Skip to content

Is it safe to scan a QR code?

Scanning a QR code is safe in itself: it only reads text, usually a web link. The risk is the same as clicking any link, so check where it goes before you open it, and be careful with codes on stickers, in unexpected emails or that ask for payment or passwords.

Updated

What a QR code can and cannot do

A QR code is a picture of some text. Most of the time, that text is a web address. Sometimes it is a WiFi login, a contact card, a phone number or a pre-filled message. When you scan it, your phone reads the text and asks what to do with it. It does not open, install or send anything by itself.

So the useful question is not “is this code safe?” but “is this link safe?” The same habits you use for links in emails and texts work here.

How big is the risk?

Real, but small and avoidable. Government security agencies in the US and UK have warned about QR code scams. The UK’s National Cyber Security Centre has also said that codes in places like pubs and restaurants are probably safe, and that QR fraud is small compared with other kinds of fraud. The risk is higher where a scammer can easily stick a fake code, or where a code arrives unexpectedly.

Where to take more care

Watch for these patterns, all named in official warnings:

  • Stickers on top of a real code, especially on parking meters, charging points, bike hire and posters in public places. If the code looks stuck on, feel the edge.
  • Codes in unexpected emails, texts or letters saying a delivery failed, a payment is due or your account has a problem. Scammers use codes because email filters cannot always read them.
  • Payment codes for parking or fines. Use the operator’s official app or type the website address from the sign instead.
  • Codes that lead to app downloads. Get apps from your phone’s official app store by searching for them yourself.
  • Pages that ask for too much, like your bank login to read a menu.

How to read the preview

  • iPhone: the Camera shows a yellow link button with the website name when it sees a code. Read it before you tap.
  • Android: the camera or Google Lens shows the address. Tap only if it looks right.

Check three things:

  1. The domain. The part just before the first single /, like example.com in https://example.com/menu. Is it the company you expect?
  2. The spelling. Scam sites use near-misses: extra letters, swapped letters, or the real name with words added.
  3. Short links. Addresses like bit.ly/... hide the destination. They are common and often fine, but when a code asks for money or a password, go to the company’s website or app yourself.

If you already scanned something suspicious

  • You only opened a page: close it. Opening a web page is rarely harmful on an updated phone.
  • You entered a password: change it now, on the real website, and anywhere you reuse it. Turn on two-step verification.
  • You entered card or bank details: call your bank using the number on your card.
  • You installed an app: delete it, and check your phone’s settings for anything new it was given access to.
  • Report it: tell the business whose code was faked. In the US, report scams to the FTC at reportfraud.ftc.gov or the FBI at ic3.gov. In the UK, forward scam emails to report@phishing.gov.uk.

Making codes people can trust

If you make QR codes for a business, you can make them easier to trust:

  • Link to your own domain, so the preview shows a name people recognise.
  • Print a label that says what the code does, like “Scan for our menu”.
  • Check your printed codes now and then for stickers placed over them.
  • Prefer static codes for print. A static code contains your real link; nobody can change where it points after printing. A dynamic code goes through a redirect, which is useful but is one more thing that has to stay secure. The static vs dynamic guide explains the difference.

Every code made on this site is static: the link you see in the preview is the link inside the code, with nothing in between.

For help with the camera itself, see how to scan a QR code on iPhone and Android.

Make a QR code that never expires

QR code generator

What should the code open?
Website details

Paste the full link. If you leave out https://, it is added for you.

Colors, size and logo

Higher levels survive damage and logos but make the code denser.

Your image stays on your device. Adding a logo switches error correction to High.

Example QR code

Example. Fill in the form to make yours.

Static code. Free forever. It never expires.

How to check a QR code before you open it

  1. Use your phone's own camera

    The built-in camera shows the link before opening it. You do not need a separate scanner app.

  2. Read the web address in the preview

    Check the domain is the one you expect, spelled correctly, before you tap.

  3. Be careful with payments and logins

    If a code asks you to pay or sign in, go to the company's app or type its address yourself instead.

Questions people ask

Can scanning a QR code hack my phone?

Scanning only reads text. Nothing happens until you open what it contains, usually a link. The risk is the same as tapping a link in a message: it could lead to a fake website or a download. Keep your phone updated and check the link first.

What is quishing?

Quishing is phishing with a QR code. Instead of a link in an email or text, the scammer uses a code, often on a fake sticker or in an email, that leads to a fake login or payment page.

Are QR codes on restaurant tables and menus safe?

Usually, yes. A code printed on a menu in a place you chose to visit is low risk. Be more careful with codes in unsupervised places, like parking meters and stations, and with codes that arrive in unexpected messages.

How do I check where a QR code goes?

Point your phone's camera at it and read the address in the preview before you tap. Look for a familiar domain with correct spelling. Short links hide the destination, so treat them with more care when money or passwords are involved.

I scanned a suspicious code. What now?

If you only opened a page, close it. If you entered a password, change it straight away and turn on two-step verification. If you entered card details, call your bank. Report the code to the business, and to the police or national fraud reporting service.

Are QR scanner apps safer?

Not usually. The camera built into iPhone and Android phones already shows a preview. The FBI has advised against downloading third-party scanner apps, which can themselves be harmful.