How do QR codes encode data?
As a two-dimensional pattern of black and white squares read as binary, with substantial built-in error correction — which is why a code still scans when damaged, partially covered or printed over a logo.
The structure, which explains the appearance:
Finder patterns — the three large squares in the corners — let a scanner locate the code and determine its orientation and rotation instantly, which is why a QR code can be read upside down or at an angle.
Alignment patterns, smaller squares that correct for distortion when the code is on a curved or angled surface.
Timing patterns, the alternating lines between finders, establishing the grid size.
Format and version information, encoding the error correction level and the code's size.
The data region, the rest, holding the encoded content plus error correction bits.
Error correction is the clever part. Reed-Solomon coding adds redundancy at one of four levels, the highest allowing roughly 30% of the code to be destroyed and still read correctly. This is why logos can be placed in the centre — the designer is deliberately spending error correction capacity.
Capacity. Up to several thousand characters, depending on version and encoding mode — numeric, alphanumeric, byte or Kanji. Shorter content produces a simpler, more reliably scannable code, which is why link shorteners are commonly used.
The security problem. A QR code is unreadable by humans, so you cannot see the destination before scanning. This has produced a genuine attack category — malicious codes stickered over legitimate ones on parking meters, restaurant tables and payment terminals, leading to phishing or fraudulent payment pages.
What to do: check the URL your camera previews before opening it; be suspicious of codes that appear to be stickers over something else; never scan a code in unsolicited post or email demanding payment; and treat a code requesting login credentials as you would any unexpected link.
They are a public specification, free to generate, which is exactly why they spread — and why nobody controls what is put into one.