QR Code Security Guide: How to Scan QR Codes Safely

QR codes are convenient. You can use one to open a restaurant menu, pay for parking, join a Wi-Fi network, open a website, or get information from a poster. The problem is that a QR code does not tell you whether its destination is trustworthy. That is why QR code security is less about the square pattern itself and more about checking where the code takes you before you trust what you see.

What is QR code phishing?

QR code phishing is an attack that uses a QR code instead of, or alongside, a normal clickable link. The attacker creates a QR code pointing to a fraudulent website. The surrounding message may pretend to come from a bank, postal courier, employer, or government agency with the goal of harvesting credentials or stealing payments.

What is quishing?

Quishing is short for "QR code phishing." The malicious URL is hidden inside a QR code, which can make the attack harder to notice because users focus on the visual image rather than the destination link. The FBI has documented quishing campaigns where malicious QR codes embedded in phishing messages directed victims to fraudulent websites.

How can a QR code hide a malicious URL?

A QR code is simply machine-readable data. That data can be a web address, plain text, or custom URI scheme. When a QR code stores a URL, the physical image does not visually show whether it points to the genuine website or a deceptive spoofed domain. The safest habit is to inspect the decoded destination before opening it in your browser.

How to inspect a QR destination

Scanning a QR code does not mean you must immediately visit the resulting site. When your scanner decodes the payload, examine the domain carefully for misspelled brand names, abnormal top-level domains, unexpected subdomains, or suspicious URL paths. Remember that HTTPS only encrypts the connection; it does not prove that a website is trustworthy.

Fake QR-code stickers

Scammers can print malicious QR code stickers and physically paste them over authentic codes on parking meters, restaurant tables, posters, and public transit kiosks. Before scanning a physical code, check whether an adhesive decal has been placed over an existing sign.

QR codes in phishing emails and text messages

Be skeptical when an unexpected QR code arrives via email or SMS with an urgent demand to verify an account or pay an overdue bill. Instead of scanning the code, open a browser and navigate directly to the company's verified website.

Dangerous URL schemes

Not every QR code contains a standard web link. Codes can store dangerous URI schemes like javascript: or data: that can execute arbitrary script or embed malicious forms. Scanners must treat all decoded content as untrusted input and avoid executing code automatically.

How to scan a QR code safely

Scan only codes from sources you trust, preview the decoded URL before opening, verify domain spelling, question urgent demands for sensitive data, and keep your phone and browser software updated with the latest security patches.

Browser-based QR scanning

You can use our free in-browser QR code scanner to decode codes via your webcam or uploaded photos without installing third-party apps that bundle advertisements or trackers. Every frame is processed client-side with zero server uploads.

QR code privacy

QR codes can store private URLs, Wi-Fi credentials, contact cards, or account details. Think carefully before encoding sensitive data with a QR code generator or sharing codes publicly. Review our Privacy Policy to understand our zero-knowledge approach.

What if you already scanned a suspicious QR code?

If you scanned a suspicious code, close the browser tab immediately. If you submitted passwords, change them across all accounts right away and enable multi-factor authentication. If you entered card numbers, contact your bank to freeze the card.

A simple QR code safety checklist

Ask yourself: Did I expect this code? Do I trust its source? Does the URL match the genuine domain? Is the domain spelled correctly? Is there artificial urgency? If anything feels suspicious, navigate directly to the official website instead.

Final thoughts

A QR scanner tells you what is encoded in a pattern. It cannot prove that the destination is trustworthy. That final check is always yours to make before entering information or completing payments.