What is a QR code?
A QR code (Quick Response code) is a square, two-dimensional matrix barcode of dark and light modules that holds up to 7,089 digits or 2,953 bytes, with three recognisable corner squares and built-in error correction, and that is read with a camera or image scanner. The code was released in 1994 by DENSO WAVE, then a division of the Japanese automotive supplier DENSO, so that parts in production could be scanned faster and with more data than a linear barcode allows. Today QR codes appear on packaging, nameplates, receipts and payment requests, and the QR code is one of the data carriers of the GS1 standards and of the digital product passport.
🧠 How is a QR code structured?
A QR code is a grid of square modules. Besides the data, the symbol contains fixed patterns that help the scanner find the image and straighten it out:
- Three finder patterns - the large squares in three corners, which let a camera recognise the code at any rotation
- Alignment patterns - smaller squares from version 2 onwards, which correct distortion on curved or skewed surfaces
- Timing patterns - alternating dark and light lines between the finder patterns that fix the module size
- Format and version information - the error correction level and the mask pattern (one of eight), plus the version number from version 7 onwards
- Quiet zone - a blank margin of at least four modules around the symbol
Sizes range from version 1 (21 × 21 modules) to version 40 (177 × 177 modules); each version adds four modules per side. The more data and the higher the error correction, the higher the version and the smaller each module becomes on the same label area.
| Version | Modules | Max. digits (level L) | Max. bytes (level L) |
|---|---|---|---|
| 1 | 21 × 21 | 41 | 17 |
| 10 | 57 × 57 | 652 | 271 |
| 40 | 177 × 177 | 7,089 | 2,953 |
Data is encoded in one of several modes: numeric (three digits in 10 bits), alphanumeric (two characters in 11 bits, upper case, digits and a few punctuation marks only), byte or kanji. A web address in lower case therefore ends up in byte mode and takes more space than a number of the same length.
🔧 How does error correction work?
The QR code adds Reed-Solomon error correction to the data. As a result a code stays readable when part of it is dirty, scratched or covered. There are four levels:
| Level | Recoverable damage (approx.) | Typical use |
|---|---|---|
| L (Low) | 7% | Clean environment, maximum data capacity |
| M (Medium) | 15% | Most commonly chosen default |
| Q (Quartile) | 25% | Industrial labels exposed to dirt or wear |
| H (High) | 30% | Harsh environments, or a logo in the middle of the code |
A higher level costs capacity: at level H, version 40 holds only about 1,273 bytes instead of 2,953. In a plant with oil, dust or scuffing on the packaging line, Q or H is a common choice; for a short link on a clean carton, M is enough.
🔄 How does a QR code differ from other barcodes?
| Code | Type | Read with | Strength | Weakness |
|---|---|---|---|---|
| QR code | 2D matrix | Camera / image scanner | High capacity, error correction, familiar to consumers | Not readable by laser scanners |
| DataMatrix | 2D matrix | Camera / image scanner | Smaller for little data, suited to direct part marking | Less familiar to consumers |
| GS1-128 | Linear | Laser and image scanner | Logistics standard for pallets and the SSCC | Needs a large label area |
| EAN-13 | Linear | Laser and image scanner | Retail standard for the GTIN | Product number only, no batch or date |
| RFID | Radio | RFID reader | No line of sight needed, bulk reading | More expensive tags, sensitive to metal and liquids |
Smaller variants exist as well. The Micro QR code has a single finder pattern and a two-module quiet zone, and holds at most 35 digits (version M4, 17 × 17 modules). The rectangular Micro QR code (rMQR), approved by ISO in 2022, fits narrow strips from 7 × 43 to 17 × 139 modules, for example along the edge of a circuit board or on a tube.
🏭 How is the QR code used with GS1 data?
A plain QR code holds free text. For the supply chain there are two standardised ways to carry GS1 data:
-
GS1 QR Code - the data is a GS1 element string with Application Identifiers inside the code, flagged by an FNC1 character in the first position. A
scanner reports this with the symbology identifier
]Q3. -
QR code with GS1 Digital Link - the GS1 keys are part of a web address, for example
https://example.com/01/08711234567895/10/AB1234?17=280930. A checkout scanner extracts the GTIN from it, while a smartphone opens product information. The syntax has also been published as ISO/IEC 18975 since 2024.
An example of content following the GS1 structure:
- (01)08711234567895 → GTIN (prefix 871 belongs to GS1 Netherlands, the last digit is the check digit)
- (17)280930 → expiry date 30 September 2028
- (10)AB1234 → batch number
- (21)SN8888 → serial number
Fixed-length fields such as (01) and (17) preferably come first. A variable-length field such as (10) is followed by a separator character (GS) when another field comes after it. The GS1 initiative Sunrise 2027 asks retailers to make their checkout scanners 2D-capable by the end of 2027, so that a QR code with GS1 Digital Link can sit next to or replace the EAN-13. In healthcare, GS1 DataMatrix remains the usual carrier for the UDI on medical devices.
🛠️ How do you deploy QR codes on the shop floor?
A QR code on a product or part links the physical world to ERP, MES and the WMS. A practical approach:
- Define the content - a GS1 element string for tracking and tracing across the chain, or a URL (GS1 Digital Link or an IEC 61406-1 Identification Link) when people with a smartphone also need to scan it.
- Choose error correction and size - keeping the content short gives a lower version with larger modules, and therefore more reliable reading. Keep the four-module quiet zone clear.
- Choose the printing method - thermal transfer labels, inkjet on cardboard, or laser marking on metal and plastic. Glossy or curved surfaces call for a higher error correction level.
- Verify print quality - sample with a verifier according to ISO/IEC 15415, or let a vision camera check and reject every code inline.
- Connect to the systems - record at each scan which serial or batch number was processed on which line, at what time and with which raw material, to support recalls and asset management.
Applications in OT environments include digital nameplates that point to documentation through the Asset Administration Shell, QR codes on machines that open a work instruction or fault procedure, and the battery passport, which must be reachable through a QR code from 18 February 2027.
🔐 What security risks do QR codes carry?
A QR code is unreadable to humans, so a user only sees where it leads after scanning it. That makes the code attractive for abuse:
- Quishing - phishing through a QR code in an email, PDF or on paper. The link bypasses URL filtering in the mail environment because it arrives as an image and is often opened on a personal phone.
- Stickers pasted over codes - a fake QR code over the genuine one on a parking meter, charging point or machine, as a form of social engineering.
- Keystroke injection - many handheld scanners behave like a keyboard. A manipulated code can then type characters or key combinations into an HMI or terminal that does not validate its input.
- Wi-Fi codes - a QR code with the Wi-Fi password on a cabinet or in the control room gives anyone with a camera access to the network.
Countermeasures: include quishing in security awareness training, check the domain name after scanning, validate scanner input in applications, disable unused scanner functions, and prefer your own domains in QR links on products.
❓ Frequently asked questions
How much data fits in a QR code?
A QR code holds at most 7,089 digits, 4,296 alphanumeric characters, 2,953 bytes or 1,817 kanji, at version 40 and error correction level L. In practice far less is used, because a smaller QR code with larger modules scans more reliably.
Can a laser scanner read a QR code?
No, a QR code is a two-dimensional matrix code that can only be read by a camera or image scanner (imager). A laser scanner reads only linear barcodes such as EAN-13 and GS1-128, which is why Sunrise 2027 focuses on replacing checkout scanners with 2D-capable ones.
Is the QR code free to use?
Yes, DENSO WAVE retained the patent on the QR code but declared that it will not exercise those rights, and the specification is public as ISO/IEC 18004. Anyone may therefore generate and read QR codes free of charge; only the name “QR Code” is a registered trademark of DENSO WAVE. The current fourth edition of the standard was published in 2024.
What is the difference between a QR code and a GS1 QR Code?
A plain QR code may contain any text or URL without a fixed structure. A GS1 QR Code contains GS1 Application Identifiers such as (01) for the GTIN and (10) for the batch number, flagged by an FNC1 character, so that every system in the supply chain interprets the fields in the same way.
Does a damaged QR code remain readable?
Yes, thanks to Reed-Solomon error correction a QR code can recover roughly 7% (level L) to 30% (level H) damage, depending on the level chosen. The three finder patterns and the quiet zone must stay largely intact, however, otherwise the scanner cannot locate the QR code.
When do you choose a QR code and when DataMatrix?
A QR code is the logical choice when consumers or staff scan with a smartphone, for example for product information or the digital product passport. DataMatrix suits small surfaces, direct part marking on metal and healthcare, where GS1 DataMatrix is the usual carrier.
📌 In summary
In just over thirty years the QR code has grown from a parts code in the Japanese automotive industry into one of the best-known 2D barcodes in the world. For IT/OT environments its main value is as a bridge between physical products and digital systems: with GS1 data for traceability, with GS1 Digital Link or IEC 61406 for product information, and as the carrier of the digital product passport. At the same time the code demands attention to print quality and to security against quishing and manipulated scanner input.
A QR code is a two-dimensional matrix barcode defined in ISO/IEC 18004 that stores up to 2,953 bytes with error correction and, through the GS1 structure or GS1 Digital Link, links products, batches and serial numbers to ERP, MES and the digital product passport.