QR codes attract confident claims. Some are old marketing gossip, some are misunderstandings of the maths, one is a good story that happens to be about a different code. Here are the eight we hear most, each with a verdict and the reason behind it.
“QR codes are dead”
Verdict: false, and it has been for a decade.
The claim comes from around 2012, when Western marketers had spent two years printing codes that needed a special app and led to pages not built for phones. Forbes ran the headline in December 2012. Two things changed. Apple built scanning into the iPhone camera with iOS 11 in June 2017 (TechCrunch), and the 2020 pandemic put codes on every menu and check-in desk (International Banker). Meanwhile Asia never stopped: India had 657.9 million UPI payment codes deployed by the end of its 2024 to 2025 financial year (Business Standard). The history article has the whole arc.
“There was a QR code on the Mars rover parachute”
Verdict: false. It was binary, not QR.
When Perseverance landed on 18 February 2021, its parachute showed a pattern of orange and white panels. Within hours enthusiasts had decoded it: the inner rings spelled “Dare Mighty Things” and the outer ring gave the GPS coordinates of NASA’s Jet Propulsion Laboratory. The encoding was plain binary, each panel a 0 or a 1, designed by systems engineer Ian Clark (NASA JPL, CBS News). No finder patterns, no error correction, no phone could scan it. A lovely puzzle, not a QR code.
“We will run out of QR codes”
Verdict: false, by a margin that is hard to picture.
A QR code is not drawn from a pool. It is computed from its content. The largest, version 40 at error-correction level L, holds 2,953 bytes (versions and capacity). That is 2,953 times 8, or 23,624 bits, so there are 2 to the power 23,624 possible messages at that size alone. Written out, that number has about 7,100 digits. The number of atoms in the observable universe has about 80. Every version, level and mask adds more. Nobody is going to run short.
- Atoms in the observable universe (approx.) 80 digits
- Seconds since the Big Bang (approx.) 18 digits
- Distinct version 40 level L codes 7112 digits
“Two different QR codes can look identical”
Verdict: false for different content; true and expected for identical settings.
Decoding is deterministic. A given picture of modules gives one and only one result, so two codes that look the same must hold the same text. In the other direction, the same text at the same version, level and mask produces the same picture every time, from any generator that follows the standard. That is a feature: a code you make today matches one you made last year. Two generators can differ only in how they split the text into encoding modes or which mask they pick, and even then the decoded text is the same. The masking article shows the eight masks.
“You cannot draw a QR code by hand”
Verdict: false. It is fiddly, but people do it.
In July 2025 Seth Larson drew a version 1 code, 21 modules a side, on squared paper with a pen and scanned it successfully (sethmlarson.dev). He used a generator as a reference, encoded his domain in capitals so it fitted alphanumeric mode, and found the scanner locked on as soon as the three finder patterns and the timing lines were in place. He also made small mistakes in the data area and the code still read, even at level L, which is error correction doing its job. What you cannot do is invent the pattern from scratch without doing the encoding maths; you copy a computed one.
“Why are there three squares, not four?”
Verdict: a real design choice, not a mistake.
Three finder patterns are enough to fix position, rotation and skew: three points define a plane. A fourth would cost a corner’s worth of data modules for no extra information. The bottom-right corner is used for data instead, and the small alignment patterns handle distortion in bigger codes. Denso’s designers chose the 1:1:3:1:1 ratio of the finders because it was the pattern least likely to occur in ordinary printed material (Denso Wave). The anatomy article has the picture.
“A QR code can hack your phone”
Verdict: false on its own; the link it carries is the risk.
A QR code is text. Scanning it does not execute anything. What can hurt you is what the text asks for: a phishing page, a rogue Wi-Fi network, a login-approval trick. Your phone shows the address before opening it, and that banner is the whole defence (Apple support). The FBI and FTC advisories of 2025 and 2026 describe scams that all depend on the victim tapping through and typing something in. The security article covers each one.
“QR codes expire”
Verdict: depends which kind. Static never; dynamic can.
A static code contains its destination. Print it on a gravestone and it will read in fifty years, provided the website still exists. A dynamic code contains a short link to a redirect service. If that service closes, or your subscription lapses, the code leads nowhere even though the squares are unchanged. “Expiry” is a property of the service, not the code. The static versus dynamic article explains how to choose.
Common mistake
Believing a free “QR code generator” website gave you a permanent code when it actually gave you a dynamic one on a trial. Decode your code with the decoder tool. If the text is your own address, it is static. If it is somebody else’s short link, it will expire when they say so.
▸The arithmetic behind 2 to the power 23,624
Version 40 at level L has 3,706 codewords of 8 bits, of which 2,956 are data codewords; after the 4-bit mode indicator and 16-bit character count, 2,953 whole bytes remain for content. Each byte has 256 values, so the count of distinct payloads is 256 to the power 2,953, which is 2 to the power 23,624. Its decimal length is 23,624 times log base 10 of 2, about 7,112 digits. The counts for other versions and levels are in the capacity table; the total across all of them is dominated by this one term.
Try it yourself
Make two codes with the same text at levels M and H in the app, then decode both with the decoder tool. Same text, different squares, identical result.