QR code decoding involves multiple image processing stages. First, the scanner locates the three finder patterns — the distinctive square-in-square markers at three corners of the code — which establish position, orientation, and scale. Next, alignment patterns (present in version 2+) correct for perspective distortion. The decoder then samples the data modules (black and white cells) in a zigzag pattern, applies the appropriate mask to invert certain modules, and finally runs Reed-Solomon error correction to recover the encoded bitstream.

Error correction is what makes QR codes remarkably resilient. Reed-Solomon codes add redundant data that allows recovery even when part of the code is unreadable. Level L recovers from 7% damage, Level M from 15%, Level Q from 25%, and Level H from 30%. This is why QR codes can still scan with a logo in the center, a coffee stain on the corner, or scratches from handling — the error correction reconstructs the missing data from the surviving portions.

QR code scanning can use live camera input or process a static image. Camera-based scanning continuously analyzes video frames, detecting and decoding QR codes in real time using the device camera. Image upload decoding processes a single photograph or screenshot containing a QR code. Both methods use the same underlying detection and decoding algorithms, but camera scanning adds the complexity of autofocus, exposure compensation, and real-time frame processing.

QR phishing (QRishing) is an increasingly common attack where malicious QR codes redirect users to credential-harvesting or malware-distribution websites. Because QR codes are opaque — you cannot read the encoded URL by looking at the pattern — scanning an untrusted code is equivalent to clicking a shortened URL from an unknown sender. A responsible QR reader should always display the decoded content before taking action, allowing the user to inspect URLs before navigating to them.