What a QR code can and can't do
A QR code holds a small amount of text: a link, WiFi details, a contact card. Scanning one doesn't run a program or install anything. Your phone reads the text, shows you what it found and waits for you to tap.
The danger starts after that tap, when you open a page and then type something into it or download something from it. It's the same risk as a link in a suspicious email, with one difference. You can hover over an email link to check it, but you can't hover over a sticker.
How QR code scams work
QR phishing has picked up its own nickname, quishing. The common versions:
- Fake stickers placed over real codes on parking meters, EV chargers, restaurant tables and posters.
- Lookalike payment pages that copy a parking, toll or utility site and ask for your card.
- Letters, emails and texts with a code claiming a parcel is held, a fine is due or an account is locked.
- Fake sign-in pages that look like your bank or work email and collect your password.
Check before you open
- Read the preview. Your camera shows the address before it opens anything, as covered in the guides for iPhone and Android. Look at the domain, the name just before the first single slash, and make sure it belongs to who you expect.
- Be wary of lookalike spellings, extra words in the domain, and short links that hide the real address.
- Don't enter passwords, card numbers or personal details on a page you reached from an unexpected code. Go to the official site or app yourself instead.
- Touch the code. If it's a sticker on top of a printed sign, treat it as suspect.
- Install apps only from the official app store, never from a link in a code.
If you put codes out in public
- Point them at your own domain, so people recognize the address in the preview.
- Place them where they're hard to cover: printed into the sign, behind glass, or on tamper-evident labels.
- Say what the code should open, right beside it. A frame with a clear label helps people notice when something doesn't match.
- Check your codes regularly for stickers or damage.
- Never ask for passwords or payment through a page someone reaches by scanning.
Privacy and this generator
Codes made here are static, so they link straight to your destination with no middleman and no scan tracking. The code is generated in your browser, and nothing you type is sent to us. Dynamic code services work differently: every scan passes through their servers first, which the static vs dynamic guide explains.
Next time you scan, read the address before you tap. And if you're the one putting a code out in the world, write what it opens right next to it.
Frequently asked questions
Can scanning a QR code hack my phone?
Scanning only reads text, and your phone asks before acting on it. The risk comes from opening a malicious page, entering details or installing something. Keeping your phone updated covers the rest.
What is quishing?
Phishing through a QR code. A fake code, often a sticker over a real one, sends you to a lookalike page that asks for a password or card details.
How can I tell if a QR code is fake?
Check the address in the preview before opening, look for a sticker stuck over the original, and be suspicious of any unexpected code that asks for payment or a login.
What should I do if I entered details after scanning a bad code?
Change that password right away, along with anywhere else you reuse it, and turn on two-step sign-in. If you entered card details, call your bank and ask them to block the card.