How much blur does it take to hide a QR code?
More than most people use. QR codes are designed to be read when damaged, so a soft blur that makes a code look unreadable to you can still leave it readable to a scanner, or readable again after someone sharpens the image. Covering the code with a solid box is the only method that removes it completely. Heavy pixelation comes second, and blur is the weakest of the three.
This page explains why, shows what we measured, and lists the things in a photo worth hiding before you post it.
Why is a QR code hard to hide?
Every QR code carries error correction: extra data that lets a scanner rebuild the message when part of the code is missing or smudged. At the highest level, H, roughly 30% of the code can be damaged and it still reads, according to DENSO WAVE, the company that invented the format. Scanners also turn the image into pure black and white before decoding, which throws away a lot of softness. A blur that turns the sharp squares into grey smudges can leave enough of the light/dark pattern in place for the code to come back.
The deciding factor is the size of the blur compared with one module, the smallest square in the code. A blur much smaller than a module just softens the edges. A blur bigger than a module mixes neighboring squares together and the pattern is gone.
What did we measure?
We generated QR codes at error correction level M (a version 2 code holding a short web address and a version 4 code holding a longer ticket link), applied a standard Gaussian blur at increasing strengths, and tried to decode each result with jsQR, the open-source decoder this tool uses. Then we tried again after a simple sharpen-and-contrast step, the kind of thing anyone with a photo editor could do to undo a light blur. Blur strength is given as the blur's standard deviation in module widths.
| Blur strength | Read directly? | Read after sharpening? |
|---|---|---|
| 0.35 of a module | Yes, both codes | Yes, both codes |
| 0.5 of a module | No | Yes, both codes |
| 0.6 of a module | No | No |
| 0.75 to 1.25 modules | No | No |
The middle row is the important one. At half a module the blurred code no longer scans, so a quick check makes it look safe, but sharpening the image brings it straight back. Pixelation behaved similarly: with blocks half a module wide, the codes still read; with blocks one module wide or larger, they didn't.
Two limits apply to these numbers. They come from one decoder and a handful of clean, computer-generated codes, so treat them as a direction rather than a threshold. Phone cameras use different, often stronger decoders, and a code in a real photo is already softer than a generated one. Researchers have also shown that pixelation can sometimes be reversed outright: the Depix project, for example, recovers text from pixelated screenshots. Pixelation leaves information behind, and a solid cover leaves none.
How does this tool check the result?
After every change, the tool scans the finished image the way a person trying to recover the code would. It looks at the whole photo, then crops and enlarges each hidden area and scans it on its own, which catches small codes a whole-photo scan would miss. If that fails, it runs the sharpen-and-contrast step from the test above at three strengths and scans again. You see a green "Checked" message only when none of those attempts reads a code.
In our sample photo, pixelation at any strength passed this check. Blur at strength 1 left both codes readable, and at strength 2 one code could still be read after sharpening. From strength 3 upward, both were hidden. That's why the default is pixelation at strength 7, with the margin set to 10% so the edges of the code are covered too.
A passed check is good evidence, not a guarantee, for the reason above: a phone's decoder isn't the one we test with. If what's in the code really matters, a 2FA secret or a ticket for an event that hasn't happened yet, use Cover.
What should you hide before posting a photo?
Most QR codes in photos are harmless links to a restaurant menu or a product page. The ones worth hiding hold something that works for whoever has it:
| Code | What a scan of your photo gives someone |
|---|---|
| Event and concert tickets | Often the ticket itself. If the venue scans the first copy of a code it sees, the person who copied it from your post gets in and you don't. |
| Boarding passes | Your name and booking reference, which on some airlines has been enough to look up and change the booking, as Krebs on Security showed. Many passes use other 2D barcodes (PDF417 or Aztec) rather than QR, which this tool doesn't detect, so draw a box over those by hand. |
| Wi-Fi codes | The network name and password in plain text. The format is WIFI:S:name;T:WPA;P:password;;, as documented in the ZXing barcode contents reference. |
| 2FA setup codes | The secret key behind your authenticator app's six-digit codes, in an otpauth:// link (see Google's key URI format). Anyone with it can generate your login codes. Never post a screenshot of a 2FA setup screen, even blurred. |
| Messaging-app contact codes | A way to add you as a contact, which matters if you'd rather strangers didn't. See our WeChat QR code guide for resetting one that's been exposed. |
| Parcel labels, loyalty and membership cards | Tracking numbers, addresses or a member ID that can be used at a till. |
QR codes are rarely the only problem in these photos. Names, booking references, seat numbers and the plain barcode next to the QR code can give away the same thing. Drag a box over each of them as well. The automatic check only tests for QR codes, so look over everything else yourself before you post.
Does the downloaded photo still contain hidden data?
No. Photos straight from a phone usually carry metadata: the camera model, the time and often the GPS location. The download from this tool is a new image drawn from the edited picture, so none of that is copied across, and the hidden areas are replaced in the pixels themselves rather than placed on top as a removable layer. JPG photos are saved as JPG and everything else as PNG. Nothing is uploaded at any point: the photo is opened, edited and saved entirely in your browser.
Is your own QR code coming out blurry?
If you searched for a blurred QR code because yours looks fuzzy, the fix is at the source, not in an editor. Blurriness usually comes from enlarging a small PNG. Download the code again as SVG, which stays sharp at any size (see why SVG QR codes print better), or as a PNG at the size you'll actually use. A code that won't scan for other reasons is covered in QR code not scanning, and if you're trying to read a blurry code someone else made, a sharper photo in the online QR code scanner is the best bet.
Quick rule
For anything that gives access (tickets, Wi-Fi passwords, 2FA codes), use Cover. Use pixelate when you want the photo to look natural and the code is low risk, and only post once the check is green.
Written by Cornelious Fazal, founder of QuickQRC. Blur measurements taken October 2026 with jsQR in Chrome on generated level-M codes.