Are QR codes safe?
What a QR code can and cannot do to your phone, how QR phishing works, and the few habits that make scanning as safe as clicking a link you can see.
Short answerA QR code is as safe as the link inside it. Scanning cannot install anything or take over your phone by itself, but the code can send you to a phishing page or a malicious download, and you cannot see the address until it is decoded — so read the link preview before you tap it.
A QR code is a link you cannot read
Most QR codes contain a web address and nothing else. The phone decodes the pattern, shows you the address, and opens it in the browser only when you tap. In that sense a code is no more dangerous than a link in an email. See how QR codes work for what is inside the pattern.
The difference is that a printed link is readable and a code is not. You can glance at a link and notice a misspelt domain; you cannot glance at a QR code and notice anything. That is the whole of the risk, and it is why scammers use them.
| On its own, a code… | But it can lead you to… |
|---|---|
| Cannot install an app | A page that asks you to install one |
| Cannot read your files, contacts, or photos | A form that asks you to type personal details |
| Cannot take a payment | A fake payment page that looks like a real one |
| Cannot know your passwords | A copy of a sign-in page that captures them |
| Cannot change your phone settings | Instructions or a file that make you change them |
Some codes contain other things — Wi-Fi details, a contact card, a pre-written text message. Your phone still asks before joining, saving, or sending, so read that prompt as carefully as a link preview.
How QR code scams work
QR phishing, sometimes called quishing, is ordinary phishing with the link hidden in a code. The patterns that come up again and again are these.
- Stickers over real codes. A fake code is stuck on top of the genuine one on a parking meter, a car-park payment sign, an EV charger, or a restaurant table. It leads to a payment page that copies the real operator’s.
- Codes in emails. A message “from IT”, a bank, or a document-sharing service asks you to scan a code to sign in or re-verify an account. A code in an image is harder for mail filters to inspect than a written link, and it moves you to your phone, where the address bar is small.
- Fake delivery and fine notices. A card through the door or under a windscreen wiper says a parcel is waiting or a fee is due, and offers a code to pay or reschedule.
- Swapped crypto addresses. A donation poster or shop sign shows a wallet address as a code, and someone sticks their own code over it. Crypto payments cannot be reversed, so whoever prints a crypto address QR code should print the address in text beside it, and payers should compare the first and last characters before sending.
- Codes that push a download. The page says you need an app to view a menu, a document, or a parking session, and links to a file outside the official app store.
The common thread is urgency plus a request for money, a password, or an install. A genuine menu or information code rarely needs any of those.
How to check a code before you tap
- Scan, then stop at the link preview. Do not tap yet.
- Read the domain — the part before the first single slash. Does it belong to the organisation whose sign or letter you are looking at?
- Look for near-misses: extra words, swapped letters, unusual endings, or a link-shortener that hides the real destination.
- Look at the code itself. Is it a sticker on top of a printed sign? Are the edges peeling, or does it sit slightly off-centre?
- If the page asks for a password, card number, or an app install, close it and go to the organisation’s site or official app yourself.
If you have already entered card details on a page you now doubt, contact your bank straight away. If you entered a password, change it on the real site, and anywhere else you used it. How to scan a QR code shows where the preview appears on iPhone and Android.
If you put QR codes in front of customers
A business cannot stop someone sticking a fake code on its sign, but it can make the fake obvious and the real one trustworthy.
- Print the domain next to the code. “Scan or visit example.com/pay” lets customers compare the preview with something you printed.
- Print the code into the sign, rather than applying it as a sticker, so a stuck-on replacement is visibly different. Check signs in public places regularly.
- Place codes where staff can see them, or behind glass, rather than on unattended posts.
- Link to your own domain. A code that opens a third-party redirect domain looks just like a scam to a careful customer. A static code points straight at your address — see static vs dynamic QR codes.
- Never ask for passwords or payment details on a page customers reach from a code without a familiar, visible domain.
Codes made on this site contain exactly what you type, with no redirect in between, and nothing you enter is sent to a server. For links, the generator only accepts http:// and https:// web addresses.
Make a code that points straight at your own domain:Generate a QR code
Related questions
Scanning on its own does not install anything or give access to your phone. The risk is the page the code opens, which might ask for a password, payment, or a download. Read the link preview and do not tap if it looks wrong.
Quishing is phishing that uses a QR code instead of a visible link. The code leads to a fake sign-in or payment page, and because the address is hidden until scanned, it is easier to miss that the site is not genuine.
Check the address in the scan preview before opening it, and make sure the domain belongs to the organisation you expect. Be suspicious of stickers on top of signs and of any page that asks for passwords, card details, or an app install.
It can be, but parking meters and payment signs are common targets for fake stickers. Check that the code is printed into the sign and that the preview shows the operator’s real domain, or use the operator’s official app instead.
Be cautious, especially if the email asks you to sign in, verify an account, or pay. Go to the organisation’s website directly rather than scanning a code you were sent.