Wirebook › Bonus lesson
Can a sticker change where a QR code takes you?
A QR code is just a square of black and white dots, yet your phone turns it into a web address in a blink. How does it know where the dots start, how does it survive a scratch, and could someone stick a different code on top? Build a code, damage it and try a real scanner, then be the sticker detective. Everything happens in your browser, and no link on this page is ever opened.
How a camera reads the grid
- Three big corner squares (finder patterns) are the first thing a scanner hunts for. Their black-white-black-white-black stripes look the same from any direction, so the phone knows where the code is, how big it is and which way up it is, even upside down or at an angle. The fourth corner has no big square, and that missing one tells it the rotation.
- The dotted timing lines between the corners are like the marks on a ruler: they let the scanner count the rows and columns.
- The small alignment square (bigger codes have several) helps when the paper is curved or the photo is tilted.
- The format notes next to the corners say how much spare data there is and which mask was used. A mask flips some squares in a fixed pattern so the code never has big blank patches or stripes that could look like a corner square.
- Everything else is your message, written in zigzag columns from the bottom right, followed by spare error correction data that can rebuild missing pieces.
Why spare data works (and when it can't)
The spare data isn't a second copy of the message. It's a clever set of extra numbers worked out from the message (a checksum's much smarter cousin), so that if some pieces go missing the scanner can work backwards and rebuild them. More spare data lets it rebuild more, but it needs more squares, so the same message makes a bigger, busier grid. That is why a code with a logo in the middle usually uses level H: the logo is deliberate damage.
Two things spare data can't fix. If one of the corner squares is covered, the scanner never finds the grid in the first place. And if a whole new code is stuck on top, there is nothing to repair: the scanner happily reads the new code, because it is a perfectly good QR code. Which brings us to the detective work.
The habits that beat a fake code
- Why tricksters like QR codes. You can't read a code by eye, and a sticker costs pennies. Fake parking and payment codes stuck on real machines have been reported in many countries; the trick has a name, quishing.
- Short links hide the destination. A code that goes to a link shortener only shows the shortener's name. That doesn't mean it's bad, but you can't check it, so be extra careful if money is involved.
- Not every code is a website. A code can fill in a Wi-Fi password, a contact card, a phone number or a text message. A good scanner tells you which before doing anything.
Grown-up twins: Tooltern's QR code scanner reads a code from a photo or screenshot and shows the real site name with warning signs (it never opens the link), the guide Is this QR code safe?, and the QR code maker with its spare-data levels.