How much data can a QR code actually hold?

A Version 40 QR code (177×177 modules) can hold up to 7,089 numeric characters, 4,296 alphanumeric characters, or 2,953 bytes of binary data at L error correction. In practice, keep payloads short. The longer the data, the denser the pattern — and dense patterns fail at distance, poor angles, or low contrast printing.

Does error correction level affect scan speed?

Higher correction means more cells in the pattern, which theoretically increases decode work. In practice, modern phone cameras are fast enough that this is irrelevant for typical use. The more meaningful variable is print contrast and code density relative to the physical size it's printed at.

Can a QR code run malicious code when scanned?

No. QR codes encode a data string, not executable instructions. A scanner interprets the content — opening a URL, adding a contact — but that logic lives in the scanning app, not in the code itself. A malicious QR code can point to a malicious URL or phishing page. It cannot execute code by virtue of being scanned.

Don't like ads? Go Ad-Free Today 

QR Codes Are Just URLs in a Trench Coat (And What Else Is in There)

Updated on Jun 7, 2026

Most QR codes contain a URL, but the format supports WiFi credentials, vCards, SMS, geo coordinates, and more. Here’s what’s actually inside, how error correction levels work, what the quiet zone requirement means in practice, and when to use dynamic vs static codes.

QR Codes Are Just URLs in a Trench Coat (And What Else Is in There) 1

ADVERTISEMENT · REMOVE?

Scan any QR code and your phone opens a URL. Do that a few hundred times and you start to assume that’s all a QR code ever is — a pixelated shortcut to a website. That assumption is wrong, and it matters if you’re building anything that generates or reads them.

QR codes are defined by ISO 18004. The spec supports four encoding modes — numeric, alphanumeric, binary, and kanji — and can carry up to roughly 3KB of data depending on version and error correction level. The URL convention is just that: a convention. The format has no opinion about what you put in it.

What’s actually in the trench coat

A handful of payload formats have become de facto standards because mobile OS camera apps know how to parse them and take the right action automatically:

URL — https://example.com — opens in browser. The obvious one.
WiFi credentials — WIFI:T:WPA;S:MyNetwork;P:hunter2;; — iOS and Android camera apps read these natively and offer to join the network. No third-party app needed. Easily the most useful non-URL payload for anyone who’s ever tried to read out a WPA2 password over the phone.
vCard contact — full v2.1 or v3.0 vCard blocks with name, phone, email, org, address. Scans prompt “Add to contacts.”
Phone number — tel:+15555551234 — prompts a call.
SMS — smsto:+15555551234:Pre-filled message text
Email — mailto:user@example.com?subject=Hello&body=...
Geo coordinates — geo:37.7749,-122.4194 — opens in Maps.
Calendar event — VEVENT block (iCalendar format) for adding events directly to the device calendar.

The WiFi one is worth flagging specifically because most people don’t know it exists. If you’re building anything with a guest network — hotel, coworking space, event — printing a WiFi QR code is strictly better than posting a password on a card. Every modern phone camera handles it without any app.

Error correction: why you can put a logo in the middle and it still scans

QR codes use Reed-Solomon error correction, which means they can reconstruct missing or damaged data from redundant cells built into the pattern. There are four correction levels:

Level	Name	Max codeword recovery	When to use it
L	Low	~7%	Clean digital contexts — screens, PDFs, presentations. Smallest pattern density.
M	Medium	~15%	General purpose. Default in most generators. Good balance for most print uses.
Q	Quartile	~25%	Industrial labels, outdoor signage, anything likely to pick up dirt or minor physical damage.
H	High	~30%	Branded QR codes with a logo deliberately placed in the center. The logo destroys data; H correction rebuilds it.

The tradeoff is density: higher correction means more redundant data cells in the same pattern. A version 10 QR code at H level is noticeably more complex than the same URL at L level. More complexity means smaller individual cells at any given print size, which means more failure risk at poor scan angles or low contrast. Ironic but real: cranking error correction too high can make a code harder to scan in practice.

The branded-logo trick works because H-level codes were designed to tolerate ~30% data loss. Place a centered logo that covers less than that and the scanner fills in the gaps from redundant cells. Go over 30% and you get a pretty graphic that doesn’t scan.

The quiet zone: the rule nobody documents until the code fails

Every QR code requires a quiet zone — a margin of blank white space around all four sides. The ISO spec requires a minimum of 4 modules (one “module” being one of those tiny squares in the grid). Skip this and scanners fail, especially in difficult lighting or at an angle.

This is the #1 cause of a “correct” QR code that doesn’t actually scan in production: it was cropped too tight, placed directly against a dark border, or printed on a colored background that bleeds into the margin. A QR code on a dark cardboard box with no white border will fail reliably. The scanner needs that white space to locate the finder patterns in the corners.

Practical number: at any print size, give the code at least 4–6mm of white padding on every side. If you can’t, you’re better off using a larger version of the code than trying to squeeze it into a tight space without margin.

Static vs dynamic: the right choice isn’t obvious

A static QR code encodes your data directly in the pattern. Once printed, it’s permanent — the only way to change what it points to is to reprint. No server needed, no third party, works forever.

A dynamic QR code encodes a short redirect URL managed by a service (qr.io, Bitly, or similar). The redirect destination is editable after printing. You also get scan analytics — count, time, device, approximate location.

For anything going on physical print material — menus, product packaging, event signage — dynamic is almost always the right call. Reprinting 10,000 product boxes because a URL changed is expensive. For digital-only use where reprinting costs nothing, static is simpler and carries zero dependency risk.

The risk nobody talks about: dynamic QR codes on physical packaging bet on a third-party redirect service existing in two years. Print a code pointing to a free-tier account at a startup QR service on 50,000 units and you’ve made a long-term promise about that service’s uptime. If they go under, get acquired, or just kill the free tier, every one of those codes breaks simultaneously.

If you want to generate QR codes — static or dynamic, any error correction level, URL or WiFi or vCard — the QR Generator on IO Tools handles all of it in the browser without an account.