They are on every tea stall, auto-rickshaw and shop counter in India: those black-and-white squares that turned a phone camera into a payment terminal. QR codes power UPI’s astonishing rise, letting a street vendor accept digital payments with nothing but a printed sticker. Yet few people who scan them daily know what they actually are: a clever visual encoding scheme invented for tracking car parts in 1990s Japan, now carrying everything from payment addresses to Wi-Fi passwords to boarding passes. Here is how QR codes work and why they conquered Indian commerce.

What is a QR code, exactly?

QR stands for Quick Response, named for the code’s design goal: fast, reliable scanning. A QR code is a two-dimensional barcode: where traditional barcodes store data in the widths of vertical lines, QR codes store it in a grid of black and white squares, called modules, packing far more information into a small space. A single QR code can hold over 4,000 alphanumeric characters, though payment codes use far less. The format was invented in 1994 by Denso Wave, a Toyota supplier, to track components in factories, and the company deliberately made the patent freely usable, a generosity that enabled its global spread. Three large squares in the corners, the finder patterns, let any scanner instantly detect the code’s position and orientation, even in a blurry photo.

How does scanning actually work?

When your camera sees a QR code, the phone’s software performs a small miracle of image processing in milliseconds. It locates the three finder patterns to establish the code’s position, rotation and size, then samples the grid of modules, reading black as 1 and white as 0. The resulting bitstream is decoded according to the mode: numeric, alphanumeric, binary or Kanji, revealing the stored text or data. Then comes error correction, the QR code’s superpower: using Reed-Solomon mathematics, the code includes redundant data that lets scanners reconstruct the message even if up to 30 per cent of the code is damaged, dirty or obscured. That is why a faded, scratched tea-stall sticker still scans, and why designers can stamp logos in the middle of codes.

How do QR codes power UPI payments?

A UPI QR code is beautifully simple: it encodes the recipient’s payment address, typically a VPA like name@bank, plus optionally the payee name and amount. When you scan it with Google Pay, PhonePe, Paytm or BHIM, your app reads the address, shows you the recipient’s verified name, and asks you to enter the amount and UPI PIN. The money moves through the UPI network in seconds. Static QR stickers encode just the address; dynamic codes generated per transaction include the exact amount, which is why restaurants show you a fresh code on a terminal. The system’s genius is its asymmetry: the merchant needs zero technology beyond a printout, while all the security, encryption, PIN authentication, lives in the customer’s phone and the banking network.

Are QR codes safe?

QR codes themselves are dumb containers; safety depends on what is inside and where you scan. The genuine risks: sticker-swapping fraud, where criminals paste their own QR over a merchant’s, is a documented problem, always verify the recipient name your app displays before entering your PIN. Malicious codes in emails or public places can link to phishing sites; preview URLs before opening. Never scan a QR that asks you to enter your UPI PIN to “receive” money: receiving money never requires a PIN, and any such request is fraud by definition. On the merchant side, the risks are lower but real: verify settlements in your app, not just from customer screenshots. Used with these precautions, QR payments are among the safest digital payment methods because the PIN never leaves your device.

QR codes beyond payments

Payments made QR codes famous in India, but the format does far more.

• Connectivity: restaurant Wi-Fi codes join you to the network without typing passwords.
• Travel: boarding passes, train tickets and event tickets live as QR codes on phones.
• Authentication: WhatsApp Web pairing and two-factor app setups use QR codes to link devices securely.
• Information: product packaging, museum exhibits and government certificates carry codes linking to details or verification pages.
• Marketing: scans bridge physical ads to digital experiences, with measurable engagement.

The pattern is consistent: wherever typing is tedious and accuracy matters, a QR code does the job in a glance.

FAQs

Do QR codes expire? Static codes encoding plain text last indefinitely. Dynamic payment or ticket codes can expire by design; generate a fresh one if scanning fails.

Can a QR code give my phone a virus? Not directly; codes encode text and links. The danger is a link to a malicious site, so preview destinations and keep your phone updated.

Why do some QR codes have logos in the middle? Error correction reconstructs the obscured portion. Up to 30 per cent damage is tolerable, so a centred logo scans fine.

From tracking Toyota parts to transforming Indian commerce, the QR code’s journey is a parable of good design: simple, robust, free to use, and perfectly matched to the phone in everyone’s pocket. The next time you scan a tea stall’s sticker, appreciate the mathematics in those squares, working flawlessly in dust, rain and fading ink.

Source: NPCI