The largest QR code the specification defines holds 2,953 bytes. Every distinct sequence of 2,953 bytes is a distinct payload, so the number of those payloads is 256 raised to the power 2,953. Written out in decimal, that is a number with 7,112 digits, beginning 3.4 and continuing for another seven thousand one hundred and eleven places. Nothing physical is ever counted in numbers that size.
That is one answer and it is exact for what it measures. The reason the question feels slippery is that "how many QR codes are possible" can mean at least three different things, and the three have very different answers.
Decide what you are counting
Three candidates, each legitimate.
The number of distinct payloads a QR code can carry. This is the useful one. Two codes carrying the same string are the same code for every practical purpose, even if one was generated at a higher version with a different mask.
The number of distinct valid symbols, meaning module patterns that actually decode. Larger, because one payload can be encoded at many versions, at four error correction levels, with any of eight masks applied, and each of those is a different picture of the same information.
The number of distinct module patterns in a grid of that size, valid or not. Largest of the three and nearly meaningless, since the overwhelming majority of them are not QR codes at all.
What follows counts the first, and states each bound as what it is rather than as an exact census of anything.
The bound at the largest version
Version 40 at the lowest error correction level is the maximum-capacity configuration: 7,089 numeric characters, 4,296 alphanumeric characters, 2,953 bytes or 1,817 kanji. Those ceilings come from the capacity tables, and each mode produces a different count.
In byte mode, a payload of exactly 2,953 bytes has 256 possibilities per byte, giving 256 to the power 2,953 payloads. As a power of two that is 2 to the 23,624th, which in decimal has 7,112 digits.
In numeric mode the ceiling is 7,089 digits, so roughly 10 to the 7,089th distinct numbers of that length. Smaller than the byte-mode figure, which is the right relationship: numeric mode packs in more characters but fewer possible values per character.
Two caveats keep this honest. These counts cover payloads of exactly the maximum length. Including every shorter payload raises the total by a factor a little above the base divided by the base minus one, which changes nothing at this scale. And the byte-mode figure assumes any byte string is a legal payload, which in raw byte mode it is, even where a decoder would present the result as unreadable text.
Version 1 already exceeds the internet
The interesting part of the arithmetic is how quickly it stops mattering.
Version 1 is a 21 by 21 grid, the smallest symbol there is, sparse enough to redraw on graph paper. At the lowest error correction level it holds 17 bytes. The count of 17-byte payloads is 256 to the 17th, which is exactly 87,112,285,931,760,246,646,623,899,502,532,662,132,736: forty-one digits, about 8.7 times 10 to the 40th.
For comparison, the whole IPv6 address space is 2 to the 128th, about 3.4 times 10 to the 38th. The smallest QR code in existence carries more distinct payloads than there are addresses in the protocol designed to number every device on Earth for the rest of time.
Estimates put the number of atoms in the observable universe somewhere near 10 to the 80th. A version 2 code passes that. Everything above version 2 is arithmetic with no physical referent at all, which is why the honest answer to the original question is a bound rather than a count of objects.
The pattern count, for completeness
Ignore validity and ask instead how many black-and-white pictures fit in a version 40 grid. That grid is 177 by 177, which is 31,329 module positions, so 2 to the 31,329th patterns: a number with 9,431 digits.
Almost none of them decode. The three finder patterns and their separators are fixed. Timing patterns are fixed. Alignment patterns are fixed. Format and version information are constrained. Data modules carry error correction codewords computed from the data, so most bit combinations are invalid by construction, and one of eight masks has been applied on top of all that. The structural elements that make a code readable are exactly the ones that make this count an overestimate by an enormous margin.
It is a genuine upper bound and a useless answer. Quote it only if somebody specifically asks how many pictures could sit in the grid.
The constraint is the URL, not the format
Nobody has ever run out of QR codes. What people run out of is room on the object.
Every character you add pushes the payload toward the next version, each version adds four modules per side, and at a fixed printed width more modules means each one is narrower. Somewhere below the resolution of your printing process or the scanning camera, reads start failing at the edges of the light and angle range. That ladder is laid out in versions 1 to 40, and its physical end is in the size guide.
So the capacity question that matters is never how many codes exist. It is how short you can make the one string you are encoding. A 40-character redirect and a 240-character URL carrying five tracking parameters are identical from the visitor's point of view and about three versions apart on the label.
The number that does run out
One count in this territory is small enough to plan around: the space of short identifiers behind your codes.
A short link using six characters drawn from upper case, lower case and digits gives 62 to the 6th, about 56.8 billion values. Seven characters gives about 3.5 trillion. Those are the numbers to check when you are minting per-item identifiers, because unlike the format itself they are finite in a way a real system can reach.
There is a sharper limit hiding inside that one. If identifiers are handed out sequentially, the space you can safely use is not the whole space, because anyone can guess the next one. If they are drawn at random, collisions become likely long before the space is full, at around the square root of its size, so a 56.8 billion space starts producing collisions in the hundreds of thousands of draws unless you check on insert. That is a real engineering constraint, and it is the only number in this article anybody will ever actually hit.
Encode your longest real URL and your shortest redirect version of the same link, put the two symbols side by side, and count the modules on each. That difference is the only capacity figure that changes what you print.
