QR codes vanished from public life around 2015 and came roaring back after 2020. They're now overused in exactly the wrong contexts and underused in some right ones. Here's the line.
QR codes had a first life as a manufacturing tracking system, a brief mainstream moment that fizzled around 2015, and a hard comeback after 2020 when touchless everything made them useful again. That comeback also unleashed them on contexts where they make no sense. A QR code is a genuinely good tool for one job and a pointless obstacle for several others, and the difference is easy to state once you know what the format is actually doing.
The one technical thing that matters
A QR code encodes data as a grid of modules, with a chunk reserved for error correction so it still scans when partly damaged or dirty. It started life on a factory floor, not in marketing:
"A QR code, short for quick-response code, is a type of two-dimensional matrix barcode invented in 1994 by Masahiro Hara of the Japanese company Denso Wave for labelling automobile parts."
— Wikipedia, "QR code" (CC BY-SA 4.0)
Error correction comes in four levels (L, M, Q, H); higher levels survive more damage but consume capacity, making the code denser. That's the trade-off that governs everything practical: the more data you cram in — or the more damage-resistance you demand — the denser the grid, and the worse it scans at small sizes or in poor light. Data versus scannability explains most QR successes and failures.
Where QR codes genuinely work
The sweet spot is physical-to-digital bridging: a situation where someone has a printed object and a phone, and typing a URL would be impractical. Restaurant menus, product packaging, event tickets, museum placards, equipment asset tags, appliance manuals. In all of these the code sits still, the user is close, and there's no keyboard alternative that's faster. That's the job QR codes were reborn to do, and they do it well.
Where they're just friction
Several popular uses are actively worse than the alternative:
- Digital-to-digital. A QR code on a website is never easier than a link. The user is already on a device that can click. You've added a step and a second device.
- Moving or distant screens. QR codes on TV ads, train departure boards, or anything the viewer can't hold still are a coin-flip to scan — camera shake and distance defeat them.
- Tiny print. A business card with a code that needs a five-centimetre scan area to resolve won't scan from a card-sized print. Density plus small size equals unscannable.
If the user can tap a link, or can't get close and steady, the QR code is decoration.
Static vs dynamic
A static QR code encodes its destination directly in the pattern — change the destination and you need a new code, but it depends on nothing and never expires. A dynamic code encodes a short redirect URL that you can re-point later, which buys you editability and scan analytics — at the cost of a permanent dependency on the redirect service staying alive. Print a static code on ten thousand product boxes and it works forever; print a dynamic one and it works exactly as long as that third-party redirector does. Choose deliberately: permanence versus flexibility.
It's not just URLs
QR codes can encode more than web addresses, and most phone cameras parse these natively. A code can carry WiFi credentials (network name, password, and security type in a defined format), a vCard contact, an SMS or email draft, or a phone number. The WiFi-join code taped inside a café is the standout example — no reading a 20-character password aloud, just scan and connect. Each data type has a standard text format the generator produces for you.
Design and branding: what you can get away with
QR codes have built-in redundancy from error correction, and that redundancy can be repurposed for design. At the highest error correction level (H, 30% recovery), you can overlay a logo on the centre of the code and it will still scan — the error correction reconstructs the obscured modules. This is how branded QR codes with a company logo in the middle work. The limits are real though: cover too much of the code and it fails; use colours with insufficient contrast against the background and scanners struggle. The modules must be darker than the background (standard is dark-on-light; inverting to light-on-dark reduces scan reliability significantly). Rounded corners on modules are usually fine; gradients across the code are risky because they reduce local contrast. The practical advice: if you're branding a QR code, start with high error correction, keep the logo small (under 20% of the code area), maintain strong contrast, and test on at least three different phone models before printing ten thousand copies.
Print size and scanning distance
A QR code's minimum print size depends on two things: the number of modules (which increases with data length and error correction level) and the expected scanning distance. Each module needs to be at least 0.33mm for a close-range scan (phone held 10–15cm away), and the rule of thumb for scanning distance is roughly 10:1 — a code printed at 2cm across scans reliably from about 20cm. A code on a poster meant to be scanned from 2 metres away needs to be at least 20cm across. This is where dense codes break down in practice: a code encoding a long URL at high error correction has many modules, each of which is smaller at a given print size, which means it needs to be printed larger to scan at the same distance. Short URLs produce simpler codes that scan at smaller sizes and greater distances. If you control the destination URL, shortening it directly improves the code's physical usability.
Security: QR codes as an attack vector
QR codes have a trust problem that's worth acknowledging: a user cannot read the destination before scanning, and a malicious code can point to a phishing page, trigger an automatic download, or initiate a phone call. Stickers placed over legitimate QR codes in public spaces (on parking meters, menus, or ATMs) are a documented social-engineering attack. The defence is on the scanner side: modern phone cameras show a preview of the URL before opening it, which helps — but many users tap through without reading. For any QR code you publish, use a URL that's obviously yours (your domain, not a shortener that obscures the destination), and for any QR code you scan in the wild, check the URL preview before opening. A QR code is a link you can't read with your eyes — treat it with the same caution you'd give an unfamiliar link in an email.
Generate it right
Build the code around its destination. Start with a QR code generator and match the error-correction level and physical size to where it'll live — high correction and generous size for a printed sticker that'll get scuffed, lower density for a clean screen. If the destination URL has query parameters or special characters, run it through a URL encoder first so the encoded value doesn't corrupt the link. And point it at a clean landing path — a slug generator turns a messy title into a short, memorable URL that's both easier to encode and nicer for anyone who does end up typing it. The right QR code is the one aimed at a genuine physical-to-digital moment; everything else is a link wearing a costume.
← All articles