Glossary / Developer reference
URI QR code
- Definition
- A URI QR code is the square black and white pattern that encodes a bitcoin: URI, so a camera can read the address and amount that would otherwise be typed.
Scanning removes typing, and typing is where mistakes live. A bech32 address written in uppercase fits QR alphanumeric mode, which BIP173 notes is about 45 percent more compact than byte mode, so uppercase codes carry fewer modules and scan more reliably. What a QR code cannot do is tell you the address inside it belongs to whoever you think it does.
How it works
A QR code is a general purpose data container standardised as ISO/IEC 18004, and bitcoin simply puts a text URI inside one.
The format offers several encoding modes. Alphanumeric mode covers a 45 character set: the digits, the uppercase letters, space, and nine punctuation marks. It packs two characters into 11 bits. Byte mode takes anything but spends a full 8 bits per character. Lowercase letters are absent from the alphanumeric set, which is why wallets often render the whole string in capitals as BITCOIN:BC1Q.... URI schemes are case-insensitive, and bech32 addresses are valid in either case as long as they are not mixed, so uppercasing is safe and shrinks the grid.
Base58 addresses beginning with 1 or 3 do not get that option, because their character set is case-sensitive and changing a letter changes the address. It is a small, concrete advantage of bech32 that rarely gets mentioned.
Error correction is chosen at generation time. The four levels recover roughly 7, 15, 25 and 30 percent of a damaged code. A printed sticker exposed to weather justifies the highest level; a screen does not. Capacity is never the binding constraint here: the largest QR version holds 4,296 alphanumeric characters, while a typical bitcoin URI runs to somewhere between 50 and 120.
Where you see it
Four surfaces produce bitcoin QR codes daily, and they are not equally trustworthy.
Exchange deposit screens generate one for the address they want you to fund. A hardware wallet's own display generates one for an address it derived internally, which is the only version whose provenance you can check. Merchant checkouts print a unified code carrying both an on-chain address and a Lightning invoice. Bitcoin ATMs display one at the moment of purchase, usually with a countdown.
The difference between the second surface and the rest is the whole security argument for hardware wallets. Malware that controls your screen can redraw a QR code; it cannot redraw the one on a Trezor or Ledger display. Generate the code on the device, then verify the characters that the device also prints underneath it.
Physical codes are the softer target. The FBI's Internet Crime Complaint Center issued a public service announcement on January 18, 2022 about criminals pasting their own QR stickers over legitimate ones, and the technique has not gone away. Treat any code printed on paper in a public place as unverified until the destination address matches something you independently expected.
There is one benign use worth knowing. Air-gapped signing devices move partly signed transactions in and out through animated sequences of QR codes, cycling several frames per second, because a camera and a screen make a data channel with no cable and no USB stack to attack.
URI QR code vs address
An address is text; a URI QR code is a picture of a longer text that happens to contain an address. Scanning a code that holds a plain address gives your wallet a destination and nothing else, so you still type the amount. Scanning one that holds a full URI fills in the amount, the label, and sometimes a Lightning invoice as well. Both look identical to the eye, which is why a wallet that shows you a prefilled total after a scan is telling you something useful about what it actually read.