QR Codes: How They Work and How to Make One That Always Scans

Updated 27 September 2026 · 6 min read

A QR code is a square barcode that a phone camera turns into a link or text. Making one takes seconds; making one that scans first time from a menu or a poster takes a little care. This guide covers how QR codes work, the printing rules that matter, and the scams to watch for when you scan.

How a QR code is built

The QR code was developed by Denso Wave in Japan and announced in 1994. A traditional barcode holds about 20 characters; a QR code can hold thousands, and it can be read from any angle.

Every code is a grid of small dark and light squares called modules, with a few fixed features:

• Three finder squares in the corners tell the scanner where the code is and which way up it is. Their 1:1:3:1:1 pattern of dark and light was chosen because it rarely appears in ordinary printed material.
• Timing patterns, dotted lines between the finders, help the scanner count rows and columns.
• Alignment squares on larger codes help correct for a tilted or curved surface.
• Everything else holds your data plus error correction data.

Codes come in 40 sizes, called versions. Version 1 is 21 × 21 modules, each version adds 4 modules per side, and version 40 is 177 × 177. More data means a bigger grid. In our generator, the 29-character link https://saatool.com/tools/qr/ makes a 29 × 29 code (version 3), 500 characters make 85 × 85, and 1,000 characters make 121 × 121. Printed at the same size, a bigger grid means smaller modules, which are harder for a camera to pick out.

Error correction: why a scratched code still scans

QR codes store extra recovery data so a scanner can rebuild parts that are dirty or missing. There are four levels:

Higher levels are tougher but need more modules for the same content. Denso Wave notes that level M is the one most often chosen, and it's what our generator uses. Recovery data is also why a small logo in the middle can work, though the logo uses up the margin meant for dirt and damage.

Printing rules: quiet zone, contrast, size and testing

• Leave a quiet zone. Denso Wave's printing guidance asks for a blank margin four modules wide on every side. Scanners use it to find the edge of the code, so keep text, borders and photos out of it.
• Keep strong contrast. Dark modules on a light background work best. Pale colours, gradients and light-on-dark (inverted) codes can fail on some scanners.
• Print it big enough. A common rule of thumb is at least about 2 × 2 cm for something read up close, like a business card, and roughly one tenth of the scanning distance for signs: about 30 cm wide for a poster read from 3 metres.
• Keep the content short. A 29 × 29 code printed 2 cm wide, quiet zone included, has modules about half a millimetre across. A 1,000-character code at the same size has modules under 0.2 mm, which many phone cameras can't resolve.
• Avoid glare and curves. Glossy lamination, reflections and codes wrapped around bottles all make scanning harder.

Then test before the full print run:

1. Scan with at least two different phones, ideally an iPhone and an Android phone, using the normal camera app.
2. Check it opens exactly the right address, with https and no typos, and that the page loads on mobile data, not only on office Wi-Fi.
3. Print one copy at final size on the final material and scan it from the real distance, in the real lighting.

Static vs "dynamic" QR codes

A static code stores your link or text in the pattern itself. It works for as long as the destination exists, needs no account and involves no tracking. The downside is that you can't change it after printing.

A "dynamic" code stores a short link to a QR company's server, which then redirects to your real page. You can change the destination and see scan counts, but every scan depends on that company. If your subscription lapses or the service closes, printed codes can stop working.

Codes made with our generator are static and never expire. To get the flexibility of a dynamic code without the dependency, point the QR code at a page on your own domain, such as yourcompany.com/menu, and update that page or its redirect when needed.

QR codes can hold more than links. Text in the form WIFI:T:WPA;S:OfficeGuest;P:your-password;; makes most phone cameras offer to join that network. Anyone who can see the code can read the password, so keep this for a guest network.

Scanning safely: watch out for "quishing"

QR phishing, nicknamed quishing, works because nobody can read a QR code by eye. The US Federal Trade Commission warns that scammers stick their own codes over real ones, on parking meters for example, and send codes by email or text with urgent stories about undelivered parcels or account problems. The link leads to a fake login or payment page, or to malware.

• Read the address your phone previews before opening it. Look for misspellings and odd domains.
• Don't scan codes in emails or messages you weren't expecting, especially ones that push you to act fast.
• Look for stickers placed over the original code on meters, posters and restaurant tables, and check your own public codes now and then.
• For payments, use the official app or type the website address yourself.
• Keep your phone updated and protect your accounts with strong passwords and 2-step verification, as our password guide explains.

Make a QR code with SAA Tool

Open the QR Code Generator, paste your link or text (a counter shows how many characters you've used), choose a size and click Create QR Code. The code is made in your browser, so your text isn't sent anywhere. Scan the preview with your phone, then download the PNG.

• Small, 300 px: for screens and emails.
• Medium, 600 px: a good default.
• Large, 1,200 px: for print. That's 300 dpi at 10 cm wide.

The limits: codes are black on white with level M error correction, with no colours, logos, SVG export or scan statistics. The PNG already includes the four-module white border the standard asks for, so keep that border when you place the code in a design, especially on a coloured background. The tool warns you above 500 characters; under about 1,000 characters scans best, and shorter is better.

Frequently asked questions

Do QR codes expire?

Static codes, like the ones our generator makes, never expire. A "dynamic" code can stop working if the company running its redirect ends your plan or shuts down.

How much can a QR code hold?

The largest version holds up to 7,089 digits or 2,953 bytes of text at the lowest error correction level. In practice, anything beyond a few hundred characters makes a dense code that's hard to scan, so use a short link instead.

Why won't my QR code scan?

The usual suspects are a code printed too small, weak contrast, a missing quiet zone, glare, or too much data. Work through them in that order.

Can a QR code contain a virus?

The code itself is only text, but it can point to a malicious website or download. Treat an unknown QR code the way you would an unknown link.