An interactive walkthrough

Inside the QR code

The checkerboard squares you scan every day have a 200-year backstory, a clever mathematical heart, and a security problem hiding in plain sight. Five short modules; no maths beyond arithmetic.

← Back to catalogue

Module 01

From Morse to the barcode

Myth we'll unpick: "QR codes are a modern invention"

Every QR code is the descendant of a telegraph wire. The story starts with a letter that arrived too late.

A letter that arrived too late

In 1825, the painter Samuel Morse was in Washington on the job of his life when a courier brought word that his wife was gravely ill. He rushed home to New Haven by horse and wagon, day and night. She had already died; he had even missed the funeral. From that day he hunted for a faster way to send a message.

By 1836, working with Joseph Henry and Alfred Vail, Morse had a telegraph that needed only a single circuit; the price of that simplicity was a cleverer code. Short and long pulses; dots and dashes.

The first data compression

Common letters, short codes.
E = · T = –

One key press each. Rare letters got longer codes. Sound familiar? It is the same instinct behind every compression scheme since.

So what does SOS stand for?

Nothing at all.··· ––– ··· is simply easy to send and impossible to mistake. The meaning came later, invented by people who assumed it must be an acronym.

Morse code turned language into a stream of two symbols. Hold that thought; it never goes away.

Morse code, drawn in the sand

In the late 1940s a Philadelphia supermarket boss begged a university to speed up his checkouts. Engineering student Bernard Silver overheard, and told his friend Norman Joseph Woodland. On a Florida beach, Woodland idly dragged his fingers through the sand, stretching the dots and dashes of Morse code downwards into thin and thick lines. The barcode was born.

The UPC barcode that grew from that moment stores just 12 digits, read by scanning a laser across the stripes; thin and thick, dot and dash, zero and one.

Build a real barcode

Type any 11 digits

The 12th digit is not yours to choose. It is computed from the other eleven: triple the digits in the odd positions, add the rest, and the check digit tops the total up to a multiple of ten. Damage any single digit and the sum snitches.

Twelve digits was never going to be enough

What a barcode says

"I am product number 93573200016 4." That is the entire message. A pointer into somebody's database, nothing more.

What people wanted to say

Where was this made? When? Which batch? Which paddock did this beef come from? Twelve digits cannot carry a story.

The pressure builds

Through the 1980s and 90s, industry after industry hit the same wall: the code was full. Something had to grow.

And in the 1980s, a crisis in British paddocks made the question urgent.

Module 02

The two-dimensional leap

Myth we'll unpick: "Someone set out to invent the QR code"

It took a disease outbreak, a frustrated factory engineer and a board game to push the barcode into two dimensions.

Mad cows and missing data

From 1986, British cattle began dying of BSE, mad cow disease, and people who ate infected beef could contract a fatal illness. Suddenly everyone wanted to know exactly where their meat had been; and a 12-digit barcode had no room for the answer.

Inventors tried stacking barcodes on top of each other, like Code 49 and its descendant PDF417, still found on airline boarding passes. Better, but still a bookshelf of one-dimensional codes. The real answer was a true two-dimensional grid.

A factory problem and a game of Go

1994Masahiro Hara, an engineer at Japanese auto parts maker DENSO, is sick of scanning up to ten barcodes on every box of components.He decides to build a better code himself.

Go boardHis inspiration is the game of Go: black and white stones on a grid. White for zero, black for one; a whole grid of bits in one glance.A camera can read thousands of squares at once. A laser reads stripes one at a time.

Open patentDENSO Wave holds the patent but chooses not to enforce it, making the code free for anyone to use, and sells scanners instead.Hara has said opening the patent is what made the QR code spread. Rival codes stayed proprietary; the QR code ate the world.

As told by Masahiro Hara in interview (Veritasium, October 2024).

How much can the grid hold?

Version 1 21 × 21 modules

~25 chars

Version 2 25 × 25; the one we build next

~47 chars

Version 10 57 × 57

~395 chars

Version 40 177 × 177; the largest

~3 KB

Forty sizes, each adding four modules per side. Version 40 holds close to three kilobytes; one programmer famously squeezed a playable game of Snake into a single code. Your phone works out the version by counting the modules.

Capacities: DENSO Wave, qrcode.com (byte mode, level M approximate).

Slow burn, then everywhere

2002Mad cow disease resurfaces in the UK. QR codes get one of their first consumer outings: beef traceability labels.

2017Apple and Android build QR reading into their native camera apps. No more third-party scanner apps; the reader is in every pocket.

2020The pandemic makes contactless everything. Menus, check-ins, payments; the little squares become infrastructure.

TodayIndia alone processes billions of QR-based payments every month.The code built for car parts became the front door of the internet.

Module 03

Anatomy of a QR code

Myth we'll unpick: "It's just random squares"

Every module in the grid has a job. The code on the next screen is real; it encodes this website's address, and your phone will read it straight off the screen.

Tap each part to light it up

This is a live version 2 QR code (25 × 25) encoding ntworldink.com. Choose a layer to see which squares are scaffolding and which carry your data.

Turning letters into squares

Byte encoding, one character at a time

'w' is character number 119

119 in binary is 01110111

01110111 becomes □■■■□■■■ , eight little squares

Every character of the message: eight squares each

The first few squares of every QR code declare the data type (numbers only, letters and numbers, bytes, or kanji) and the message length; then the message itself follows, byte after byte.

Watch the data pour in

Data enters at the bottom right corner and zigzags upward in two-column ribbons, snaking around the fixed patterns, all the way to the top left.

359 data modules will fill in true placement order.

Now scan it

Point your phone camera at the screen. This code was built module by module through this walkthrough, and it really works: it goes to ntworldink.com.

Half of what you just watched fill in is not the message at all. The rest of the grid is something stranger; that is module 04.

Module 04

Unkillable codes

Myth we'll unpick: "A damaged code is a dead code"

Tear a corner off a QR code and it still scans. That is not luck; it is some of the most elegant mathematics in daily use.

The trick: keep valid messages far apart

Suppose the only two valid messages are 000 and 111, opposite corners of a cube. Flip any single bit in transit and you land on a corner that is not a valid message; the error announces itself, and the nearest valid corner is almost certainly what was meant.

The distance between valid code words is called the Hamming distance. Spacing words further apart lets you correct more flipped bits.

Reed-Solomon: redundancy with a brain

The idea in one sentence:
before sending, add a few extra numbers computed so the whole message satisfies equations the receiver knows; if the equations fail on arrival, the pattern of failure reveals where the damage is and what the missing values were.

You have trusted it for decades:
Reed-Solomon codes (1960) recover scratched CDs and DVDs, and still pull Voyager's fading whisper out of deep space, half a century after launch. QR codes carry the same mathematics in every corner shop.

In a QR code, roughly half the grid can be these recovery numbers. How much exactly is your choice.

Four levels of stubbornness

Level L light protection, most room for data

7% damage

Level M the everyday default; our code uses it

15% damage

Level Q for grubby factory floors

25% damage

Level H maximum; survives a logo punched through it

30% damage

This is why designers can stamp a logo over the middle of a code and it still scans: the logo is just damage the mathematics routes around.

Restoration rates: DENSO Wave, qrcode.com, "Error correction feature".

Try to kill it

Click or drag on the code to paint damage, then test it with your own phone camera. This code uses level M; in theory it should survive until roughly 15% of it is gone.

Damage: 0.0%

15%

Untouched. It scans.

Damage to the three big position squares hurts far more than damage to the data region; the recovery maths cannot protect the parts that tell the camera where the code is.

Eight disguises, one message

Raw data can bunch into blank patches that confuse scanners, so the standard defines eight masking patterns that flip pixels in fixed ways. A generator scores all eight for awkward patches and publishes the least awkward one; the winner's number rides along in the format strip.

All eight below are real and scannable, and all decode to exactly the same address. Tap them; penalty scores are shown, lower is better.

This is why two generators can hand you different-looking codes for the same link.

Module 05

The dark side of the squares

Myth we'll unpick: "If it scans, it's safe"

Everything that makes QR codes brilliant for machines makes them opaque to people. Scammers noticed.

The core problem: you cannot read it

A QR code pointing at your bank and a QR code pointing at a scam page are visually identical. Humans cannot proofread a checkerboard. Every safety habit you have for links ("hover over it", "read it before you click") fails at the exact moment you scan.

Security folk call QR phishing "quishing". The attack is usually not technical at all; it is a sticker.

Three ways the trick is played

The sticker

A scam code printed on adhesive paper, stuck squarely over the real one; on a parking meter, a menu, a charging station. The equipment looks official because it is; only the sticker is new.

The letterbox drop

Fake fines, missed-delivery cards and "update your details" letters carrying a QR code. Paper feels trustworthy, and the code hides the destination.

The borrowed brand

A scam page dressed as a bank, toll operator or government agency, reached through a code in an email or poster. The page can look pixel-perfect; the address gives it away.

Your one defence sits in the address preview your phone shows before it opens anything. Let's train on it.

Check before you tap

Your camera shows a preview of where each code leads. Trust it or not? All addresses below are invented for this exercise.

A sticker on a Darwin parking meter offers "pay by phone". The preview reads:

https://nt-parkingfines-pay.com/meter

Suspicious is right. Government payments in the Territory live under nt.gov.au. A hyphenated look-alike domain that merely mentions NT is the classic sticker scam; pay through the meter, the official app you already have, or an address you type yourself.

A restaurant table card for the menu. The preview reads:

https://ordermate.online/menu/darwin-laksa-house

Reasonable. Menus commonly live on third-party ordering platforms, and a menu does not ask for money up front or your personal details. Risk is low; stay alert the moment any "menu" wants card numbers or a login.

A letter about an unpaid toll, urging immediate payment. The preview reads:

https://linkt.com-pay-secure.net/invoice

Suspicious is right. Read domains from the end: this page lives on com-pay-secure.net, not on the real operator's domain; "linkt" is only a subdomain costume. The words before the first slash can be dressed up to say anything.

Habits that beat the sticker

Preview, then read backwards

Always look at the address your camera shows before opening, and read the domain from the end. The true owner is just before the first single slash.

Feel the surface

On parking meters, menus and public posters, a code on a sticker over another code is a red flag you can literally feel. Unexpected codes in letters and emails deserve the same suspicion as unexpected links.

Never pay through a scanned code

For fines, tolls, banking and anything with your card details, close the browser and go in the front door: the official app, or an address you type yourself.

Why this matters

The QR code is Morse code's great-grandchild: language flattened into two symbols, spread onto a grid, wrapped in mathematics that heals its own wounds. It is free, open and effectively inexhaustible; the number of possible codes dwarfs the number of atoms' worth of stickers we could ever print. The only part with no error correction is the human holding the phone. Now you scan with your eyes open.

Built on: Veritasium, "I built a QR code with my bare hands to see how it works" (October 2024), including Masahiro Hara interview material; DENSO Wave, qrcode.com ("Error correction feature"; "Information capacity and versions of QR Code"); ISO/IEC 18004 (QR code standard). The QR codes on these pages were generated for this walkthrough and encode ntworldink.com.