Short answer: a QR code scans reliably when it holds only the data it needs, keeps a clear blank border of four modules on every side, uses dark modules on a light background with strong contrast, and is printed large enough for the distance people will scan from. Always test it on more than one phone before printing. A QR code is only as trustworthy as the place it points to, so check the destination, and teach people to check it too.

This guide explains how QR codes work at a practical level, how to choose the right content type, and how to avoid the problems that make codes fail or put people at risk.

How QR codes work, in brief

A QR code is a two-dimensional barcode. Its small black and white squares are called modules, and each module stores part of the data. DENSO WAVE, the company that developed the QR code, explains that symbols come in versions from 1 to 40: Version 1 is 21 × 21 modules and Version 40 is 177 × 177 modules, with each version adding four modules per side.

The more data you put in, the higher the version, and the more modules the code needs. That matters more than any design choice: a short link produces a code with fewer, larger modules that is easy to scan, while a long link or a long block of text produces a dense code that can fail when printed small.

The three large squares in the corners are what make a QR code instantly recognisable, and DENSO WAVE lists among the QR code’s features that it can be read from any direction (360°) and resists dirt and damage. The rest of the pattern holds your data, plus extra error correction data that lets the scanner recover the content if part of the code is dirty or damaged.

Choose the right content type

A QR code can hold several kinds of content. The type changes what the phone does after scanning, so pick the one that matches the job.

  • URL: opens a web page. Best for menus, product pages, event details and forms.
  • Text: shows plain text. Useful for a short note or a code, but phones won’t act on it.
  • Wi-Fi: joins a network after the user confirms, without typing the password.
  • Email, phone or SMS: starts a message or call with the details filled in.
  • Contact (vCard): offers to save a contact card with name, phone, email and website.

The ARAIJA QR Code Generator supports all of these types and creates the code in your browser, so the content isn’t sent to ARAIJA. If you type an email address into the text box, it suggests the email type instead, because a code with the correct type works more predictably.

URL, Wi-Fi and contact examples

Use the full address, including https://, and keep it as short as you reasonably can. ARAIJA only accepts links that start with https:// or http://, which prevents codes from carrying other kinds of addresses that phones might handle unexpectedly.

A Wi-Fi network

Wi-Fi codes follow a widely used text pattern that starts with WIFI: and lists the security type, network name and password; the ZXing project documents this format. Two cautions apply. First, anyone who scans the code can read the password, so only display it where everyone who can see it should have access. Second, if you’re setting up a network, make the Wi-Fi password long and random before you share it. The ARAIJA Password Generator creates one in your browser, and a QR code means guests never need to type it.

A contact card

Contact codes usually use the vCard format, defined in RFC 6350. Include only what you want to share publicly, such as a work phone instead of a personal one, because the data is printed in plain form inside the code.

Quiet zone and contrast

A QR code with its four-module quiet zone highlighted, beside three versions: dark on light, low contrast and inverted colours

The blank border and strong contrast matter more than decoration.

Quiet zone

DENSO WAVE’s guidance on determining the code area says a QR code needs a clear margin, the quiet zone, at least four modules wide on all sides. Without it, a scanner can mistake nearby text, borders or background patterns for part of the code. This is one of the most common reasons a printed code fails: someone crops the white border to make it fit, or places it against a busy photo.

ARAIJA sets a four-module quiet zone by default and won’t go below it.

Contrast

Scanners look for the difference between dark and light modules. The safest choice is very dark modules on a very light background. Problems start when:

  • the colours are too similar, such as mid-grey on light grey;
  • the code is inverted, light modules on a dark background, which some scanner apps can’t read;
  • a background image or gradient runs through the code.

ARAIJA checks the colour contrast and turns off downloading when the colours are too close or when the background is darker than the code.

Appropriate sizing for the use case

There is no single minimum print size that works everywhere. The size a code needs depends on several things together:

  • Data density: more data means more modules, so each module is smaller at the same overall size.
  • Scanning distance: a code on a table is read from a few centimetres away; a code on a poster may be read from across a room.
  • Print and display quality: blurry printing, glossy laminate, glare and low-resolution screens all reduce the margin for error.
  • The phones people use: cameras and scanner apps vary.

DENSO WAVE’s guidance shows that once the version and the module size are set, the size of the whole symbol follows from them, including the quiet zone. In practice, that means: keep the content short so the version stays low, print as large as the space reasonably allows, and test at the real distance before printing in bulk.

Error correction and visual customisation

QR codes include error correction, so a scanner can restore the data if part of the code is dirty or damaged. There are four levels: L, M, Q and H. DENSO WAVE notes that raising the level improves recovery but also increases the amount of data, and therefore the size of the code. It describes Level M (around 15%) as the most frequently selected, Q or H for dirty environments such as factories, and L for clean environments with a lot of data.

ARAIJA chooses the level automatically by default. You can set it yourself under Advanced settings.

Styling is where many codes go wrong. Rounded dots and brand colours can work, but every change removes some of the margin for error. ARAIJA offers Classic, Rounded and Modern Color styles, and recommends Classic as the easiest to scan. Whatever you choose:

  • keep the three corner squares clearly visible;
  • don’t place a logo or picture over the code;
  • keep strong contrast between modules and background;
  • test the final printed version, not just the screen preview.

PNG vs SVG output

  • PNG is a grid of pixels. It’s perfect for screens, documents, chat and social media. Choose a large PNG size if you might print it, because enlarging a small PNG later makes it blurry.
  • SVG is a vector format that describes shapes, so it stays sharp at any size. It’s usually the better choice for printers and design software.

ARAIJA can download both. If you’re unsure, download both and keep the SVG for print.

Real-world scan verification checklist

Before you print or publish a code, check:

  1. It opens the right destination, with no typing mistakes in the link.
  2. It scans on at least two different phones, ideally one iPhone and one Android phone.
  3. It scans at the real distance and in the real lighting where people will use it.
  4. The quiet zone survived cropping, framing and layout.
  5. Printed colours still have strong contrast; ink can look lighter on paper than on screen.
  6. The Wi-Fi code actually joins the network, and the contact code imports the right fields.
  7. Someone besides you has tried it.

Common scanning problems

Problem Likely cause Fix
Scanner doesn’t react Quiet zone cropped, or busy background Restore a four-module blank border
Works on screen, fails in print Printed too small for the data, or blurry print Shorten the content, print larger, use SVG
Works close, fails at distance Modules too small for the distance Increase the printed size
Some phones fail Low contrast or inverted colours Use dark modules on a light background
Opens the wrong page Typo in the link or an outdated address Fix the content, then regenerate and reprint
Code gets damaged outdoors Dirt, scratches or weather Protect the print; consider a higher error correction level

QR phishing and malicious destinations

A QR code hides its destination until someone scans it, which makes it attractive to scammers. The US Federal Trade Commission’s consumer alert from September 2026 describes scammers covering legitimate QR codes on parking meters with their own codes that lead to fake sites designed to steal money or personal information. The FBI’s Internet Crime Complaint Center warned in 2022 that criminals tamper with QR codes to redirect people to malicious sites. The FTC has also warned that scammers hide harmful links in QR codes sent by email and text.

Practical advice drawn from those agencies:

  • Check the link preview before opening it. Look for misspellings or swapped letters in the domain name.
  • Look for stickers placed over a printed code.
  • Be careful entering logins, personal or payment details on any site you reached from a QR code.
  • Don’t install apps from QR codes. Use your phone’s official app store.
  • Keep your phone’s system and apps updated.

If you create codes for others, help them stay safe: print the destination address in readable text next to the code, use your own recognisable domain, and check public codes regularly for tampering.

Most importantly, generating a QR code doesn’t make the destination safe. ARAIJA encodes exactly what you enter. It doesn’t scan, approve or verify websites.

Practical workflows

A table code for a restaurant menu

  1. Use the URL type with the shortest stable link to the menu.
  2. Keep the Classic style, the four-module quiet zone and automatic error correction.
  3. Download SVG for printing and test the printed card on two phones.
  4. Print the menu’s web address in small text under the code.

A guest Wi-Fi card

  1. Create a separate guest network if your router supports it.
  2. Generate a long random password for that network.
  3. Use the Wi-Fi type, then test that the code actually joins.
  4. Display it only where guests should have access.

A contact code for an event badge

  1. Use the Contact type with work details only.
  2. Keep the fields brief, since less data means a simpler code.
  3. Test the import on both iPhone and Android.

FAQ

Do QR codes expire?

A static QR code stores its content directly, so the code itself doesn’t expire. It stops being useful when the destination, such as a web page or a Wi-Fi password, changes.

Can I put a logo in the middle?

You can, relying on error correction, but it reduces the margin for error and some phones may fail. For important codes, a clean Classic code is safer.

Is SVG always better than PNG?

For print, usually yes. For chat, social media and documents, PNG is simpler and widely accepted.

Can a QR code contain a virus?

A QR code contains data, such as a link. The risk comes from where it leads, which is why checking the destination matters.

Summary and next step

Choose the correct content type, keep the data short, protect the four-module quiet zone, use dark modules on a light background, print at a size that suits the scanning distance, and test on real phones before publishing. Then make safety part of the design: show the destination, use a recognisable domain, and remind people to check before they tap.

When you’re ready, create your code, download both PNG and SVG, and run through the checklist above.

Sources

QR Code is a registered trademark of DENSO WAVE INCORPORATED.