QR Codes: Print Size, Error Correction Levels, and Quishing Risks

1. Choose the error correction level first

QR codes embed redundancy so they still scan when partly damaged. ISO/IEC 18004 defines four levels.

| Level | Recoverable | Typical use |
|---|---|---|
| L | ~7% | On-screen display, clean conditions |
| M | ~15% | General print (default) |
| Q | ~25% | Logo overlay, rougher conditions |
| H | ~30% | Outdoor signage, large logo overlay |

Higher levels survive more damage but require more modules for the same payload, making the code denser. At small print sizes a higher level can actually scan worse, so pick level and size together.

To place a logo in the centre, use at least Q; for a large logo, H.

2. Sizing for print

A widely used rule of thumb:

minimum side length = expected scan distance ÷ 10

30 cm (business card, menu): at least 3 cm

1 m (poster): at least 10 cm

5 m (banner): at least 50 cm

You must also preserve the quiet zone. The standard requires a margin four modules wide. Background patterns or borders intruding into that margin sharply reduce read rates.

3. Shorter payloads scan better

The more data a code carries, the more modules it needs and the denser it gets at a fixed print size.

Shorten long URLs or use a redirect.

Heavy UTM parameters can double a URL's length.

Non-Latin text encodes as UTF-8 and takes roughly three times the bytes of ASCII.

4. Static versus dynamic codes

Static: the destination is encoded in the code itself. No third-party dependency and permanent, but the destination cannot be changed once printed.

Dynamic: the code holds a short URL from an intermediary that forwards to the real destination. You can change the target later and see scan analytics, but the code dies if that service shuts down.

For long-lived print such as business cards or product labels, this distinction matters.

5. The WiFi QR format

A WiFi credential QR encodes this string:

WIFI:T:WPA;S:NetworkName;P:Password;;

T is the encryption type (WPA, WEP, nopass), S the SSID, P the password. Add H:true; for a hidden network.

Note that anyone who scans this code learns the password. The image is effectively the password, so do not post it online or place it where outsiders can photograph it.

6. Quishing (QR phishing)

A QR's weakness is that a human cannot read the destination before scanning. Attacks that paste a sticker over a legitimate code in public spaces have been widely reported.

Check the domain in the address bar after scanning.

Look for signs of an overlaid sticker on codes at parking meters, EV chargers, and restaurant tables.

Stop if a page reached via QR asks for login or payment details.

7. Generator

The EVEDAYS QR Generator creates codes for URLs, text, WiFi, and contacts and saves them as PNG. Input stays in your browser, so no third-party server keeps a copy. The generated code itself, however, is readable by anyone who scans it — you control who you share it with.

8. Sources

ISO/IEC 18004 — QR Code bar code symbology specification

Korea Internet & Security Agency