Someone posts a photo of a boarding pass on the way to a long-awaited trip. The name is legible, the flight number is legible, and the code in the corner has been smudged with a fingertip blur tool. It looks covered. To the person posting, the job is done.
To a decoder, that smudge is often just noise it was designed to see through.
What people are actually posting
The code is rarely decorative. Each of these carries something specific.
A boarding pass code holds booking details that, combined with a surname, can be enough to reach a reservation. An event ticket code holds a token the gate validates, and a token that gets used by someone else first is a token that stops working for you. A payment request code holds account identifiers. A WiFi code holds the network name and the password in plain readable text, with no encryption of any kind in the payload.
The worst case is a two-factor setup code. That square contains the shared secret used to generate your one-time codes. Anyone who scans it can generate the same codes as you, indefinitely, from their own device, and nothing about your account will look unusual until it does.
None of these are exotic scenarios. They travel through group chats and social feeds constantly, and QR codes already sit in an environment where fake and tampered codes are a working fraud category. Assume anything scannable in a public image will be scanned by somebody.
Error correction is working against you
QR codes were designed for the physical world: printed on boxes that get scuffed, stuck to windows that get rained on, folded into pockets. To survive that, the format builds redundancy into every symbol using Reed-Solomon error correction, in four selectable levels.
At the highest level, a symbol can lose roughly thirty percent of itself and still decode correctly. That is why a logo can sit in the middle of a marketing code without breaking it. Damage tolerance is a feature, deliberately engineered, and every decoder implements it.
Now apply that to your blur. Obscuring a corner, or a quarter of the surface, or the center, falls comfortably inside what the format was built to recover from. The code is not partially hidden. It is a slightly damaged code, which is exactly what it was designed to be. Our breakdown of error correction levels shows how much redundancy each level carries.
Blur, pixelation, and the emoji sticker
Each of the popular approaches fails for its own reason.
Gaussian blur preserves large-scale structure. Dark regions stay dark, light regions stay light, and the boundaries are still where they were. Decoders threshold an image into black and white before reading it, so a mild blur can survive that step almost intact. Heavy blur destroys more, but "heavy enough" is not something you can judge by looking.
Pixelation replaces regions with average colors. If the blocks are smaller than the code's modules, you have essentially preserved the pattern. If they are larger, you have lost some data, but the finder squares, the timing lines, and the overall geometry usually survive, and error correction can carry the gap.
An emoji or a sticker over the middle is precisely a logo overlay. That is the designed-for case. Marketing teams do it on purpose because it does not break the code.
One rule replaces all of that judgment: if any part of the original pattern is still visible, assume the code is recoverable.
What actually removes a code from a picture
Two techniques work, and both are boring.
- Draw a solid, fully opaque rectangle over the entire symbol in a single flat color. Not a semi-transparent overlay, not a rounded highlight, not a marker effect with a soft edge.
- Extend that rectangle past the edges of the code, including the white quiet zone around it. Every corner square must be gone. Partial coverage of the finder patterns is still partial coverage.
- Or crop the code out of the frame entirely, which is faster and leaves nothing to reason about.
- Scan the rest of the image for a second copy. A code reflected in a window, visible on a laptop screen in the background, or printed on the sheet of paper next to the one you covered defeats the whole exercise.
If the image only exists to show a friend where you are sitting, consider whether it needs the pass in the frame at all. The most reliable redaction is the photo you take from a different angle.
Flatten the file, then test the file
Covering the code in an editor is not the same as covering it in the file you send.
Many photo apps edit non-destructively. The original stays intact and the edits are stored as instructions, reversible with one tap and sometimes carried along when the file is shared. Export a flattened copy rather than sharing the edited original, and confirm the export is what you think it is.
Metadata is the second trap. Image files can carry an embedded thumbnail generated before your edit, and some tools do not regenerate it. Strip metadata on export when the option exists. There have also been documented cases of screenshot editing tools writing an edited image over the original file without truncating the leftover bytes, leaving the pre-edit version recoverable from what looked like a finished file. Those specific bugs get patched, but the lesson is durable: trust the exported file, not the editor preview.
Then test it properly. Take the file you are about to post, not the version on your editing canvas, and run it through a decoder. Upload it to a tool that will read a code from a picture. If anything decodes, go back and cover more. This takes fifteen seconds and it is the only step that actually verifies the result. Broader habits for handling codes safely are collected in QR code security.
The same physics, the opposite goal
There is a neat symmetry here. Most people meet QR error correction from the other direction, when a code is soft, damaged, or badly printed and they need it to work anyway. That is the blurry QR code problem, and the answer there is to give the decoder more to work with: better light, a sharper source, a straighter angle.
Redaction is the same property viewed from the far side. The tolerance that makes a code readable through a coffee stain is the tolerance that makes it readable through your blur. Fighting it with a soft brush is fighting a system that was engineered to win that fight.
Open the screenshot you were about to post, put a solid black rectangle over the code and its margin, export a flat copy, and upload that copy to a decoder before it goes anywhere.