How QR codes work, and how to make one that always scans

A QR code is a grid of black and white squares encoding text, with enough redundancy built in that a surprising amount of it can be missing before the message is lost. Understanding the redundancy is what separates a code that scans reliably from one that fails on a sign.

The parts of the grid

The three large squares in the corners are finder patterns; they let a scanner locate the code and work out its rotation, which is why a QR code scans upside down. Smaller alignment patterns correct for the distortion of a code photographed at an angle or printed on a curved surface.

The timing patterns — alternating lines between the finders — tell the scanner how big each module is. Everything else is data and error-correction codewords, which is why two codes holding the same text can look completely different if the settings differ.

Error correction is a budget, not a setting

QR codes use Reed–Solomon error correction at one of four levels, recovering roughly 7%, 15%, 25% or 30% of the code. That redundancy is what lets a code survive a scratch, a fold, or a logo placed over the middle.

It is not free. Higher correction means more codewords for the same message, so the code becomes denser and each module smaller at a fixed physical size. Medium is right for a screen; choose a higher level for print or for anything you intend to cover.

Why printed codes fail

The most common cause is the quiet zone — the blank margin around the code. Scanners need it to find the edges, and designers routinely crop it away to fit a layout. Keep a clear margin of at least four modules.

Next is contrast and inversion. Dark-on-light is what scanners expect; a light code on a dark background fails on many readers, and low-contrast colour pairs fail in poor lighting. Then size: a code needs enough physical area for the camera distance, so a code on a poster read from three metres must be far larger than one on a business card.

How a Wi-Fi QR code joins a network

A Wi-Fi QR code is not a link. It holds a short piece of text in a fixed format, WIFI:T:WPA;S:MyNetwork;P:my-password;;, which gives the security type, the network name and the password. The built-in camera app on a recent iPhone or Android phone recognises that format and offers to join the network, so nobody has to type the password.

Because the whole message is inside the code, it works offline and never expires. It also means that anyone who can photograph the code has the password, so a code taped to a café wall is effectively a public password. Put a guest network behind it, not your main one.

Open networks, hidden networks and awkward names

A network without a password still needs a code of its own, and it's the simplest case: the security type is set to open (T:nopass) and the password is left out. The phone joins as soon as the code is scanned, which is exactly what a guest or event network wants.

A hidden network doesn't broadcast its name, so the phone won't find it unless the code says to look. That is the H:true flag. Leave it off and the code scans, the phone says it is joining, and then nothing happens, which looks like a wrong password but isn't.

• The network name must match exactly. It is case-sensitive, and a trailing space counts.
• Semicolons, commas, colons, double quotes and backslashes in a name or password have to be escaped with a backslash, or the phone reads a truncated password. A generator should do this for you. Hand-written codes are where it goes wrong.
• Choose WPA for any modern router using WPA2. WEP is obsolete, and a router still using it should be upgraded rather than put on a sign.