Email or username:

Password:

Forgot your password?
blinry

Learn how QR codes work, and how to read them without a computer!

@piko and I just released the interactive explainer that we used in our workshop at #37c3!

qr.blinry.org

65 comments
jesterchen42

@saper @blinry @piko If you understand German, perhaps have a look at arminhanisch.de/2018/10/qr-cod (both of you, one for reading, one for perhaps getting input for the article). :)

lamitpObuS

@blinry @piko To follow the talk was quite fun. Most probably I will never try to decode a QR code by hand.

Regarding the separators. It's mentioned there need to be empty lines around the finder pattern, highlighted on two sides. When I place the QR code on a black background it cannot be scanned any more.

* Has a QR code always to be placed on a white/light background?
* Must empty lines surround the whole finder patterns?
* Is it just a weakness in the QR code readers?
* What do I miss?

@blinry @piko To follow the talk was quite fun. Most probably I will never try to decode a QR code by hand.

Regarding the separators. It's mentioned there need to be empty lines around the finder pattern, highlighted on two sides. When I place the QR code on a black background it cannot be scanned any more.

blinry

@lamitpObuS Yeah, the QR Code standard says that there's supposed to be a "quiet zone" around the code (which should be filled white). So that's probably what's happening there! If the quiet zone is not there, your reader doesn't recognize the code. @piko

lamitpObuS

@blinry @piko Thanks for the answer. The “quiet zone” was the missing link.

I now find it even on your page. Could swear it wasn't mentioned in December 2023. 🤔

Johannes Hoff

@blinry @piko Nice! I tried to learn it from wikipedia once, but fell asleep. This one had me understand it within the few minutes it took to read.

Lone Spelunker

@blinry @piko

An excellent and approachable write-up. I hope I never find myself in a situation where I need to actually decode one of these by hand, but it's interesting to understand how it works.

HAMMER SMASHED FILESYSTEM 🇺🇦

@blinry @piko thank you
i can now finally throw away the fucking computer

Nath

@blinry @piko
With some training it could be an epic skill to be able to decode qr-codes without pen and paper (neither a computer). 😅

DELETED

@blinry @piko yess! this is really a very clear ressource on decoding common QR codes!

unfortunately, numeric and alpha numeric don't seem to be supported and unicode bytes are interpreted as ascii, but these are minor problems.

Marcel Waldvogel

@confusomu @blinry @piko
Excellent resource, will help me explain QR codes, thanks!
On the topic of encoding modes, I was missing the information that the content is a *sequence* of messages, terminated by an end marker. Only then followed by the ECC.
(Yes, most codes consist of only a single message, but switching encoding can help creating smaller QR codes, depending on your content.)

Danny Boling 🌈 ☮️

@blinry

This is quite handy but I also hope I never have to do it, lol. Thank you for sharing!

@piko

f♯ a♯ ∞

@blinry sorry but it seems broken on FF for android 😅 the qrcode is not showing at all 😩

@piko

blinry

@tsadiq Can you find out which version of the Firefox app you're using? Because it does work for me there. :O @piko

f♯ a♯ ∞

@blinry alright it's my bad actually, I had try deactivating uBlock and Privacy Badger extensions before telling you, but it turns out the culprit was Dark Reader, works just fine when I turn it off 🙈

@piko

Ethan :verified_flashing:

@blinry @piko

Cool!

Related: the gist of this ad is, "The only safe QR code is our QR code."
(QR code links to jscmgroup dot com/qr-code-safety)

Seen @ Charlotte, NC, USA Airport

bitman

@blinry @piko quick question: do you know anything about the two QR codes found in the back of Mexican voter's ID? It seems to not only have the user's information encoded, but also a color picture and they don't seem to be readable by most QR code reader apps.

ewanm89

@bitman @blinry @piko I'll start with that only if they have the 3 square alingnment boxes in the corners is it a QR code. Most of the data on said cards from what I can see from a google search is not in a QR Code format, but a variant of PDF417 (this is not the same PDF as the file format from adobe). Such a format is a bit more complex than QR Code with using a base 929 encoding of the data.

ewanm89

@bitman @blinry @piko
Said PDF417 is used by quite a few governments for government ID data, including "RealID" by US Homeland Security on US driving licences and Israel uses it on their visa documents. It is a format designed for being read by uncordinated linear scan rather than image sensor. I doubt the image is actually stored on the card in that data, but a reference to where to find the image in government database.

bitman

@ewanm89 @blinry @piko oh, I see where the confusion might be coming from, as OLDER versions of the INE card USED PDF417, however, newer ones use two high-density QR codes on the back, and there's even an official app from the Electoral Authority to read and validate IDs by scanning said codes, which results in the full name and other data of the holder, as well as a color picture.

Here's is a link to both versions of the app. You might find a specimen going around, but after scanning it, it says is invalid. I also tried using the official app WITHOUT any sort internet connection and it worked just fine, meaning the data is indeed contain within those QR codes to the best of my understanding:

Apple App Store: apps.apple.com/mx/app/valida-i

Google Play Store: play.google.com/store/apps/det

Newspaper talking about it and specimen with QR codes: eluniversal.com.mx/nacion/poli

If you want a real ID to be able to scan the codes, PM me and I'll *see what I can do.

@ewanm89 @blinry @piko oh, I see where the confusion might be coming from, as OLDER versions of the INE card USED PDF417, however, newer ones use two high-density QR codes on the back, and there's even an official app from the Electoral Authority to read and validate IDs by scanning said codes, which results in the full name and other data of the holder, as well as a color picture.

Tatzelbrumm

@blinry @piko
Great!
Could you add references/links to the specs (IIRC you mentioned those were lengthy technical papers) with all the gory details?

Iza Marfisi

@blinry @piko very cool dynamic tutorial!
Excellent. 👌👏💡Thanks.
Qrcodes tuned out to be more complex that what I would have thought. Especially the zigzag reading order! 🤔
#computerscience #unpluged

M.

@blinry @piko thank you for publishing - we ttied to attend the workshop but it was already full

Tim Ward ⭐🇪🇺🔶 #FBPE

@blinry @piko Yes well, in times gone by I could read paper tape, and on a good day punched cards, but I'm not looking to revive those skills.

DJM (freelance for hire)

@blinry @piko There's a small animated GIF in this post, that quickly goes through the same info.
masto.ai/@cybeardjm/1117659872

Mark Whybird

@cybeardjm @blinry @piko THESE ARE AWESOME. Are there any online tools that allow fiddling with the different options to encode some given data? If I have followed correctly, the mask pattern is entirely arbitrary and could be changed just for aesthetics. In many cases, the encoding could also be a user choice within limits. I can also see that the mysterious error correction section is malleable with insertion of other images like you, @cybeardjm, do or chrome-generated ones have - any simple insights into how that works?

Again though - WOW.

@cybeardjm @blinry @piko THESE ARE AWESOME. Are there any online tools that allow fiddling with the different options to encode some given data? If I have followed correctly, the mask pattern is entirely arbitrary and could be changed just for aesthetics. In many cases, the encoding could also be a user choice within limits. I can also see that the mysterious error correction section is malleable with insertion of other images like you, @cybeardjm, do or chrome-generated ones have - any simple insights...

Mark Whybird

@cybeardjm @blinry @piko p.s. while the @cybeardjm “content creation…” QR scans just fine on my iPhone’s scanner, the interactive decoder by @blinry and @piko running in iOS safari refuses to recognise it :(

Marcel Waldvogel

Nayuki explains the creation side of QR codes very well, including the selection of the mask.
nayuki.io/page/creating-a-qr-c

It is not only the ECC area that is malleable, the entire code is. Actually, *before* a QR reader starts decoding the content, it checks for (and fixes) errors in the content with help of the ECC bits.

So, a malicious user could create a code which a human would decode differently from a computer…

@whybird @cybeardjm @blinry @piko

Nayuki explains the creation side of QR codes very well, including the selection of the mask.
nayuki.io/page/creating-a-qr-c

It is not only the ECC area that is malleable, the entire code is. Actually, *before* a QR reader starts decoding the content, it checks for (and fixes) errors in the content with help of the ECC bits.

lgvs

@marcel
Thank you, I was just about to ask how mask was chosen! Really interesting.

@whybird @cybeardjm @blinry @piko

Marcel Waldvogel

@lgvs @whybird @cybeardjm @blinry @piko I don't think it is mentioned on the page, but in the code: To minimize uniform-color areas and eye-like patterns.

calculang

@blinry @piko Awesome page!
And I might use it as a neat reference/optional PR target to make this codec in calculang! Thanks for sharing!

bx

@blinry @piko im so very gladd someone else is aware of gur potential of human created and human readable 21x21 QR codes! :D

Likely Jan Lukas

@blinry @piko

This is fabulously well done, thank you! ❤️

I had to slog through tons of materials to figure this out a few years' back for a dissertation-adjacent project* but never did manage to figure out masking manually, so ended up using a generator for the final pattern.

*made a QR code of my dissertation research question in Miyuki seed beads. Still haven't finished as it takes a LONG time! 😀

michaelvcooper1

@blinry @piko I'll take "Questions that begin with 'Why'" for $200 Alex.

Jack Matirko

@blinry @piko also, at least on iPhone if you take a screenshot that has a QR code in it the code becomes a clickable link in the photos app. Not sure if that’s true on android too. That’s why I’ve been slathering qrs in all my shorts and Insta posts. It’s a handy way to be like “I want to check that link out later”.

hartreefox

@blinry @piko

Leave it to me to break it. ;)

The page does well up to 42 ascii characters, but any more than that (checked up to 45) it lists the length as 37 and decodes the first two letters that it shows incorrectly. It's when it goes from version 3 to version 4.

Thank you for this! You gave me a good start. Now I have to dig more deeply into it.

Dragonfox called Sophie

@blinry @piko I just did a quick read over it, but didn't see the block interleaving - did I miss that or is that actually missing?

Xerz! :blobcathearttrans:

@blinry @piko wHY DID IT PICK UP HENTAI AS A RANDOM ENGLISH WORD I?????????????????

Johannes P. Leuschner

@blinry is there a recording of your workshop from #37c3 available? Couldn’t find on on media.ccc.de…

Duco

@leuschner @blinry I don't think so. It was hold in a workshop room and we even moved to a different place. I haven't seen a camera. Also they did some practical training. But maybe on the next congress you can make a talk of it. I found it very interesting and as there where a lot of people interested at 37C3 as well, it's probably a good idea to have a recorded version.

𝟙𝔸∋λC

@blinry The coloring would suggest the two marked (X) units are not contributing to the recognition. Is that true?

datatrash

@iacore They belong to the timing part (should be orange).

marinheiro

@blinry @piko Thank you! I was always curious to know how these worked. It looks very fragile, even with error correction (eg a blob of dirt over the mask pattern bits)

​Piko

@marinheiro @blinry Yes, that's why there are actually two places for the mask pattern bits. And it still seems to work if both are covered! 🤨 (I tried it just now :D)

I think there's still so much more to the error correction (which would be too much effort to do it completely in your head) that it somehow is really stable...

Adam Blažek

@blinry @piko …Who needs to read QR codes manually so often that they developed mnemonics for the masks?

hexaheximal

@blinry @piko first you made an amazing explanation of git, and now you made an amazing explanation of qr codes...

Cqoicebordel ❎

@blinry @piko
You use bytes to store alphanumeric data ?

Because I made a QR Code watchface for the Watchy (github.com/Cqoicebordel/Watchf), and I guarantee trying to decode alphanum data on paper or in your head is hard, each char use 5½ bits.
Guaranteed headache.

All that to say, it would have been funnier to use alphanumeric encoding ;)

datatrash

@blinry @piko Some time ago I learned about QR codes out of curiosity.
But I realized I forgot most of it when reading your post.

However, you inspired me to use my pixel art editor to draw some QRs.

The rainbow colored one can't be read by my reader, so a little more work needs to go into finding colors with enough contrast.
But I still like the message it contains.

Am I?

@blinry
Uhh, really not what it is for, but think about doing a#CPP #mdspan iterator to do this 😳
@piko @vitaut

Go Up