Overview
QR codes have become an essential part of the Bitcoin user experience. Bitcoin addresses, Lightning invoices, and payment URIs are long strings of characters that are impractical to type manually. QR codes solve this by encoding payment information into a scannable two-dimensional barcode, enabling fast, error-free transfers between devices. Nearly every Bitcoin wallet supports both generating and scanning QR codes.
QR Codes in Bitcoin Payments
Payment Flow with QR Code:
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ Recipient │ │ QR Code │ │ Sender │
│ generates │────>│ displayed │────>│ scans QR │
│ invoice │ │ on screen │ │ with phone │
└──────────────┘ └──────────────┘ └──────┬───────┘
│
┌──────▼───────┐
│ Wallet │
│ parses & │
│ confirms │
│ payment │
└──────────────┘
Common QR Contents:
• bitcoin:bc1q...?amount=0.001 (BIP21 URI)
• lnbc10u1p... (Lightning invoice)
• lnurl1dp68... (LNURL endpoint)
BIP21 Payment URIs
The BIP21 standard defines a URI scheme that QR codes typically encode for on-chain payments. A BIP21 URI can include the address, a requested amount, a label, and a message. Modern implementations can also include a Lightning invoice as a fallback parameter, allowing the sender's wallet to choose the most appropriate payment method.
QR Code Capacity
QR codes come in different sizes (versions) with varying data capacity. A standard Bitcoin address easily fits in a small QR code, but Lightning invoices can be quite long (hundreds of characters), requiring larger QR codes. LNURL addresses this by encoding a short URL that resolves to the full invoice, keeping QR codes compact and easily scannable.
Security Considerations
While QR codes themselves are simply a data encoding format and carry no inherent security risk, users should be cautious about:
- QR code replacement attacks — Malicious software could replace a displayed QR code with an attacker's address. Always verify the first and last few characters of an address before sending.
- Phishing QR codes — QR codes posted in public places could link to malicious websites or encode attacker-controlled addresses.
At Points of Sale
QR codes are critical for point-of-sale Bitcoin payments. The merchant's POS system generates an invoice, displays it as a QR code, and the customer scans it with their mobile wallet. On Lightning, the entire process from scan to confirmed payment typically takes just a few seconds.