susQR Spot a QR? Check it right where you are.

What Is a QR Code?

How the little square works, why it's everywhere, and how it's used for good and for scams

Last updated: September 2026 · By the susQR team · 7 min read

Quick answer: A QR code ("Quick Response" code) is a square barcode that stores a small piece of information, usually a web address. Your phone's camera reads it in a fraction of a second, so you don't have to type anything. That convenience is why QR codes are on menus, tickets, and payment stands, and it's also why scammers use them: you can't tell where a QR code goes just by looking at it.

📋 In this guide

  1. How a QR code works
  2. What a QR code can hold
  3. Where QR codes came from
  4. Why they're everywhere
  5. The good: how QR codes help
  6. The bad: how scammers use them
  7. How to tell a good QR code from a bad one
  8. Questions

How a QR code works

A regular barcode is a single row of lines, read from left to right. A QR code is two-dimensional: information is stored in a grid of tiny black and white squares, called modules, read in both directions. That lets it hold far more, and a phone can read it from any angle, even upside down.

The black-and-white squares aren't random. Some are fixed landmarks that help your camera find and straighten the code; the rest carry the actual information. Here's a real one (it goes to susqr.com, so feel free to scan it):

A real QR code linking to susqr.com with its finder, timing, and alignment patterns and quiet zone highlighted
A real, scannable QR code (29 × 29 modules)
  • Finder patterns. The three big squares in the corners. They tell your camera "here's a QR code, and this way is up."
  • Timing patterns. The rows of alternating dots between the finders. They act like a ruler, so the camera knows how big each square is.
  • Alignment pattern. The small square near the bottom right. It helps read codes that are curved, tilted, or printed on something round.
  • Quiet zone. The blank border. Without it, cameras struggle to find the edges.
  • Everything else is the data itself, plus built-in backup copies.

Those backup copies are called error correction. A QR code can still be read with roughly 7% to 30% of it scratched, smudged, or covered, depending on the level chosen when it was made. It's why codes with a logo stamped in the middle still work, and also why a sticker covering just part of a real code can be enough to take it over.

How much fits? The largest QR code (177 × 177 modules) holds up to 7,089 digits or about 4,300 letters and numbers, more than enough for any web address.

Static vs. dynamic QR codes

A static QR code has the link printed right into its pattern; it can never change. A dynamic QR code contains a short link to a middleman service, which forwards you to the real destination. Businesses like dynamic codes because they can change the destination after printing and count how many people scanned. The catch: whoever controls that service can redirect every printed copy at any time, and it can record when and roughly where you scanned.

What a QR code can hold

Most QR codes contain a web address, but a code can hold other things, and your phone acts differently for each:

🔗 A web linkOpens a website: menus, tickets, payments, sign-ups.
📶 Wi-Fi detailsJoins a network without typing the password.
👤 A contact cardAdds someone's name, phone, and email.
📞 A phone number or textStarts a call or a pre-written message.
✉️ An emailOpens a new email with the address filled in.
📅 A calendar eventAdds a date and time to your calendar.
📍 A locationOpens a spot in your maps app.
💳 A payment requestStarts a payment in a wallet or banking app.
🔐 A sign-in or setup codeLinks an account, like two-factor login or WhatsApp on a computer.

Where QR codes came from

QR codes were invented in 1994 by Masahiro Hara and his team at Denso Wave, part of the Toyota group in Japan, to track car parts moving through factories faster than regular barcodes allowed. Denso Wave chose not to enforce its patent and let anyone use the format for free, and it became an international standard (ISO/IEC 18004). That openness is a big reason QR codes spread from car factories to cereal boxes.

They were common in Asia for years, but in the US they stayed a novelty until two things happened: phone cameras learned to read them without a separate app (iPhone added it in 2017), and the COVID-19 pandemic pushed restaurants and shops toward contactless menus and payments. Since then, they've been everywhere.

Why they're everywhere

  • No typing. Long web addresses and Wi-Fi passwords become a one-second scan.
  • Every phone can read them. No app, no special hardware.
  • They're free and cheap to print. Anyone can make one in seconds, and a sticker costs pennies.
  • They connect paper to the internet. A poster, a package, or a parking sign can link to up-to-date information.
  • They're contactless. No shared menus, pens, or card terminals to touch.

Notice that every one of those strengths also makes life easier for scammers. That's the whole story of QR codes in one sentence.

The good: how QR codes help

🍽️ Menus and orderingRestaurants print one code instead of stacks of menus, and update prices without reprinting.
🎫 Tickets and boarding passesConcerts, flights, trains, and events scan a code on your phone at the door.
💳 PaymentsHundreds of millions of people pay by QR code every day, through systems like Alipay and WeChat Pay in China, UPI in India, and Pix in Brazil.
📶 Sharing Wi-FiGuests join your network without you reading out a long password.
📦 Product informationInstructions, ingredients, warranties, recalls, and recycling details on the package.
🔐 Safer sign-insSetting up two-factor authentication or linking WhatsApp to a computer by scanning a code.
🏥 Health and recordsPatient wristbands, prescriptions, and medical paperwork link to the right record.
🏭 Factories and warehousesStill used for what it was invented for: tracking parts and inventory.

The bad: how scammers use them

Using a QR code to trick someone has a name: quishing (QR + phishing). Microsoft counted a 146% jump in QR phishing in just the first three months of 2026. These are the scams we see most, all documented by police, courts, or the FTC in 2025–2026:

🅿️ Fake stickers on parking meters and pumpsA sticker placed over the real code sends you to a fake payment page that steals your card. Reported from Raleigh to St. Petersburg, and the subject of a September 2026 FTC warning.
📱 "Unpaid ticket" and toll textsA text shows an official-looking court or DMV notice with a QR code to "pay" a small fine. No court or DMV collects fines this way. More on this scam.
📧 Email "security" noticesAn email says your password or two-factor login is expiring: "scan to re-verify." The code opens a fake login page. How email quishing works.
📦 Packages you didn't orderA mystery package includes a QR code to "find out who sent it." The FBI warned about this in 2025.
🚗 Fake rideshare and donation codesA "driver" outside a stadium or a street "fundraiser" asks you to scan to pay, then charges far more than agreed.
🔓 Hijacked sign-in codesA scammer sends you a sign-in QR code from their own screen, posing as a prize or a verification. Scanning it logs them into your account.
📶 Rogue Wi-Fi codesA code in a café or hotel connects you to a network the scammer controls.
⬇️ Fake app downloadsA code on a flyer or poster installs a harmful app from outside the official app store.

See where these are turning up on our QR scam map and city-by-city incident pages.

Why scammers love QR codes

  • You can't read them. A text link at least shows you the address; a QR code hides it until you scan.
  • They slip past filters. Email and text spam filters check links, but a QR code is just a picture.
  • They move you to your phone. A code in a work email gets scanned on a personal phone, away from company security, on a small screen that shows only part of the address.
  • Real places lend trust. A code on an official parking meter or a restaurant table feels safe, even when it's a sticker someone added last night.

How to tell a good QR code from a bad one

You can't by looking at the pattern: a safe code and a scam code look identical. What you can do:

  1. Check the physical code. Is it a sticker on top of something? On a meter, pump, or charger, pay in the official app instead.
  2. Think about how it reached you. Codes in unexpected texts, emails, and packages are the riskiest of all.
  3. Check where it goes before you open it. That's exactly what susQR does.

Not sure about a QR code? Check it first.

Point susQR at the code or upload a photo or screenshot. It follows the link for you, checks it with 90+ security companies and scam blocklists, and gives you a plain answer: safe to open, be careful, or don't open, before anything loads on your phone.

Check a QR code with susQR →

Free · no app · no account · how to scan a QR code

Questions

What does QR stand for?

Quick Response. It was designed to be read very quickly, from any angle.

Who invented the QR code?

Masahiro Hara and his team at Denso Wave, a Toyota-group company, in 1994, to track car parts in factories.

Can a QR code contain a virus?

Not by itself. A QR code is just data, usually a web address, so scanning it can't infect your phone. The danger is the page it sends you to: a fake login, a card-stealing payment page, or a download.

Do QR codes expire?

Static codes never do. Dynamic codes go through a middleman service, and stop working if that service ends; their owner can also change where they point at any time.

Can QR codes track you?

The code itself can't. But a dynamic code passes you through a service that can log when you scanned, your rough location, and your type of phone, like a tracked link in an email.

Are QR codes safe?

Most are, but fake ones look exactly like real ones. For any code you didn't expect, check it first.

Related: How to scan a QR code · What is quishing? · 10 common QR code scams · QR code safety checklist