ISO/IEC 18004: The QR Code Standard, Explained (2026)
Key Takeaway
ISO/IEC 18004 — the international QR code standard. How QRs encode data, how they're structured, how scanners decode them, error correction explained.
ISO/IEC 18004 is the international standard that defines what makes a QR code a QR code. It specifies how data is encoded into the black-and-white module grid, how scanners are supposed to locate the symbol, which versions and sizes are permitted, and how errors are recovered when part of the code is damaged or occluded. If your scanner can read a QR code printed by someone else's tool, it's because both sides obey the same specification.
This guide walks through what the standard actually says — in plain English, with the original references where you can verify each claim. It's aimed at developers, product managers, and anyone who wants to understand what the encoding box on the back of their phone is doing.
What ISO/IEC 18004 is — and how it got that name
The QR (Quick Response) code was invented in 1994 by Masahiro Hara at Denso Wave, a subsidiary of the Japanese automotive supplier Denso. The original use case was tracking automotive parts through the manufacturing process, which is why the symbol had to be machine-readable at high speed from any angle — the three large nested squares (the 'finder patterns') let a scanner orient the symbol no matter how the part is rotated. The history of that origin is covered in our history of QR codes — this post focuses on the standard, not the company.
Denso Wave released the QR code royalty-free. In 1997 the Automatic Identification and Mobility (AIM) association published the first formal industry standard (AIM ITS/97-001), and ISO formally adopted the spec in 2000 as ISO/IEC 18004:2000. The standard has been revised several times since — ISO/IEC 18004:2006, :2015, and the most recent ISO/IEC 18004:2024 — each adding refinements without breaking backward compatibility. A reader following the 2024 edition can still decode a symbol generated in 2000.
The naming convention parses as: ISO (International Organization for Standardization), IEC (International Electrotechnical Commission — the standards body for electronics), document number 18004, year published. The full title is 'Information technology — Automatic identification and data capture techniques — QR Code bar code symbology specification.'
Four QR symbol models (but only one matters in practice)
The standard defines several QR symbol types. In practice, almost every QR code you scan in 2026 is a Model 2 QR code.
| Symbol type | When | Where used |
|---|---|---|
| Model 1 | 1994 (original) | Mostly obsolete; some legacy industrial systems |
| Model 2 | 1997 update | The QR code you scan on signs, packaging, and payment apps |
| Micro QR Code | 2004 | Tiny symbols for small parts; fewer modules, less capacity |
| iQR Code | 2008 | Rectangular and inverted symbols for industrial label printing |
| SQRC / Frame QR | 2014+ | Encrypted (SQRC) or branded-image (Frame QR) variants; not yet broadly supported |
For the rest of this guide, 'QR code' means Model 2 unless stated otherwise. The encoding rules, error correction, and symbol structure described below all refer to Model 2.
Symbol structure: the parts every QR code has
Open any QR code at high resolution and you'll see four structural elements the standard requires, in addition to the data modules themselves:
- Finder patterns. Three large nested squares in the top-left, top-right, and bottom-left corners. A scanner uses the 1:1:3:1:1 black-white ratio of these squares (the same ratio in any orientation) to locate the symbol and figure out which way is up.
- Alignment patterns. Smaller nested squares scattered across the symbol for versions 2 and higher. They help the scanner correct for perspective distortion (when the QR is photographed at an angle).
- Timing patterns. A row and column of alternating black-white modules running between the finder patterns. They give the scanner a fixed reference for module size.
- Format and version information. Two short bit-strings encoded near the finder patterns. The format info tells the scanner the error-correction level and the mask pattern (covered below). The version info — present on V7 and above — tells the scanner the symbol's grid size.
Surrounding the symbol there's also a quiet zone: a margin of at least four module-widths in every direction, free of any other content. Without the quiet zone, scanners often fail to locate the symbol cleanly. That's why every QR design guide tells you not to crop the white space too close.
Encoding modes: how text becomes pixels
The standard defines five primary modes for encoding data into the symbol, plus an extension mechanism (ECI) for less-common character sets:
| Mode | Character set | Bits per character | Typical use |
|---|---|---|---|
| Numeric | 0–9 only | ≈ 3.33 (10 bits per 3 digits) | Phone numbers, ID numbers, ISBNs |
| Alphanumeric | 0–9, A–Z (uppercase only), and 9 symbols | 5.5 (11 bits per 2 chars) | Short uppercase URLs |
| Byte | ISO 8859-1 (Latin-1) by default; UTF-8 with ECI | 8 | Anything else (lowercase URLs, accented text) |
| Kanji | Shift-JIS | 13 | Japanese characters |
| Structured Append | — | — | Split data across multiple symbols |
Smart encoders pick the most efficient mode for each segment of the input. A QR containing 'HELLO123' can use Alphanumeric mode and fit in fewer modules than the same string in Byte mode. A URL like 'https://qrlynx.com/abc' has lowercase letters and so must use Byte mode for the path — but the protocol prefix 'HTTPS://' could in principle be packed into Alphanumeric. Most generators don't optimize that aggressively; the difference rarely matters in practice.
For characters outside Latin-1 (Cyrillic, Greek, Arabic, etc.) the encoder uses an ECI (Extended Channel Interpretation) indicator at the start of the data segment to tell the scanner to interpret subsequent bytes as UTF-8 or another specific encoding. Modern phone scanners handle UTF-8 ECI correctly; very old industrial scanners may not.
Versions 1–40: the grid sizes
Every QR code is one of 40 versions defined by the standard. Version 1 is a 21×21-module grid; each subsequent version adds 4 modules per side, up to Version 40 at 177×177 modules. Larger versions hold more data — but they need more physical space, more printer resolution, and more focus from the scanner.
A few reference points (all assuming error-correction level M):
- Version 1 (21×21): ~14 numeric digits, or ~7 ASCII characters in Byte mode
- Version 5 (37×37): ~108 numeric digits, or ~84 characters — fits a typical short URL
- Version 10 (57×57): ~287 numeric digits, or ~213 characters — fits a long URL with UTM parameters
- Version 25 (117×117): ~1,367 characters — overkill for a URL but used for vCards with photos
- Version 40 (177×177): ~4,296 alphanumeric characters or ~2,953 bytes — the maximum the standard allows
For deep capacity tables and the practical implications of choosing each version, see our dedicated post on QR code versions explained. For the relationship between version and physical print size, see the QR code print size guide and the QR code size calculator.
Error correction: Reed-Solomon, four levels
The standard mandates Reed-Solomon error correction at one of four levels. The trade-off is always the same: higher correction means more redundancy bytes, which means less room for actual data at a given symbol version.
| Level | Modules recoverable if damaged | Typical use |
|---|---|---|
| L (Low) | ~7% | Clean digital surfaces (screens) |
| M (Medium) | ~15% | Default for most general-purpose QRs |
| Q (Quarter) | ~25% | Light damage expected (outdoor signage) |
| H (High) | ~30% | Heavy damage tolerance, or to embed a logo on top of the symbol |
Logo overlays exploit error-correction level H. By placing a logo over the center of the symbol (where the alignment patterns aren't), you 'damage' up to ~30% of the data modules; Reed-Solomon reconstructs them from the redundancy bytes. Lower levels leave less headroom for the logo. We explain the mechanics — and the gotchas — in our QR code error correction guide.
One detail the standard makes explicit but most explainers gloss: the percentages above are codeword-level, not module-level. A QR codeword is 8 modules; if all 8 are damaged you've lost one codeword. Reed-Solomon recovers up to N corrupted codewords, where N depends on the error-correction level and version.
Mask patterns: making the symbol scannable
After the data is laid into the grid, the encoder applies one of 8 mask patterns: a deterministic XOR over the data modules that toggles certain modules black or white. The purpose is to avoid pathological patterns — long runs of same-color modules, large solid blocks, or features that look like the 1:1:3:1:1 finder ratio — that would confuse the scanner.
The encoder tries all 8 masks, scores each on four penalty rules defined in the standard, and picks the lowest score. Two QRs encoding the same data with the same version and error-correction level can look visually different because the optimal mask differs. The format information bits near the finder patterns tell the scanner which mask was applied so it can XOR back to the original data.
How a scanner decodes a QR code
Locate the three finder patterns
The scanner runs a 1:1:3:1:1 ratio detector over the image looking for the nested-square finder patterns. Once it identifies three candidates, it determines the symbol's orientation and bounding box.
Determine version and grid size
The distance between finder patterns tells the scanner the version. For V7 and above, the scanner also reads the explicit version-information bit block near the top-right finder to confirm.
Read the format information
Two short bit-strings adjacent to the finder patterns encode the error-correction level (L/M/Q/H) and which of the 8 mask patterns was applied. These bit-strings carry their own BCH error correction so they can be read even when partially damaged.
Unmask, decode, and run Reed-Solomon
The scanner XORs the data modules with the identified mask pattern, reads the bit stream column-by-column in the prescribed zigzag order, separates data codewords from error-correction codewords, and runs Reed-Solomon to fix any read errors before producing the final output bytes.
Where to read the actual standard
The full spec is paywalled by ISO. The 2024 edition is the current canonical text; older editions are still informative but lack some clarifications:
- ISO/IEC 18004:2024 — the current edition. CHF 198 for the PDF; some institutions have ISO library access.
- Denso Wave standards reference — the inventor's own summary of QR-family standards, free.
- ISO/IEC 18004:2015 (superseded but commonly referenced) — predecessor edition.
- For Reed-Solomon background, the Wikipedia article on Reed-Solomon error correction is accurate and worth reading before the ISO text.
If you're implementing a scanner or encoder library, the standard alone is enough to do it correctly. If you just want to understand what's happening when you scan a QR with your phone, the structural overview above covers it — the rest is implementation detail.
Frequently Asked Questions
Is ISO/IEC 18004 the only QR code standard?
It's the international one — and it's the one that governs the QR codes you'd encounter on a phone, on packaging, or in any cross-border setting. Japan's domestic JIS X 0510 standard is essentially identical text; AIM's ITS/97-001 was the predecessor industry standard. Denso Wave still owns the trademark on the term 'QR Code' but the technology is royalty-free.
What does ISO/IEC mean in the name?
ISO is the International Organization for Standardization (the umbrella body). IEC is the International Electrotechnical Commission (the electronics-focused sibling). When a standard is co-published — as most identification and computer-science standards are — it gets the dual ISO/IEC prefix and a single number, here 18004.
Is using QR codes free, or do I owe Denso Wave royalties?
Free. Denso Wave released the QR Code spec royalty-free in 1994 and has maintained that position. They still own the registered trademark on the words 'QR Code,' so commercial products that prominently use the phrase as a product name should include a notice, but generating, scanning, and distributing QR codes themselves carries no fee.
What's the difference between Model 1 and Model 2 QR codes?
Model 2 (1997) added the alignment patterns that allow correction for perspective distortion, expanded the version range, and refined the masking rules. Model 1 lacks alignment patterns, so scanners struggle to read it when the symbol is photographed at an angle. Any QR code generated since the late 1990s is essentially guaranteed to be Model 2; encountering Model 1 in the wild is rare.
Can I encode any character set in a QR code?
Yes, via the Byte mode + ECI (Extended Channel Interpretation) mechanism. UTF-8 is the most common ECI-flagged encoding; Cyrillic (ISO 8859-5), Greek (ISO 8859-7), and other Latin-extensions all work. Some very old industrial scanners ignore ECI and may render UTF-8 bytes as Latin-1 garbage, but modern phone-camera scanners handle the standard ECI codes correctly.
Why are there 40 versions and not, say, 50?
The standard's authors picked 40 as the practical upper bound where a typical scanner camera resolution at typical print sizes can still resolve individual modules cleanly. Version 40 at 177×177 modules is also already so dense that error correction headroom is the main constraint, not capacity — adding more versions wouldn't unlock useful new use-cases.
What's the smallest QR code possible?
A Version 1 QR code is 21×21 modules. For tinier symbols the standard offers Micro QR Code (M1–M4), with M1 at just 11×11 modules but holding only 5 numeric digits. Micro QR codes lack the full finder-pattern triplet (they have only one) and are not as broadly scanner-compatible as standard QR codes.
Does a 'pretty' QR code (with colors or a logo) still follow ISO/IEC 18004?
Yes, as long as the data modules remain machine-readable. The standard doesn't require black-on-white — it requires sufficient contrast between dark and light modules. Logos overlaid on the symbol's center work because Reed-Solomon error correction recovers the obscured modules. Custom shapes for the data modules (rounded dots, etc.) are permitted as long as scanners can still see the module grid.
Why does the standard get revised so often?
Each revision adds clarifications, new symbol variants (like iQR Code in 2008), or refinements to test methods — but never breaks backward compatibility. The 2024 edition mainly cleaned up wording and aligned a few annexes with related standards. A QR code that scans against the 2000 edition still scans against the 2024 edition.
How does ISO/IEC 18004 relate to Data Matrix, Aztec, and PDF417?
Those are separate 2D barcode standards (ISO/IEC 16022, 24778, and 15438 respectively). Each is governed by its own ISO document. They share the same approach — encoding data into a 2D module grid with error correction — but the symbol structures, encoding rules, and ideal use-cases differ. QR codes are the most consumer-recognizable today.
Where does QRLynx fit in the ISO/IEC 18004 picture?
QRLynx is a QR code generator and management platform that produces ISO/IEC 18004 compliant Model 2 symbols at every version and error-correction level. We don't extend the standard — that would break scanner compatibility — but we add a software layer for dynamic redirects, analytics, and design customization on top of fully compliant symbols. Any QR generated on QRLynx will scan with any standards-compliant reader.
Practical takeaways
You don't need to memorize the standard to use QR codes effectively. The high-leverage facts are: pick the lowest version that fits your data (smaller = easier to scan from distance), use Error Correction level M for general-purpose codes and H if you're embedding a logo, leave a quiet zone of 4 modules around the symbol, and don't crop the white margin.
If you're building infrastructure on top of QR — gating it behind a lead form, tracking scans for marketing attribution, or running a QR campaign — the spec mostly recedes into the background. What matters is that the symbol your software produces is a valid Model 2 QR code; everything else is product design. Our testing methodology documents how we verify standards compliance across the platforms we evaluate.
