How do QR codes actually work and how did a Toyota warehouse problem turn into the most scanned symbol in the world?

Quick Response (QR) codes are now scanned billions of times daily, yet their journey from a Toyota warehouse problem to the world's most prevalent 2D barcode took a mix of open-source thinking, two decades of invisibility, and a pandemic that compressed adoption into months. Understanding how they encode data, survive damage, and became ubiquitous—alongside the security risks that follow them—reveals why a simple pattern of squares transformed global commerce.

How Black and White Squares Encode Information

QR codes convert content into binary data, apply structured error correction, and arrange everything inside a square matrix optimized for fast scanning. Scanners interpret a grid of black and white squares as a stream of 1s and 0s, where small squares (called modules) can be either black (1) or white (0). Unlike traditional one-dimensional barcodes that store information only horizontally, QR codes store information both horizontally and vertically , which dramatically increases storage capacity.

Data is converted into a binary format using specific encoding modes such as numeric, alphanumeric, byte, or Kanji , and every QR code contains functional elements such as position markers, alignment patterns, and timing patterns that ensure reliable scanning even when partially damaged. The three large square "eyes" in the corners tell the scanner where the code starts and ends, enabling 360-degree scanning.

Why 30% Damage Doesn't Break the Code

Thanks to built-in QR code error correction, a code can remain scannable even if up to 30% of the QR code image is damaged, depending on the correction level used. Using Reed-Solomon error correction, QR codes can recover from up to 30% data loss—which is why you can add logos to codes without breaking them.

There are four QR code error correction levels: L (Low), M (Medium), Q (Quartile), and H (High), each offering different levels of error correction ranging from around 7% to 30% of codewords that can be restored. Typically, Level M (15%) is most frequently selected , but branded codes with logos use Level H to allow for the overlap. Higher correction levels can withstand scratches, smudges, and partial code loss , though they make the code slightly larger.

From Toyota Floor to Global Standard: The Patent Decision

QR codes were invented in 1994 by Masahiro Hara at Denso Wave for tracking Toyota auto parts — and took 25 years to go mainstream. The QR code was born from factory feedback in 1994: workers wanted a way to handle product information more efficiently, with a code that could store more data, read quickly, and withstand dirt on the production line. Traditional barcodes were inadequate because they could only hold a small amount of information, so workers often had to scan multiple barcodes for one item.

The decision that shaped QR codes' future was revolutionary: Denso Wave patented the QR code but chose not to exercise their patent rights, making the technology freely available for anyone to create and use, which is the primary reason QR codes became a global standard. This decision is presented as one of the main reasons the code spread.

For the first decade of its existence, the QR code was an industrial tool: Toyota and its supplier ecosystem used it to track parts, and other Japanese manufacturers adopted it because it was free and interoperable, but outside Japanese factories, almost no one had ever seen one. Japan's first move toward consumer use happened around 2002, when carriers began shipping mobile phones with built-in QR-scanning software, and magazines, posters, and product packaging started carrying codes—but Japan was effectively the only country where this worked at scale because the rest of the world's phones lacked the software.

How a Pandemic Compressed a Decade Into 18 Months

The COVID-19 pandemic was the single largest accelerator of QR code adoption in history, with global QR code generation increasing by an estimated 238% between March 2020 and December 2021. The pandemic created urgent, practical reasons to scan—restaurant menus, contactless check-ins, vaccination records, and digital health passes.

COVID-19 did not create digital payments—but it compressed years of adoption into a very short time. Most habits formed during COVID such as contactless payments, QR menus, and mobile-first transactions have largely persisted, even as emergency restrictions have lifted. Industry data shows that 87% of consumers who started scanning QR codes during the pandemic continued to do so regularly in 2024 and 2025. What might have taken a decade of gradual adoption occurred in roughly 18 months of necessity.

Security Risks Hidden in Plain Sight

QR codes present inherent risks due to their potential exploitation by malicious actors, as a bridge between the physical and digital realms, they can become vectors for phishing attacks and malware dissemination. The primary threat is "quishing"—QR code phishing. A QR code phishing attack manipulates users into giving away personal and financial information or downloading malware.

What makes quishing effective is the delay between trust and verification: a person often decides to scan before they see the full destination, giving the attacker an advantage. While QR codes are generally safe, they can be manipulated by scammers because they all appear similar, and a malicious QR code may lead you to a spoofed website designed to drop different malware types or steal sensitive data like login credentials or credit card information.

Overlay attacks are a form of cyber-attack where malicious QR codes are placed over legitimate ones, and the fake codes can be used to direct people to websites which install malware, steal personal information, or obtain money from users. According to reporting by NordVPN, 73% of Americans scan QR codes without verifying the destination, and more than 26 million users have been redirected to malicious websites.

To protect yourself, use the QR-scanner that comes with your phone rather than using an app downloaded from an app store , and be aware that QR codes used in pubs or restaurants are probably safe, but scanning codes in open spaces like stations and car parks might be riskier. Always pause before scanning unexpected codes, especially in public or when received via unsolicited email.

A Final Note

QR codes remain a powerful tool—their reliability, capacity, and open standard made them indispensable. But their invisibility (you cannot see the destination before scanning) combined with their ubiquity makes them appealing to attackers and require scanning with awareness. Keep this information updated on official sources as cybersecurity practices and QR code technologies continue to evolve.

References

• 1. How Data Becomes a Scannable Code with QR Code Encoding
• 2. What is QR Code Structure and How Does It Work? | 2026 Guide
• 3. Creating QR Codes: How They Work and How to Make One
• 4. Anatomy of a QR Code: Know Its Structure & Functionality | QR Tiger
• 5. How Do QR Codes Work? - The Elm
• 6. How The Heck Do QR Codes Work? (An Interactive Exploration)
• 7. How Do QR Codes Work? QR Code Technical Basics
• 8. How do QR codes work? — Learn how Gadgets Work - One Gadget at a Time
• 9. DEV Community
• 10. QR Code Error Correction: Create Damage-Resistant Codes