Preview the decoded content before opening it, inspect the entire destination, distrust unexpected payment or login prompts, and do not encode secrets you would not print in plain text. When creating a code, test the final image in its real setting and provide a readable alternative destination.
What a QR code actually contains
A QR code stores encoded data in a grid of dark and light modules. That data might be ordinary text, a web address, contact information, Wi-Fi configuration, a telephone number, or another application-specific value. Scanning decodes the value; the next action depends on the scanning application and the user’s choice.
The square pattern does not reveal whether the destination is safe. Two codes can look almost identical while directing people to completely different websites. This makes context and destination preview essential.
How QR codes are abused
A malicious code may send a person to a convincing imitation login page, request a payment, initiate a call or message, or encourage an unsafe download. Printed codes create another risk: someone can place a replacement sticker over a legitimate parking, restaurant, event, or payment code.
Urgency should increase caution. Messages claiming that payment is overdue, an account will close, a package cannot be delivered, or immediate verification is required use the same pressure techniques found in email and text-message phishing.
Treat the decoded address like a link received through any other channel. The convenience of scanning should not bypass the checks you would perform before clicking.
Checks to make before opening a code
Inspect the physical code
Look for stickers, mismatched branding, damage, or placement that does not make sense.
Preview the result
Use a scanner that displays the decoded text or destination before opening it.
Read the full domain
Check spelling, subdomains, the connection scheme, and whether a short link hides the destination.
Use another route
For payments or account access, open the official application or type the known address yourself.
If a code leads to a login page, do not assume the branding proves authenticity. Password managers may help because they associate saved credentials with specific domains, but you should still inspect the address. Never install an application or device-management profile merely because a scanned code asks you to.
Creating a QR code responsibly
Use the shortest stable destination that you control, and avoid unnecessary tracking parameters. Test the code with multiple devices at the physical size and distance people will use. High contrast, a clear quiet zone around the code, and sufficient resolution improve reliability.
Provide a readable text alternative near the code. This helps people who cannot scan it, lets cautious users type or verify the address, and preserves access if the image is damaged. If the destination may change, use a redirect on a domain you control rather than depending on an unrelated shortening service.
Privacy when generating and scanning
A locally generated QR code can be created entirely in browser memory, so the generator does not need to receive the encoded text. That is useful when creating simple text or internal links, but it does not make the resulting code secret. Anyone who sees the image can decode it.
Opening the destination creates a normal network request. The destination can receive information normally associated with a web visit, even if generation was local. Do not describe a QR code as anonymous or untrackable unless the complete destination workflow supports that claim.
Do not encode exposed secrets
A printed or shared QR code should be treated as publicly readable within its environment. Avoid placing passwords, recovery codes, private keys, confidential personal data, or long-lived access tokens directly into it. If a QR workflow grants access, the referenced system should apply appropriate authentication, expiration, and authorization.
Frequently asked questions
Can a QR code itself contain malware?
A normal QR code contains encoded data such as text or a URL. The danger usually comes from what a device does with that data, such as opening a malicious website, starting a payment, or prompting the installation of an unsafe application.
How can I check a QR code before opening it?
Use a scanner that previews the decoded destination, inspect the complete domain and scheme, and cancel if the address is shortened, misspelled, unexpected, or inconsistent with the physical context.
Is it safe to put a password in a QR code?
Usually not. Anyone who can view or photograph the code may recover its contents. Treat a QR code as visible data unless a separate system securely protects what it references.
Does generating a QR code locally prevent tracking?
Local generation prevents the generator from needing the encoded text, but the destination website can still collect normal request information when someone opens the link.
Primary reference
- U.S. Federal Trade Commission: Scammers hide harmful links in QR codes — consumer guidance on destination checks, unexpected messages, and malicious QR links.