A QR code ("Quick Response" code) is a square, two-dimensional barcode that a camera can read from any direction. It stores data, such as a web link or a cryptocurrency payment request, in a grid of black and white squares called modules. In crypto, people mostly use QR codes to share a receiving address and payment details. The sender scans the code instead of typing a long string of characters, which removes the chance of a typo. The code does not check that the address is the right one, though. The sender still has to do that.
Where the QR code came from
DENSO WAVE, then a division of DENSO CORPORATION, announced the QR code in 1994. Masahiro Hara developed it with one other team member. According to DENSO WAVE, barcodes of the time held only about 20 alphanumeric characters. Users wanted more capacity and wanted to encode Kanji and Kana as well as alphanumeric characters. The team also aimed for fast reading, which is where the name "quick response" comes from.
The format then became a standard:
- 1997: approved as an AIM standard for automatic identification
- 1999: approved as a JIS standard 2D code
- 2000: approved by ISO as an international standard
- 2004: Micro QR Code made a JIS standard
DENSO WAVE kept the patent rights but said it would not enforce them, so anyone can use the format freely.
How a QR code stores data
Size: 40 versions
QR code sizes are called versions. Version 1 is 21 × 21 modules and Version 40 is 177 × 177 modules. Each version adds 4 modules per side. The more data you encode, the higher the version, and the denser the code.
Capacity
The largest standard symbol (Model 2, Version 40, at the lowest error correction level) holds at most:
| Data type | Maximum |
|---|---|
| Numeric | 7,089 characters |
| Alphanumeric | 4,296 characters |
| Binary (bytes) | 2,953 bytes |
| Kanji | 1,817 characters |
These are upper limits. Higher error correction or a different data type lowers them.
Error correction
QR codes use Reed-Solomon error correction, so a code can still be read when part of it is dirty or damaged. There are four levels. Each one tolerates damage to roughly this share of the code:
- L: 7%
- M: 15% (DENSO WAVE says this level is the one most often chosen)
- Q: 25%
- H: 30%
Higher levels make a code more robust, but it can hold less data.
Reading from any angle
A standard QR code has three position detection patterns, the large squares in three corners. Micro QR has only one. Each pattern has a black-and-white module ratio of 1:1:3:1:1. The reader uses this ratio to work out the code's rotation and position, which is why DENSO WAVE describes the code as readable from any direction in 360°.
Is this QR code safe to act on?
Answer a few questions about where a QR code came from and what your wallet shows, to see the check the article recommends next.
Where did the QR code come from?
- The recipient's wallet receive screen, shown or sent by the person I am paying → next question
- A code in an unexpected public place, such as a sticker on a parking meter → Check the URL before opening
- An email or text message I was not expecting → Don't scan it
After scanning, does your wallet show an address and amount that match what the recipient gave you?
- Yes, both match → next question
- No, the address or amount differs, or it opened a website instead → Stop and confirm with the recipient
Does your wallet say the payment request contains a required (req-) parameter it does not understand?
- Yes, the wallet rejected or flagged the request → Ask for a new payment request
- No, the wallet read the whole request → The details match: final check
The FTC advises not scanning a QR code in an email or text you weren't expecting. If the message looks real, contact the company through a phone number or website you already know.
Scammers stick their own codes over real ones. Check the URL the code shows before you open it, and do not enter login details on a site you did not expect.
A QR code does not check that the address is the right one. Do not send until the address and amount match what the recipient gave you, because an on-chain payment to the wrong address generally cannot be reversed.
Under BIP 21, a wallet that does not understand a parameter starting with req- must reject the whole URI. Ask the recipient for a request your wallet can read rather than typing the details by hand.
You have confirmed the address and amount against what the recipient gave you, which is the check the article recommends. Keep your phone updated and your accounts protected with strong passwords and multi-factor authentication.
This follows only the checks the article describes: it cannot tell whether a particular address really belongs to the recipient, or whether a website or app is genuine.
How crypto wallets use QR codes
The bitcoin: URI
A Bitcoin wallet's QR code usually holds a bitcoin: URI, not just a bare address. BIP 21 defined the scheme so that users could pay by clicking links or scanning QR codes. Nils Schneider and Matt Corallo wrote it, and it was assigned in 2012. The simplified syntax is:
`` bitcoin:<address>[?amount=<amount>][?label=<label>][?message=<message>] ``
amountis in decimal BTC, with a period as the decimal separator and no commas (amount=50means 50 BTC).labelnames the address, such as the receiver's name.messagedescribes the payment to the person paying.- Any parameter starting with
req-is required. A wallet that does not understand one must reject the whole URI.
Bitcoin's developer documentation says a URI "eliminates denomination confusion and saves the spender from copying and pasting two separate values." It also notes that leaving out optional parameters keeps the QR code small and easy to scan with "unsteady or low-resolution mobile cameras."
BIP 321 replaces BIP 21
BIP 21 is now closed and has been superseded by BIP 321, authored by Matt Corallo and assigned on 15 November 2024. The main changes:
- The address can be left empty if a query parameter supplies a payment instruction.
- It defines standard keys for other ways to pay:
lightning(BOLT 11 invoices),lno(BOLT 12 offers),pay(BIP 351) andsp(BIP 352 Silent Payments). - It adds an optional
pop(proof of payment) parameter. - The scheme and query keys are case-insensitive. The spec notes that this already matched common practice "due to the use of mostly-uppercase URIs in QR codes."
One address per payment
Many people print a single address QR code and reuse it, but Bitcoin's developer guide advises a new address for each payment. It gives two reasons. Reusing a public key lets others "easily track the receiving and spending habits" of the owner. Using each private key for only one signature also protects against a class of attack. For merchants there is a practical reason too: a separate address per payment "makes it trivial to determine which customers have paid." A wallet that generates a fresh receiving QR code each time follows this advice.
QR code scams
A QR code hides its contents until you scan it, and scammers use this. In a consumer alert dated 6 December 2023, the US Federal Trade Commission described scammers sticking their own codes over the ones on parking meters. It also described codes sent by text or email with made-up reasons to scan, such as a failed delivery or a problem with an account. The code leads to a fake site that collects login details, or it installs malware.
The FTC's advice:
- If you see a QR code in an unexpected place, check the URL before you open it.
- Don't scan a QR code in an email or text message you weren't expecting.
- If a message looks real, contact the company through a phone number or website you already know.
- Keep your phone updated, and protect your accounts with strong passwords and multi-factor authentication.
For crypto payments, also check the address and amount your wallet shows after scanning, and confirm them against what the recipient gave you. A payment sent on-chain to the wrong address generally cannot be reversed.
Quick reference
- What it is: a square 2D barcode, readable from any direction, announced by DENSO WAVE in 1994
- Sizes: 40 versions, from 21 × 21 to 177 × 177 modules
- Maximum capacity: 7,089 digits, 4,296 alphanumeric characters, 2,953 bytes or 1,817 kanji
- Damage tolerance: about 7% to 30%, depending on the error correction level
- In Bitcoin: usually a
bitcoin:URI (BIP 21, now BIP 321) carrying an address, amount, label or message - Main risk: a code that leads to a fake site or the wrong address, so check before you open or pay
Limitations: the capacity figures and the L/Q/H error-correction percentages come from a barcode reader manufacturer's documentation, not from DENSO WAVE's own pages or the ISO standard.
