the first character is an “h”. Following this same process, the next few blocks are “t”, “t”, “p”, “:”, “/” and “/”.

Then we get to an interesting case. Block 8 is split into two parts by the alignment pattern. However, we skip over this and keep reading:

Block 8

Reading this gives us 01110111, which is byte 0x77. This is the ASCII code for “w”, which we can take as the next character.

The next exciting block is number 10. This one changes direction in the middle of the block, but we can follow it around as it does this. After unmasking it and following it around, we get the following:

Block 10

Reading this gives us 01110111 again, which is byte 0x77. This is the ASCII code for “w”, which we can take as the next character.

If we continue decoding the blocks, we’ll eventually get the complete message – “http://www.baeldung.com”.

After this, we would start a new data section. If we continue decoding this, we’ll find the encoding type is “End of message”, which tells us that we’ve now decoded all of the data from the QR code.

5. Security Concerns

Because a QR code can contain configuration settings or arbitrary URLs, this opens them up as a potential security concern. We should be cautious about exactly what codes we scan and what we scan them with.

For example, malicious actors can plant QR codes in public places – billboards, shopping centres, etc. – that will take unsuspecting users to a malicious site. Or to connect their phone to an adversarial WiFi network whereby the attacker can capture everything the compromised phone is doing.

However, this doesn’t mean we should never use or trust them. It just means that we need to be careful. For example, in the same way that we wouldn’t open a suspicious URL sent to us in an email, we shouldn’t unthinkingly open a URL that we scanned from a public QR code.

6. Conclusion

Here we’ve looked at what a QR code is, how they’re composed and how to decode the data from them. Next time you need to represent some information, why not investigate if using a QR code might help?