How QR codes on products work, from the printed square to your screen

A QR code on a product is simply a link (or a short piece of text) encoded as a pattern of black and white squares. Your phone's camera decodes the pattern back into text and, if it is a web address, offers to open it. What you actually see after that is decided by the website the code points to, not by the code itself.

What a QR code really contains

A QR code doesn't "do" anything. It is a compact way of storing a string of characters so that a camera can read it quickly and reliably. On packaging, that string is almost always a URL, often with an extra identifier at the end.

A QR code can also hold:

• plain text, such as a batch number or product code;
• a contact card;
• Wi-Fi network details;
• a phone number or a pre-filled message.

Brands nearly always choose a URL. It opens on any smartphone, and the brand can update the page behind it without reprinting a single box.

How your phone reads it

Here is what happens in the second or so after you point the camera at a code:

1. The camera spots the three large squares in the corners. These finder patterns tell the phone where the code is, how it is rotated and at what angle it was captured.
2. The software straightens the image and reads the grid of small modules, the light and dark cells.
3. The modules are converted into data. QR codes include error correction, so a code that is scratched, creased or partly covered by glare can often still be read.
4. Your phone shows the result. If it is a link, you see a preview of the address and decide whether to open it.

Most modern phones do this in the built-in camera app, no extra download needed. If a code won't scan, move closer, tilt the package to kill the glare, or wipe the surface.

Static vs unique QR codes

All QR codes look alike, but product codes fall into two very different groups.

With a unique code, every package carries its own identifier. When the server receives a request, it knows not just that "someone scanned our product" but exactly which unit was scanned. That is the foundation for product authentication QR codes, one-time digital rewards and collectible rewards tied to a single buyer.

What happens between the scan and the page

When you open the link, your phone sends a request to the website's server. From there, a few things can happen:

• A plain page. Everyone gets the same content, such as a user manual.
• A redirect. The code points to a short address that forwards you to the real page. This lets a brand change the destination at any time.
• A code lookup. The server checks its database: does this code exist, has it been used, which product or batch does it belong to? The answer determines which screen you see.
• An account action. If the code is meant to give you something (a loyalty reward, a warranty registration, a digital collectible), the site asks you to sign in or sign up so the result can be linked to you.

The key point: the server makes the decision, not the printed pattern. The same code can lead to a manual today and a refreshed page tomorrow.

Why a code sometimes doesn't work

It is rarely your phone. Usually it is one of these:

• Poor printing or damage. The code is too small, blurred, printed on glossy film or badly crumpled.
• Low contrast. A pale code on a pale background, or a code printed in the package's brand color, can be hard for a camera to pick out.
• Already redeemed. One-time codes will tell you they have been activated before. That is expected behavior, not a bug.
• The page is down. The site isn't responding, or you have no connection.
• A sticker on top of the original. Sometimes someone places a different code over the real one. Our guide to QR code safety explains how to spot that.

How Crypto Sticker does it

Partner products carry a unique Cryptoscope QR code. Each code belongs to one item and can be activated once. For the shopper, the flow looks like this:

1. Scan the code with your phone camera and check that the preview shows the official domain, cryptosticker.org.
2. The site checks the code: does it exist, and has it already been activated?
3. If it is valid, you are asked to sign in or create an account.
4. Once you are signed in, a collectible sticker appears in your personal collection, along with its own public passport page in the registry.

After activation the link stops working, so scanning the same code again won't give anything. That is also why you shouldn't post or forward the code or link before activating it: someone else could use it first. See Cryptoscope and how it works for the details.

Quick answers

Do I need a special app?

Usually not. The built-in camera on most smartphones reads QR codes. You only need a separate app if the brand specifically says so.

Can a QR code install something on my phone by itself?

No. The code is just text and can't run anything. The risk comes from opening a link to a dodgy site and then downloading something or typing in your details there. Always check the address before you tap.

Why would a brand bother with unique codes?

A shared code is fine for information. Unique codes matter when you need to tell one item from another: confirming it's genuine, giving a reward only once, or linking a digital item to a specific customer. To see what else can sit behind a code, read what happens after you scan a QR code. If you are on the brand side, QR codes on product packaging covers placement and printing.

The short version

A QR code is a convenient way to print a link. The camera reads the pattern, the phone shows the address, and the website does the rest. Static codes send everyone to the same page; unique codes let the site recognize a specific item and, for example, hand out something exactly once. Check the address before you open it, and keep one-time codes private until you have activated them.