Are QR codes safe?

A QR code is just a pointer

Scanning a QR code cannot, by itself, install malware or take over your phone. The code contains text — usually a link — and your phone shows you that link before doing anything. Every risk comes from what happens after you choose to act on it: visiting a malicious site, entering credentials, or making a payment. Treat a QR code exactly like a link someone hands you: harmless to look at, risky to trust blindly.

Quishing: QR phishing

Quishing is phishing delivered by QR code. An attacker puts a code on a flyer, email, parking sign, or fake notice that leads to a convincing copy of a real login or payment page. Because the destination is hidden inside the pattern, you can't eyeball it the way you'd scrutinize a typed link — which is precisely why it works. Common lures include fake parking fines, package-redelivery notices, bank "security alerts," and account-verification prompts.

The sticker-swap scam

A low-tech but effective attack: criminals print a malicious code on a sticker and stick it over a legitimate one — on parking meters, restaurant tables, e-scooters, or payment terminals. The surrounding sign looks official, so victims trust the code. If a QR code looks like a sticker applied on top of other printing, or the edges are peeling, don't scan it.

How to scan defensively

• Preview the URL. Most phone cameras show the link before opening it. Read the domain — does it actually match the brand? Our QR code reader decodes a code and shows its full destination, with scam-signal checks, without opening anything.
• Watch for look-alike domains. paypa1.com or bank-verify.example are not the real thing.
• Be wary of shorteners on physical codes from untrusted sources — they hide the true destination.
• Never enter passwords or payment details on a page you reached unexpectedly via a code. Open the official app or type the address yourself.
• Inspect the physical code. Peeling stickers or codes pasted over signage are red flags.
• Keep your phone updated so the browser's own phishing protections are current.

A quick pre-scan checklist

When you encounter a code in the wild, run through this in a couple of seconds before acting on it:

• Is the physical code intact? No sticker pasted over another, no peeling edges.
• Does the previewed domain match the brand? Read it before tapping; watch for look-alikes and shorteners.
• Is it asking for something sensitive? Unexpected login or payment requests are the biggest red flag.
• Did you expect a code here at all? An unsolicited code in an email or letter deserves extra suspicion.

None of these guarantee safety, but together they catch the overwhelming majority of malicious codes — which almost always rely on you scanning first and thinking later.

If you create QR codes

You can build trust into your codes: link to your real, recognizable domain (short and on-brand), avoid unnecessary shorteners so people can verify the destination, and protect physical codes from tampering. For payment codes especially, place them where they can't be covered and check them regularly — see payment QR codes. Generating your codes with a private, client-side tool like this one also means your data is never exposed in the first place.

Frequently asked questions