QR code

QR code

A QR code (quick-response code) is a type of two-dimensional matrix barcode, invented in 1994, by Japanese company Denso Wave for labelling automobile parts. A barcode is a machine-readable optical image that contains information specific to the labelled item. In practice, QR codes contain data for a locator, an identifier, and a website visitor tracking. To efficiently store data, QR codes use four standardized modes of encoding (i) numeric, (ii) alphanumeric, (iii) byte or binary.
A QR code consists of black squares arranged in a square grid on a white background, including some fiducial markers, which can be read by an imaging device such as a camera, and processed using Reed–Solomon error correction until the image can be appropriately interpreted. The required data is then extracted from patterns that are present in both horizontal and vertical components of the image.

History:

The QR code system was invented in 1994 under a team led by Masahiro Hara from the Japanese company Denso Wave. The initial design was influenced by the black and white pieces on a Go board, the position detection pattern was found using the least used ratio in black and white areas on printed matter can avoid misidentifying, which was 1:1:3:1:1. Its purpose was to keep track of automotive parts manufactured by Denso, to replace several bar codes on each box, each of which had to be scanned separately, with the requirement of high capacity that is able to encode Kanji, Kana and alphanumerics together.

Standards:

There are several standards that cover the encoding of data as QR codes:

October 1997 – AIM (Association for Automatic Identification and Mobility) International

January 1999 – JIS X 0510

June 2000 – ISO/IEC 18004:2000 Information technology – Automatic identification and data capture techniques – Bar code symbology – QR code (now withdrawn)

Defines QR code models 1 and 2 symbols.

1 September 2006 – ISO/IEC 18004:2006 Information technology – Automatic identification and data capture techniques – QR Code 2005 bar code symbology specification (now withdrawn)

Defines QR code 2005 symbols, an extension of QR code model 2. Does not specify how to read QR code model 1 symbols or require this for compliance.

1 February 2015 – ISO/IEC 18004:2015 Information – Automatic identification and data capture techniques – QR Code barcode symbology specification

Renames the QR Code 2005 symbol to QR Code and adds clarification to some procedures and minor corrections.

May 2022 – ISO/IEC 23941:2022 Information technology – Automatic identification and data capture techniques – Rectangular Micro QR Code (rMQR) bar code symbology specification

Defines the requirements for Micro QR Code.

At the application layer, there is some variation between most of the implementations. Japan's NTT DoCoMo has established de facto standards for the encoding of URLs, contact information, and several other data types.[19] The open source "Zing" project maintains a list of QR code data types.

Uses:

QR codes have become common in consumer advertising. Typically, a smartphone is used as a QR code scanner, displaying the code and converting it to some useful form (such as a standard URL for a website, thereby obviating the need for a user to type it into a web browser). QR code has become a focus of advertising strategy, since it provides a way to access a brand's website more quickly than by manually entering a URL. Beyond mere convenience to the consumer, the importance of this capability is that it increases the conversion rate: the chance that contact with the advertisement will convert to a sale. It coaxes interested prospects further down the conversion funnel with little delay or effort, bringing the viewer to the advertiser's website immediately, whereas a longer and more targeted sales pitch may lose the viewer's interest.

Although initially used to track parts in vehicle manufacturing, QR codes are used over a much wider range of applications. These include commercial tracking, warehouse stock control, entertainment and transport ticketing, product and loyalty marketing and in-store product labeling. Examples of marketing include where a company's discounted and percent discount can be captured using a QR code decoder that is a mobile app, or storing a company's information such as address and related information alongside its alpha-numeric text data as can be seen in Yellow Pages directories.

They can also be used in storing personal information for use by organizations. An example of this is Philippines National Bureau of Investigation (NBI) where NBI clearances now come with a QR code. Many of these applications target mobile-phone users (via mobile tagging). Users may receive text, add a vCard contact to their device, open a URL, or compose an e-mail or text message after scanning QR codes. They can generate and print their own QR codes for others to scan and use by visiting one of several pay or free QR code-generating sites or apps. Google had an API, now deprecated, to generate QR codes, and apps for scanning QR codes can be found on nearly all smartphone devices.

QR codes have been incorporated into currency. In June 2011, The Royal Dutch Mint (Koninklijke Nederlandse Munt) issued the world's first official coin with a QR code to celebrate the centenary of its current building and premises. The coin can be scanned by a smartphone and originally linked to a special website with contents about the historical event and design of the coin. In 2014, the Central Bank of Nigeria issued a 100-naira banknote to commemorate its centennial, the first banknote to incorporate a QR code in its design. When scanned with an internet-enabled mobile device, the code goes to a website that tells the centenary story of Nigeria. In 2015, the Central Bank of the Russian Federation issued a 100-rubles note to commemorate the annexation of Crimea by the Russian Federation. It contains a QR code into its design, and when scanned with an internet-enabled mobile device, the code goes to a website that details the historical and technical background of the commemorative note. In 2017, the Bank of Ghana issued a 5-cedis banknote to commemorate 60 years of Central Banking in Ghana, and contains a QR code in its design, which when scanned with an internet-enabled mobile device, that code goes to the official Bank of Ghana website.

Displaying multimedia contents:

QR codes also used to direct users to specific multimedia content (such as videos, audios, images, documents and any type of content accessible from the web). This type of QR code is called "Multimedia QR code".

Mobile operating system:

QR codes can be used on various mobile device operating systems. iPhones running on iOS 11 and higher and some Android devices can natively scan QR codes without downloading an external app. The camera app is able to scan and display the kind of QR code (only on iPhone) along with the link (both on Android and iPhone). These devices support URL redirection, which allows QR codes to send metadata to existing applications on the device. Many paid or free apps are available with the ability to scan the codes and hard link to an external URL.

Virtual stores:

QR codes have been used to establish "virtual stores", where a gallery of product information and QR codes is presented to the customer, e.g., on a train station wall. The customers scan the QR codes, and the products are delivered to their homes. This use started in South Korea, and Argentina, but is currently expanding globally. Walmart, Procter & Gamble and Woolworths have already adopted the Virtual Store concept.

Website login:

QR codes can be used to log into websites: a QR code is shown on the login page on a computer screen, and when a registered user scans it with a verified smartphone, they will automatically be logged in. Authentication is performed by the smartphone, which contacts the server. Google tested such a login method in January 2012.

Mobile ticket:

There is a system whereby a QR code can be displayed on a device such as a smartphone and used as an admission ticket. Its use is common for J1 League and Nippon Professional Baseball tickets in Japan. In some cases, rights can be transferred via the Internet.

QR code payment:

QR codes can be used to store bank account information or credit card information, or they can be specifically designed to work with particular payment provider applications. There are several trial applications of QR code payments across the world. In developing countries like China, India and Bangladesh QR code payment i a very popular and convenient method of making payments. Since Alipay designed a QR code payment method in 2011, mobile payment has been quickly adopted in China. As of 2018, around 83% of all payments were made via mobile payment.

In November 2012, QR code payments were deployed on a larger scale in the Czech Republic when an open format for payment information exchange – a Short Payment Descriptor – was introduced and endorsed by the Czech Banking Association as the official local solution for QR payments. In 2013, the European Payment Council provided guidelines for the EPC QR code enabling SCT initiation within the Eurozone.

In 2017, Singapore created a taskforce including their Government Agencies such as the Monetary Authority of Singapore and Infocomm Media Development Authority to spearhead a system for e-payments using standardized QR code specifications. These specific dimensions are specialized for Singapore’s market.

The e-payment system, Singapore Quick Response Code (SGQR), essentially merges various QR codes into one label that can be used by both parties in the payment system. This allows for various banking apps to facilitate payments between multiple customers and a merchant that displays the single QR code.

A single SDQR label contains e-payments and combines multiple payment options. Once consumers spot the SGQR label, they will be able to scan it and see which payment options the merchant accepts. The SGQR scheme is co-owned by MAS and IMDA.

Website login:

QR codes can be used to log into websites: a QR code is shown on the login page on a computer screen, and when a registered user scans it with a verified smartphone, they will automatically be logged in. Authentication is performed by the smartphone, which contacts the server. Google tested such a login method in January 2012.

Mobile ticket:

There is a system whereby a QR code can be displayed on a device such as a smartphone and used as an admission ticket. Its use is common for J1 League and Nippon Professional Baseball tickets in Japan. In some cases, rights can be transferred via the Internet.

Design:

Unlike the older, one-dimensional barcodes that were designed to be mechanically scanned by a narrow beam of light, a QR code is detected by a 2-dimensional digital image sensor and then digitally analyzed by a programmed processor. The processor locates the three distinctive squares at the corners of the QR code image, using a smaller square (or multiple squares) near the fourth corner to norm
alize the image for size, orientation, and angle of viewing. The small dots throughout the QR code are then converted to binary numbers and validated with an error-correcting algorithm.

Information capacity

The amount of data that can be represented by a QR code symbol depends on the data type (mode, or input character set), version (1, ..., 40, indicating the overall dimensions of the symbol, i.e. 4 × version number + 17 dots on each side), and error correction level. The maximum storage capacities occur for version 40 and error correction level L (low), denoted by 40-L:

Maximum character storage capacity (40-L)
Character refers to individual values of the input mode (data type).

Input mode	Max. characters	Bits/char.	Possible characters, default encoding
Numeric only	7,089	31⁄3	0, 1, 2, 3, 4, 5, 6, 7, 8, 9
Alphanumeric	4,296	51⁄2	0–9, A–Z (upper-case only), space, $, %, *, +, -, ., /, :
Binary/byte	2,953	8	ISO/IEC 8859-1
Kanji/kana	1,817	13	Shift JIS X 0208

Error correction:

QR codes use Reed–Solomon error correction over the finite field , the elements of which are encoded as bytes of 8 bits; the byte  with a standard numerical value  encodes the field element  where  is taken to be a primitive element satisfying . The primitive polynomial is , corresponding to the polynomial number 285, with initial root = 0. The Reed–Solomon code uses one of 37 different polynomials over , with degrees ranging from 7 to 68, depending on how many error correction bytes the code adds. It is implied by the form of Reed–Solomon used (systematic BCH view) that these polynomials are all on the form , however the rules for selecting the degree  are specific to the QR standard.

When discussing the Reed–Solomon code phase there is some risk for confusion, in that the QR ISO/IEC standard uses the term codeword for the elements of , which with respect to the Reed–Solomon code are symbols, whereas it uses the term block for what with respect to the Reed–Solomon code are the codewords. The number of data versus error correction bytes within each block depends on (i) the version (side length) of the QR symbol and (ii) the error correction level, of which there are four. The higher the error correction level, the less storage capacity. The following table lists the approximate error correction capability at each of the four levels:

Level L (Low)	7% of data bytes can be restored.
Level M (Medium)	15% of data bytes can be restored.
Level Q (Quartile)	25% of data bytes can be restored.
Level H (High)	30% of data bytes can be restored.

Encoding:

The format information records two things: the error correction level and the mask pattern used for the symbol. Masking is used to break up patterns in the data area that might confuse a scanner, such as large blank areas or misleading features that look like the locator marks. The mask patterns are defined on a grid that is repeated as necessary to cover the whole symbol. Modules corresponding to the dark areas of the mask are inverted. The format information is protected from errors with a BCH code, and two complete copies are included in each QR symbol.

The message dataset is placed from right to left in a zigzag pattern, as shown below. In larger symbols, this is complicated by the presence of the alignment patterns and the use of multiple interleaved error-correction blocks.

Meaning of format information. In the above figure, the format information is protected by a (15,5) BCH code, which can correct up to 3 bit errors. The total length of the code is 15 bits, of which 5 are data bits (2 EC level + 3 mask pattern) and 10 are extra bits for error correction. The format mask for these 15 bits is: [101010000010010]. Note that we map the masked values directly to its meaning here, in contrast to image 4 "Levels & Masks" where the mask pattern numbers are the result of putting the 3rd to 5th mask bit, [101], over the 3rd to 5th format info bit of the QR code.

Message placement within a Ver 1 QR symbol (21×21). The message is encoded using a (255,248) Reed Solomon code (shortened to (26,19) code by using "padding") that can correct up to 2 byte-errors. A total of 26 code-words consist of 7 error-correction bytes, and 17 data bytes, in addition to the "Len" (8 bit field) "Enc" (4 bit field), and "End" (4 bit field).

Larger symbol (Ver 3) illustrating interleaved blocks. The message has 26 data bytes and is encoded using two Reed-Solomon code blocks. Each block is a (255,233) Reed Solomon code (shortened to (35,13) code), which can correct up to 11 byte-errors in a single burst, containing 13 data bytes and 22 "parity" bytes appended to the data bytes. The two 35-byte Reed-Solomon code blocks are interleaved so it can correct up to 22 byte-errors in a single burst (resulting in a total of 70 code bytes). The symbol achieves level H error correction.

Mode indicator	Description	Typical structure '[ type : sizes in bits ]'
1 = 0b0001	Numeric	[0001 : 4] [ Character Count Indicator : variable ] [ Data Bit Stream : 31⁄3 × charcount ]
2 = 0b0010	Alphanumeric	[0010 : 4] [ Character Count Indicator : variable ] [ Data Bit Stream : 51⁄2 × charcount ]
4 = 0b0100	Byte encoding	[0100 : 4] [ Character Count Indicator : variable ] [ Data Bit Stream : 8 × charcount ]
8 = 0b1000	Kanji encoding	[1000 : 4] [ Character Count Indicator : variable ] [ Data Bit Stream : 13 × charcount ]
3 = 0b0011	Structured append	[0011 : 4] [ Symbol Position : 4 ] [ Total Symbols: 4 ] [ Parity : 8 ]
7 = 0b0111	ECI	[0111 : 4] [ ECI Assignment number : variable ]
5 = 0b0101	FNC1 in first position	[0101 : 4] [ Numeric/Alphanumeric/Byte/Kanji payload : variable ]
9 = 0b1001	FNC1 in second position	[1001 : 4] [ Application Indicator : 8 ] [ Numeric/Alphanumeric/Byte/Kanji payload : variable ]
0 = 0b0000	End of message	[0000 : 4]

Encoding modes:

Encoding modes

Indicator	Meaning
0001	Numeric encoding (10 bits per 3 digits)
0010	Alphanumeric encoding (11 bits per 2 characters)
0100	Byte encoding (8 bits per character)
1000	Kanji encoding (13 bits per character)
0011	Structured append (used to split a message across multiple QR symbols)
0111	Extended Channel Interpretation (select alternate character set or encoding)
0101	FNC1 in first position (see Code 128 for more information)
1001	FNC1 in second position
0000	End of message (Terminator)

Risks:

The only context in which common QR codes can carry executable data is the URL data type. These URLs may host JavaScript code, which can be used to exploit vulnerabilities in applications on the host system, such as the reader, the web browser or the image viewer, since a reader will typically send the data to the application associated with the data type used by the QR code.

In the case of no software exploits, malicious QR codes combined with a permissive reader can still put a computer's contents and user's privacy at risk. This practice is known as "attagging", a portmanteau of "attack tagging". They are easily created and can be affixed over legitimate QR codes. On a smartphone, the reader's permissions may allow use of the camera, full Internet access, read/write contact data, GPS, read browser history, read/write local storage, and global system changes.