How to Interpret QR Scan Data: From Decoded Content to Campaign Insight
“Interpreting QR scan data” means two different things, and most people need both. The first is what a scanner pulls out of the black-and-white squares: a web address, some text, a Wi-Fi login. The second is what the numbers in your analytics dashboard mean once people start scanning your codes in the real world. This guide covers both, in that order, so you can read a code’s content with confidence and judge a campaign’s scan counts without fooling yourself.
TL;DR
- A scanner turns the code’s pattern into a string of characters. Most often that string is a URL, but it can also trigger actions such as joining Wi-Fi or dialling a number.
- Capacity and readability depend on the code’s version, encoding mode and error-correction level, not just on how it looks.
- A scan, a visit and a conversion are three separate events. Count each in the tool that actually sees it.
- Scan counts are a signal, not a verdict. Placement, size, lighting and privacy limits all shape the numbers.
- Preview any decoded link before opening it, especially on codes you did not create.
Table of Contents
- What a QR code actually contains
- How a scanner reads and decodes the pattern
- How much data can one code hold?
- Static versus dynamic: where the data really lives
- Reading your analytics: scan, visit, conversion
- What affects the accuracy of the numbers
- Checking decoded content before you open it
- Our perspective: scan data is only as good as the code behind it
- Put it to work with QRlytics
- FAQ
- Sources
What a QR code actually contains
A QR code is a two-dimensional matrix barcode. According to the U.S. Payments Forum, a scanner converts the code’s dots into numbers or a string of characters. That string is the entire payload. The code itself does not “know” anything about the page it points to, and it does not carry your marketing data.
What the string means depends on its format. The same source notes that a code can point to a URL, and that a payment code may include details such as a transaction amount. The Canadian Centre for Cyber Security lists the common actions a decoded code can trigger:
- opening a website
- downloading an app
- joining a Wi-Fi network
- creating a contact
- sending an email or message
- dialling a phone number
The scanner app does not usually need to know the type in advance. It reads the data and your phone decides what to offer, based on how the text is formatted. That is why a code that begins with a web address opens a browser prompt, while one formatted as a phone number offers to call.
Character sets: numbers, letters, binary and Kanji
Inside the code, data is stored in one of several modes. Scandit’s technical guide states that QR codes support numeric, alphanumeric, 8-bit binary and Kanji character sets. The mode matters for one practical reason: numeric data packs far more tightly than free text, so a code holding only digits can be simpler and easier to scan than one holding a long URL with tracking parameters.
How a scanner reads and decodes the pattern
When you point a phone at a code, a fairly rigorous sequence runs in a fraction of a second. Following the description in Scandit’s guide, the decoder does this:
- Captures an image and locates the finder patterns and the quiet zone.
- Estimates perspective distortion, using the alignment pattern, so a code on a tilted poster still reads.
- Works out the encoding mode from the format information.
- Reads the bits of the data grid.
- Applies Reed-Solomon error correction.
- Decodes the data stream and passes the result to the app.
The three square position markers orient the reader, and the blank border around the code marks where the symbol ends, as The Conversation explains in its computer-science walkthrough. Dark and light modules represent binary values, which is why a code is really a tiny grid of ones and zeros.
Why damaged codes still scan
The error-correction step is the reason a scuffed sticker or a logo placed in the middle of a code can still work. The ANSI Blog describes how camera-readable modules are processed with Reed-Solomon correction before the data is extracted. The ISO/IEC 18004:2015 standard specifies four correction levels, able to recover roughly 7% (L), 15% (M), 25% (Q) and 30% (H) of the symbol’s codewords.
Higher correction is not free. It uses up room that would otherwise hold data, so a higher level means either less payload or a denser, harder-to-scan pattern. If you add a logo, choose a higher level. If your code is small, keep the payload short.
How much data can one code hold?
Capacity depends on version, encoding mode and error-correction level. Per OMRON’s technical guide, Model 2 codes run from Version 1 at 21×21 cells to Version 40 at 177×177 cells, and Version 40 can hold up to 7,089 numeric characters. That is the theoretical ceiling. Real campaign codes should sit nowhere near it.
The more you put in, the more squares there are, and the smaller each square becomes at a fixed print size. For printed material, this is the strongest argument for pointing the code at a short redirect address instead of encoding a long destination URL directly. A short payload gives you a sparse, bold pattern that scans quickly from a distance. It also means you can change where the code leads without reprinting, which brings us to the difference between static and dynamic codes.
Static versus dynamic: where the data really lives
A static code stores the final destination inside the pattern. Decode it and you see exactly where it goes. It cannot be edited, and nothing records who scanned it, because the scan happens entirely on the person’s phone.
A dynamic code stores a short redirect address instead. When someone scans, their phone requests that address, the redirect service logs the scan, then sends them on to the current destination. That log is where scan analytics come from. It is also why a decoded dynamic code shows you a short link rather than the final page: the content you see at decode time is the redirect, not the destination.
This has a clear consequence for interpretation. If a code has no redirect layer, there is no scan data to read, whatever any dashboard claims. For a closer look at how tracking works, see our practical guide to QR code tracking.
Reading your analytics: scan, visit, conversion
Once you have a dynamic code in the wild, the numbers start arriving. The most common mistake is treating them as one thing. A useful model is to separate measurement into layers, as in this measurement guide for offline campaigns: the scan is recorded by the QR or redirect platform, the visit by your web analytics, behaviour by events after landing, and attribution by your reporting model.
| Layer | What it tells you | Where it is recorded |
|---|---|---|
| Scan | Someone pointed a phone at your code and the redirect fired | QR platform |
| Visit | The landing page loaded and a session began | Web analytics |
| Behaviour | What they did on the page: scroll, click, watch | Web analytics events |
| Conversion | A predefined action was completed | Web analytics or CRM |
The gaps between layers are informative. A scan with no matching session can mean the person left before the page loaded, a slow page, or a blocker. A mobile scan may also convert later on another device, so the conversion never lines up with the scan in your reports.
Scans versus unique users
Total scans count every redirect. Unique scanners try to count people. These two numbers diverge when the same person scans twice, for instance to re-read a menu or to show a friend. Neither is wrong. They answer different questions:
- Total scans measure how often the code is used. Good for judging a placement.
- Unique scanners estimate reach. Good for comparing campaigns.
- Repeat rate (total divided by unique) hints at utility. A high ratio on a menu or manual code is healthy. On a one-off promotion it may mean confusion.
Web analytics uses its own definitions, and it helps to know them before comparing. In Google Analytics 4, Total users are unique users who triggered any event, Active users are those who engaged, New users have a first visit, and Returning users a previous session. Your QR platform’s “unique” count and GA4’s “users” will rarely match exactly, because they identify people differently. Compare trends within each tool rather than forcing the totals to agree.
Defining a conversion before launch
A conversion is a predefined action. Google’s documentation says it is recorded when a user performs an action such as a purchase or form request after an interaction, and that offline results need an identifier to be matched to online activity. For QR campaigns, that means choosing the event first: a coupon redeemed, a booking made, a form submitted. Then tag your destination links with consistent UTM parameters, so the visit arrives in your web analytics labelled with the campaign, and reconcile the gaps after the fact.
Our guide on tracking from scan to conversion walks through a campaign sheet you can copy, and for turning numbers into a business case, this piece on analytics and marketing ROI is a helpful companion.
Reading the geography and timing
Three cuts of the data tend to be the most useful:
- Time of day and day of week. A spike at lunchtime on a restaurant table card is expected. A spike at 2 a.m. on a billboard code deserves a second look.
- Location. Heat maps show where scans cluster. Compare them with where you actually placed codes, since a cluster somewhere unexpected can reveal that a flyer travelled or that a code was reposted.
- Device type. A heavy skew to one operating system can point to a landing page that renders poorly on the other.
A single number rarely settles anything. Compare each code against another placement, or against its own history, before drawing a conclusion.
What affects the accuracy of the numbers
Low scan counts are not always low interest. Sometimes people simply cannot scan. Nielsen Norman Group frames successful scanning as an environmental design problem as much as a code-generation problem: size, distance, lighting and visibility decide whether a person can scan at all. Its guidance recommends at least 2 cm by 2 cm for reliable scanning, plus roughly 1 cm of extra code size for every additional 10 cm of scan distance.
So before you decide a poster “doesn’t work”, check the basics:
- Is the code large enough for the distance people actually stand at?
- Is it on a glossy or curved surface that causes glare or distortion? We cover this in our guide to QR codes on curved surfaces.
- Is it placed where people pause, rather than where they pass?
- Does the surrounding copy tell people what they get for scanning?
Our notes on measuring QR code placement show how to test two positions against each other and read the difference fairly.
Privacy limits on what you can know
A scan can expose cookies, device type, IP address and location, according to the Canadian Centre for Cyber Security, along with anything the person enters on the destination site. That is a reminder that scan data is about devices and sessions, not named individuals, and that you should collect only what you need. Aggregated counts, regions and device types answer almost every campaign question without profiling anyone. For a deeper look at doing this responsibly, read our QR data privacy guide.
Checking decoded content before you open it
Interpreting a code also means deciding whether to trust it. Digital.gov notes that a code usually holds a site address, and warns that attackers can replace legitimate codes or interfere with embedded links. Its advice is to verify links before using them and to avoid downloads from QR codes.
Nielsen Norman Group adds practical habits: scan only trusted sources, preview the destination, avoid suspicious codes, look for HTTPS and a padlock, control automatic actions, and report anything suspicious. In practice:
- Read the previewed address before tapping. Does the domain match the brand?
- Be wary of a sticker placed over another code.
- Treat a code that asks for a login or payment as you would an email asking the same.
- If you publish codes, put your brand name and a short instruction near them so people can tell yours from a pasted-over fake.
Our perspective: scan data is only as good as the code behind it
We see the same pattern again and again. A team prints ten thousand flyers, reads the scan numbers for a month, and only then discovers the code was a free-tier link that stopped redirecting, or a static code that never recorded anything. The data they are interpreting was never trustworthy to begin with.
That is why we build around permanence. Codes created during an active subscription keep working after cancellation or billing problems, so a printed menu, package or poster does not become a dead end. It also means your historical comparisons stay meaningful: a year-on-year change in scans reflects people, not a broken redirect.
Our advice is simple. Decide what a scan should lead to before you print. Separate scans, visits and conversions, and read each in the tool that sees it. Test placements against each other instead of guessing. And collect only the data you will actually use.
— The
Put it to work with QRlytics
If you want to read real scan data without stitching tools together, QR codes with analytics give you scan counts, locations on a heat map and device information in one place, with CSV export for your own reports. You can start on the free plan, which has limited codes and analytics, with no credit card. Paid plans unlock unlimited codes, advanced analytics and API access, and you can see them on our pricing page.
When you are ready to build a code you can edit later, try the dynamic QR code generator. For turning the numbers into a one-page summary your team will actually read, this guide to a one-page campaign performance report is a good template to borrow from.
FAQ
Can I see what a QR code says without opening it?
Yes. Most phone cameras show a preview of the decoded text or address before you tap. Read it first. If the domain looks wrong or the code asks you to download something, leave it alone, as Digital.gov advises.
Why does my dashboard show more scans than my website shows visits?
They measure different moments. The QR platform records the scan at the redirect, while web analytics records a visit only once the page loads and its tag fires. Slow pages, blockers and people who abandon quickly create the gap. A modest difference is normal, so track the ratio over time instead of expecting the two to match.
Are unique scans the same as unique people?
No. A unique scan is an estimate based on signals such as device or session, so one person with two phones counts twice and two people sharing a device may count once. Use it to compare campaigns against each other rather than as a headcount.
How much data can a QR code hold?
It depends on version, mode and error-correction level. The largest standard symbol, Version 40, can hold up to 7,089 numeric characters, according to OMRON. For print, a short redirect address is far easier to scan than a long encoded URL.
What should I measure first on a new campaign?
Start with scans per placement, then visits, then one defined conversion. Add UTM parameters to the destination link from day one so each code is identifiable in your web analytics.
Sources
- FAQ - QR Codes, U.S. Payments Forum
- Security considerations for QR codes, Canadian Centre for Cyber Security
- QR Codes: Complete Technical Guide, Scandit
- How QR codes work and what makes them dangerous, The Conversation
- ISO/IEC 18004:2024 QR Code Bar Code Symbology, ANSI Blog
- ISO/IEC 18004:2015 International Standard
- Code Reader Technical Guide, OMRON
- QR Code Tracking Guide for Offline Campaigns, Tools.link
- Understand user metrics, Google Analytics Help
- Conversions overview, Campaign Manager 360, Google for Developers
- 13 QR-Code Usability Guidelines, Nielsen Norman Group
- Introduction to QR codes, Digital.gov
- Why analytics in marketing drives better ROI
- One-page campaign performance report