How QR codes work: what they contain and why they can still be read when partly covered

You scan one at a restaurant to read the menu, at the gate, at the entrance to a concert. Scanning a QR code has become an everyday gesture, and hardly anyone stops to wonder what is actually inside it.

Yet that is the question that matters. A QR code isn’t a picture: it’s a small container of data, designed to be read by any camera, even from a photo, even when it’s damaged. Understanding how QR codes work explains why a light blur isn’t enough to hide one, why some codes are worth as much as a key, and why it’s worth looking at the address before you open a link.

This post lays out the technologies involved one by one, with their real advantages and limits, without pointing to any specific product. It is the technology side of the recommendation on posting photos with QR codes: tools help, but the choice of what to show remains yours.

How to read this list

First, the mechanism in a few lines.

How it’s built. A QR code is a grid of small black and white squares called modules. Three larger squares in the corners tell the reader where the code starts and which way up it is, even if you hold the camera at an angle. The rest of the grid holds the data, encoded in binary (ones and zeros, here dark and light): the more modules there are, the more characters fit, up to a few thousand.

What it contains. The code doesn’t “know” anything: it only contains the text someone put into it. Depending on who generated it, it may be:

1. plain text — a serial number, a message, a collection code;
2. a link — the address of a website, which your phone offers to open;
3. booking data — passenger name, booking reference, flight, date and seat, as on boarding passes;
4. Wi-Fi credentials — the network name and password, written in plain text in a line such as WIFI:T:WPA;S:NetworkName;P:password;;;
5. a pairing code — a temporary authorisation that links an account or a service to a new device, such as the desktop version of a messaging app or the activation of a digital SIM.

Why it can still be read when partly covered. Every code contains a redundant part called error correction: extra data, calculated with a mathematical method, that lets the reader rebuild the content even when a piece is missing, dirty or covered. There are four levels: the lowest recovers roughly 7% of the code, the highest roughly 30%. That’s why many codes have a logo in the centre and still work. For anyone posting a photo, it means that a covered corner, a hidden strip, a hasty “half” cover that hides less than it seems, or a blur that still lets light and dark be told apart can leave the code readable.

And the barcodes on tickets? The classic barcode, with vertical lines, holds only a few characters, usually a number. Boarding passes and train and event tickets, however, often use two-dimensional codes (made of stacked rows or concentric squares), close relatives of the QR code: they hold more data and also have error correction. Boarding passes follow a format shared across the whole airline industry, which any reader can decode.

Static and dynamic. A static code contains the data directly: once printed, it can’t be changed or switched off. A dynamic code contains only a short link to a server, which then redirects to the destination: whoever created it can change that destination, switch it off and count the scans. On tickets, “dynamic” often also means a code that changes every few seconds in the official app.

The technologies are organised into four functions, the same ones used in the post on how to hide a QR code in a photo:

• prevention — stopping a readable code from ending up in a public photo;
• detection — noticing a code that slipped through, or a suspicious link;
• response — making an exposed code useless;
• governance — keeping things in order over time, in a family, a team or a small business.

For each one you’ll find the risk it reduces, its advantages, its honest limits, and how complex it is to use.

1. Prevention technologies

Cropping and solid boxes in the photo editor

The features of your phone’s photo editor, or of a social network’s story editor, that trim the image or draw an opaque shape over part of it.

• Risk reduced: readable codes and booking references in the photos you post.
• Advantages: they’re already on your phone; cropping and solid boxes remove the information rather than muddling it.
• Limits: blurring and pixelation (the mosaic effect), often offered alongside, are less reliable; in some tools an effect stays editable until you save the image.
• Example: you photograph your concert ticket and cover both the code and the number printed beneath it with a black rectangle.
• Complexity: basic.

Codes that change or activate shortly before use

Some organisers and carriers show the ticket only in their official app, with a code that regenerates every few seconds or appears shortly before the event.

• Risk reduced: tickets copied from a photo or a screenshot.
• Advantages: a photo of the code stops being valid within moments; you don’t need to do anything special.
• Limits: it depends on whoever issues the ticket, not on you; many tickets are still a fixed code in a PDF.
• Example: at the stadium entrance you open the app and show a code that changes as you look at it.
• Complexity: basic.

Guest network and sharing Wi-Fi from the screen

Many routers let you create a guest network, separate from the one your household devices use; many phones display a QR code on screen to share the network, with no need to print it.

• Risk reduced: the main network password being read from the card that ended up in the background of a photo.
• Advantages: people on the guest network can’t see your household devices; a code shown on the spot doesn’t stay stuck to the fridge.
• Limits: it has to be set up once on the router; some older routers don’t offer it. Where to start is explained in the resource on home network security.
• Example: you print the guest network’s code for visitors, not the main network’s.
• Complexity: intermediate.

2. Detection technologies

Code recognition in images

Many photo galleries and cameras can recognise a code even inside a photo that’s already saved, and offer to open it.

• Risk reduced: a code that escaped a first look, in the background or in a reflection.
• Advantages: it becomes a simple test: if your phone can read the code from the photo you’re about to post, so can anyone.
• Limits: a negative test is not a guarantee: other readers may succeed where yours didn’t.
• Example: before posting, you open the covered photo in your gallery and check that the phone no longer offers any link or text.
• Complexity: basic.

Link preview before opening

When you scan a code, your phone usually shows the address or the name of the site before opening it.

• Risk reduced: landing on a fake site from a counterfeit code, or one stuck over the real one.
• Advantages: it gives you time to read the domain (the main part of the address, before the first slash) and ask yourself whether that’s what you expected.
• Limits: shortened links hide the final destination; an address starting with https only means the connection is encrypted, not that the site is honest, as the recommendation on browsing only over HTTPS explains. The most common tricks are gathered in the post on QR code attacks.
• Example: the code on a parking meter offers an address that looks nothing like the local council’s: you don’t open it, and you pay through the app or website you already know.
• Complexity: basic.

Notifications from whoever issued the code

Emails, messages and official app notifications when a booking is changed, a check-in completed or a ticket scanned.

• Risk reduced: someone else using your code without you noticing.
• Advantages: they arrive on their own and let you react before the trip or the event.
• Limits: precisely because people expect them, they’re imitated by fake messages; always check through the official app or website. The signs to recognise are in the post on the signs someone used your QR code.
• Complexity: basic.

3. Response technologies

Revoking and reissuing the code

The ability of whoever issued a ticket, a badge or a dynamic code to cancel it and create a new one.

• Risk reduced: an exposed code that stays valid.
• Advantages: the old code stops working; with dynamic codes, a single change on the server is enough.
• Limits: a static code with plain-text data can’t be “recalled”: the name and booking remain readable in every copy of the photo.
• Example: you ask the organiser, through official channels, to replace the ticket that ended up in a story.
• Complexity: variable.

Changing credentials and linked devices

When the code contained a key, the answer is to change the key: the Wi-Fi password, or unlinking paired devices from the section of the account that lists them.

• Risk reduced: access that continues after the code was exposed.
• Advantages: it makes the posted code useless, even in copies other people saved.
• Limits: when you change the Wi-Fi password, every device in the house has to be reconnected. The step-by-step order is in the post on how to hide a QR code in a photo.
• Complexity: basic.

4. Governance technologies

These become relevant when the codes aren’t only yours: a family, a team, an association, a small guest house.

“Reference” codes rather than “content” codes

Whoever generates codes can put just an identifier in them, checked on their own server, instead of a name, an address or a password.

• Risk reduced: personal data readable by anyone who scans the code.
• Advantages: it applies data minimisation (collecting and exposing only what’s needed); it makes revocation possible.
• Limits: it needs a system to verify the codes; it doesn’t depend on the people receiving them.
• Complexity: advanced.

Shared rules on photos and codes

A few written guidelines: no badges in office photos, Wi-Fi codes out of shot, permission before posting other people’s tickets.

• Risk reduced: behaviour that varies from one person to the next.
• Advantages: they turn individual care into a shared habit.
• Limits: they only work if they’re simple and remembered.
• Complexity: intermediate.

Training and awareness

Short sessions that explain what’s inside a code, not just that it should be covered.

• Risk reduced: half-done covers, or covers made with unreliable effects.
• Advantages: people who understand the why choose the right method on their own; it’s the pillar on which the Cyber Welfare Framework rests.
• Limits: it requires continuity.
• Complexity: basic.

Comparison table

How to choose

If you’re an individual. Cropping or a solid box before every photo with a ticket, a parcel or a document, plus the recognition test in your gallery; for other people’s codes, the link preview. Who sees your photos also depends on who you accept as a contact, as the recommendation on connecting only with people you know explains; the location saved in the file is a separate topic, covered in the recommendation on turning off photo geotagging.

If you travel often or work with a badge. Add the habit of keeping boarding passes and badges out of every shot, turning on airline notifications, and treating pairing codes like a house key: you don’t photograph them and you don’t forward them.

If you manage a group or a small business. A guest network with its own code, a few shared rules on photos and, if you generate codes yourself, only a reference inside them, not personal data.

A rule of thumb. No technology removes risk on its own. The combination that gives the best result for the effort is a solid box + the recognition test before posting: if your phone no longer reads anything and the box covers everything, edges and printed numbers included, you’ve done the part that matters.

How this connects to the Cyber Welfare Framework

Reference level: FL2 — Beginner. This is the level at which you move from automatic gestures to your first informed choices: understanding the mechanism is enough to treat every code with the right care.

Conclusion

Knowing how QR codes work takes some of the mystery out of an object we use every day. Inside there is only text: a menu, a booking, a password. Error correction makes it robust, and it’s that very robustness that asks us, when we cover a code, to cover all of it. If you’d like to know where to start, the digital resilience self-assessment gives you a reference point.

What to do next. Open a recent photo of yours with a ticket or a parcel in it and check whether your phone’s gallery recognises the code. If it does, you already know what to cover next time.

Related content

• Posting photos with QR codes — the recommendation this belongs to
• How to hide a QR code in a photo — how to put these technologies into practice, in order
• QR code attacks — the abuses these technologies are designed against
• Signs someone used your QR code — what notifications and checks look out for
• Risks of QR codes in photos — what’s at stake with a readable code

Related resources

Short explainers from the Resources section, for anyone who wants to focus on a single aspect:

• Home Network Security: The Router Nobody Configures
• How to Recognise Phishing When It Is Built to Be Convincing

Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.