What is actually inside a QR code (and what a WiFi code reveals)

A QR code looks like noise, a little maze of black and white squares that means nothing until a phone points at it. That look fools people into thinking it is some kind of secret encoding. It is not. A QR code is plain text drawn as a grid, with a few fixed patterns that help a camera read it and a layer of error correction that lets it survive damage. Once you know the parts, you stop worrying about the wrong thing and start worrying about the right one: the WiFi kind, which hands your network password to whoever scans it.

TL;DR: A QR code is text stored as a pattern of squares: a link, WiFi credentials, a contact card, in the open with no encryption. The three corner squares are finder patterns, and Reed-Solomon error correction is why a smudged or logo-covered code still scans. Anyone who scans it reads exactly what you put in, which matters most for WiFi codes.

The anatomy: what those squares are doing

A QR code is not one blob of pattern. It is a few distinct regions, each with a job.

The three big squares in the corners are the finder patterns. They are the first thing a scanner looks for. Their nested-square shape is deliberately rare, so the camera can spot them fast, and because there are three of them in an L-shape, the scanner can work out which way up the code is. That is why a QR code reads upside down, sideways, or at an angle. The finders tell the software where the code is and how it is rotated before a single character gets decoded.

Around the outside is the quiet zone, the blank margin with nothing in it. It looks like empty space you could trim to save room. Do not. Scanners need that clear border to tell where the code ends and the background begins. The spec asks for a margin about four modules wide, where a module is one of the small squares. Crop it too tight and many phones will not lock on, even though the pattern itself is intact.

The rest of the grid splits into two things: timing patterns (the dotted lines running between the finders, which let the scanner count off the grid and stay aligned) and the data area, where your actual message lives as light and dark modules. Bigger versions also add smaller alignment patterns inside the grid to keep large codes from drifting out of true.

So a QR code is not a language or a cipher. It is text laid out in a format built for a camera, wrapped in patterns that help the camera find it, orient it, and read it back reliably. When your phone scans one and shows a link, it did not decrypt anything. It located the finders, measured the grid, and read the modules.

Reed-Solomon: why a dirty code still works

Here is the part that feels like magic and is just math. A QR code carries error-correction data using Reed-Solomon codes, the same family of math that recovers data from scratched CDs and deep-space transmissions. It stores extra codewords alongside the real message. If some modules are damaged, covered, or misread, the scanner uses those extra codewords to reconstruct the original.

There are four levels, and you pick one when you make the code:

• L (Low): about 7% of the code’s data can be recovered
• M (Medium): about 15%
• Q (Quartile): about 25%
• H (High): about 30%

One thing worth being precise about: those percentages are the share of the code’s data units (called codewords) that can be restored, not the share of the physical picture. In practice it lines up with what you see. At level H, a code keeps scanning with roughly a third of it obscured, which is exactly why brands drop a logo in the middle of a QR code and it still works. The logo covers part of the data, and Reed-Solomon fills the gap back in.

That same headroom is why a code survives a coffee ring, a fold in the paper, or a bit of glare. The tradeoff: higher correction means more redundant data, which means a denser, busier grid for the same message. If you want a logo in the middle, use H. If you want the simplest possible code for a plain link and you control the printing, L or M is enough.

Nothing in it is secret

Because a QR code is open text, there is no key, no password on the code itself, and no encryption. Whatever you encode is readable by every scanner that sees it. A code with a URL holds that URL in the clear. A contact code holds the name, phone and email as plain fields. A WiFi code holds the network name and the password, spelled out.

This is usually fine and is the whole point: a poster code that opens your menu is meant to be public. The trouble starts when people assume the squares hide something. They do not. The finder patterns, the quiet zone, the error correction, none of it is security. It is all just there to make the text easy to read. If you would not write the contents on a sign in plain words, do not put them in a QR code and treat the squares as cover. The code is the sign; the squares are a font your phone can read.

What a WiFi QR code actually shares

The WiFi QR code is where this matters most, because it is so handy that the exposure is easy to miss. The code contains your network name and your WiFi password as readable text, so a guest’s phone can read it and join without typing. Convenient, and also the catch: anyone who scans that code, or photographs it to scan later, now has your WiFi password.

For a café or a guest network that is meant to be shared, that is what you want. For your home or office network, think about where the code lives. A WiFi code taped to a window faces the street; one posted in a public photo is readable by anyone who saves the image. And the error correction cuts the wrong way here: even a partly obscured photo of your WiFi code can still decode, because that is the whole point of Reed-Solomon. A guest network keeps the convenience without handing out the keys to everything else on your main one. You can create a WiFi code, and read what is encoded in any code you are handed, with a WiFi QR generator at qr.hivly.net so you know exactly what you are putting on the wall.

How much a code can hold

QR codes come in 40 sizes, called versions. Version 1 is a 21 by 21 grid; version 40 is 177 by 177. Each step up adds four modules per side and a good chunk of capacity, which is why a code holding a long URL looks visibly busier than one holding a short one.

At the top end, version 40 at the lowest error-correction level holds roughly 7,000 digits, about 4,000 alphanumeric characters, or a bit under 3,000 bytes. Raise the error correction and that number drops, because the redundant codewords eat into the space. Most everyday codes are nowhere near this. A menu link or a line of WiFi details fits in a small version, which keeps the grid simple and the scan reliable. If your code looks like a solid wall of tiny squares, you have either packed in a lot of text or cranked the error correction high, or both.

The real risk is the destination, not the code

A QR code cannot carry a virus, because it is only text and cannot run anything on its own. The risk is not the squares; it is where they point. A code holding a link can send you to a convincing fake login page. A code holding contact or WiFi data can prefill an action you did not intend. The attack is misdirection, getting you to trust a destination because a code, which feels neutral and machine-made, suggested it.

The defense is the same one you use with any link. Before you act, look at where the code leads. A good scanner shows you the URL or the details first and waits for you to confirm, rather than opening them automatically. Scan, read what it actually says, and decide, the same caution you would apply to a link in an email from a stranger. Finder patterns and error correction make a code easy to read. They do not make it trustworthy, and it earns no extra trust just for looking technical.