Scanning QR Codes Safely
QR codes are a URL with a paint job. That means every risk of clicking a link online applies when you scan one — plus a few extra, because you cannot see the destination in advance.
Last updated July 23, 20264 min read
What can hide inside a QR code
- A malicious URL that mimics a real login page.
- A pre-filled email or SMS ready to send to a premium-rate number.
- Wi-Fi credentials that join your device to an attacker-controlled hotspot.
- A vCard that quietly adds contacts to your address book.
Quishing — QR phishing
Attackers now paste malicious QR stickers over legitimate ones on parking meters, restaurant menus, and public posters. Because you scan on a phone, the browser bar is short and lookalike domains slip past unnoticed.
Safe scanning habits
- Always preview the URL before opening — every modern camera app shows it.
- Refuse codes that immediately open an app or trigger a download.
- Never enter passwords on a page you reached from a public QR code — navigate manually instead.
- Be extra careful with codes stuck on public property; inspect for a sticker-over-sticker layer.
Tip: Our QR Code Scanner runs in your browser and shows you the decoded content before you act on it — no auto-opening.
If you already scanned something suspicious
Close the page immediately, forget any Wi-Fi network you joined, and clear any downloads you did not intend. If you entered credentials, change them from a device you trust.