A QR code is a way of writing characters down so a camera can read them. It holds no identity, performs no lookup, and does nothing on its own. What happens after a scan is decided by your phone, based on the shape of the text it found.
What the text usually is
A URL. The overwhelming majority. Your phone recognises it and offers to open it.
Plain text, which is just displayed.
A contact card, in vCard format, which the phone offers to save.
Wifi credentials. WIFI:T:WPA;S:NetworkName;P:password;; — one line, with the network name and the password in it. The phone recognises the prefix and offers to join.
A payment string, which in most countries is an account identifier and an amount, not a transaction. Scanning does not move money; it fills in a form.
In every case the phone is pattern-matching on a prefix. There is no instruction inside the code telling it what to do.
The wifi one is worth a second look
Because the password is in the code, in plain characters, and a code is a picture.
Anyone who photographs the card on the counter has your wifi password. Anyone who appears in a photograph of the café wall has it. It is not encrypted, hashed or protected in any way — a reader shows the whole string including the password.
That is fine for a guest network and much less fine for the main one. It is the single most common case where people share more than they realise, precisely because the code looks opaque.
Why a logo in the middle does not break it
QR codes store their data with error correction, at one of four levels. At the highest, roughly 30% of the code can be missing or wrong and the content still recovers exactly.
That is why a logo works, and why a code survives being folded, scuffed or partly covered. It is also why a code with a logo has to be generated at a higher correction level — pasting a logo onto an existing low-correction code does break it.
The three large squares in the corners are position markers, letting a scanner find the code at any angle. Those are not redundant, and covering one does break it.
Size, and why long URLs make ugly codes
More data means more modules — the small black squares — and a denser grid. A short URL gives a code with large modules that scans instantly from a distance; a long one with tracking parameters gives a dense grid that needs a closer, steadier camera.
For anything printed, shorten the URL first. It is the difference between a poster that scans across a room and one that does not.
The security question, properly stated
A QR code cannot contain a virus, because it contains text and text does not execute.
The risk is that you cannot read where it goes before you scan it. A sticker placed over a legitimate code on a parking meter, a restaurant table or a payment terminal sends you to a page that looks right and is not. This is common enough to have a name, and it works because scanning has replaced reading a URL.
Two habits cover almost all of it. Read the URL your phone shows you before opening it — every scanner displays it, and nobody looks. And treat a code that has been stuck on top of something as suspicious, because that is what a physical sticker attack looks like.
For a code you have received rather than scanned in the street, decoding the image shows the text without opening anything.
Making one
Generating a code is arithmetic on a string — no server required, and worth insisting on for the wifi case, where the whole content is a password.
Print it large enough that the modules are clearly separated, keep the quiet zone — the blank margin around it — and test it with an actual phone at the distance people will stand. Codes that fail in the field usually fail for one of those three reasons.
The short version
It is text. Your phone decides what to do with it by recognising a prefix. A wifi code contains your password in plain view. Up to 30% can be missing and it still reads. And the only real risk is not looking at the URL before opening it.