Are QR codes safe to scan? Mostly yes, for a reason the warnings tend to skip: a QR code is not a program. It is a printed pattern that encodes text, usually a URL. Scanning one runs nothing on your phone — it hands a string to your camera app, which offers to open it. Everything that can go wrong is at the other end of that link.
That is still a real risk, because you cannot read a URL by looking at a grid of squares. That opacity is what makes QR codes a good phishing vector, and both the FBI and the UK National Cyber Security Centre have warned about it. Here is what a code can and cannot do, and why a code you made might stop scanning.
What a QR code actually contains
A QR code is a grid of dark and light squares — modules — that encodes characters, standardised as ISO/IEC 18004 and now in its 2024 edition. Symbols run from 21×21 modules up to 177×177.
What a decoder hands back is text. Your phone then works out what it appears to mean:
- A URL — by far the most common, and the only payload that reaches out to anything.
- A contact card your phone offers to add to Contacts.
- Wi-Fi credentials it offers to use to join a network.
- A pre-filled email or message, which opens in a compose window rather than sending.
No payload type means "run this". The pattern cannot contain a program, grant itself a permission, or install anything. Everything a QR code does, it does by handing a string to software that already had those abilities.
So are QR codes safe to scan? The honest answer
The NCSC put it plainly in a February 2024 post: the risk sits in where the code takes you, not in the act of scanning. A malicious QR code and a malicious link in an email are the same attack — the QR version is just harder to inspect.
So "can a QR code give you a virus" has an awkward answer. Not directly. But the page it opens is an ordinary web page, with whatever risk an unpatched browser carries, and it can ask you to download something or type a password. In practice the damage is rarely malware; it is credential theft. The FBI advisory of 8 January 2026 on North Korean Kimsuky activity describes that shape — QR codes in spear-phishing emails leading to fake Microsoft 365, Okta and VPN login pages, with stolen session tokens replayed to get past multi-factor authentication.
Two things make this work better for an attacker than a plain link: many email security tools do not read the image a code sits inside, and scanning moves you onto a personal phone, away from your work machine's monitoring.
What your phone shows you before it opens anything
Neither major phone platform opens a scanned link on its own; both put a tappable banner in front of you first. That banner is your one chance to read the destination.
- iPhone and iPad — Apple's instructions: open the Camera app, hold the device so the code appears, then tap the link to open the content. There is also a Scan Code control for Control Center.
- Android — in Camera from Google you point the camera at the code, or tap QR first, then click the banner that appears.
Read that banner as a domain, not a sentence. What decides your destination is whatever sits immediately before the first single slash: example.com.verify-id.net/office365 is a page on verify-id.net. Banners truncate long URLs too. Both the FBI and the NCSC suggest using the built-in camera rather than a downloaded scanner app.
Why dynamic QR codes hide the real destination
Longer URLs need more modules, making a denser, more fragile code, so many printed codes encode a short link instead. Commercial platforms go further and sell dynamic codes: the pattern points at the platform's domain, which redirects to wherever you currently aim it — so you can fix a broken link on ten thousand printed flyers without reprinting them.
Two consequences. The banner shows the redirect domain, not the page you land on, so the check above tells you much less. And a code that was safe when printed can point somewhere else later, because the destination is editable while the pattern never changes. They are also a subscription product, with the trade-offs we covered in Free vs. Paid Online Tools: When Each Makes Sense.
The QR generator here makes static codes: the destination is baked into the pattern and nobody can change it remotely. The cost is no analytics and no editing.
The sticker problem, and where it actually happens
The physical attack is simple: print a code, stick it over a real one. The FBI's January 2022 public service announcement says criminals "tamper with both digital and physical QR codes to replace legitimate codes with malicious codes", and advises checking that a code has not had a sticker placed over the original. The FTC's December 2023 consumer alert names the same trick on parking meters, plus codes on unexpected packages and in unsolicited texts.
The NCSC adds calibration the scarier coverage drops. Codes on pub and restaurant menus are probably fine — tampering means doing it under staff supervision. The risky places are open and unattended: station car parks, parking machines, public notice boards, where a sticker goes on with nobody watching.
Run a fingernail across the code — a sticker has an edge you can feel.
The habits that actually matter
From the FBI, FTC and NCSC guidance, in order of impact:
- Read the domain on the banner before you tap. This covers most of the risk and costs nothing.
- Treat a code in an unexpected email or text exactly like a link in one. The image is not a safer container for a hostile URL, just a less inspectable one.
- Never install an app from a QR code. Find it in the official store yourself.
- Never enter a password or payment details after a scan you did not go looking for. That login page is the point of the exercise.
- For payments, skip the code. Type the address yourself, or call a number you already had.
- Keep the phone's OS updated. The FTC lists this explicitly.
None of this means stop scanning things; it means treating the banner as a URL bar. For the same reasoning from the other side, Are Online Password Generators Safe? How Client-Side Generation Works covers when a browser tool is worth trusting.
Why is my QR code not working?
Completely separate problem, and usually one of four causes.
- No quiet zone. The specification requires a four-module wide clear margin on every side of the symbol. Designers routinely crop it off to fit a layout, and the decoder can then no longer find the symbol's edges — the most common cause of a code that works on screen and fails in print.
- Printed too small. There is no universal minimum in millimetres; it depends on module count and scanning distance. A longer URL means more, smaller modules at the same size, so shortening the string often beats enlarging the code.
- Not enough contrast. Pale colours, gradients and background photos eat the margin a decoder needs to tell dark modules from light. ISO/IEC 18004 allows reflectance reversal — light on dark — but reader support varies, so dark-on-light stays the safe default.
- Damage beyond the error correction budget. Four levels exist, each trading capacity for recovery.
| Level | Approximate recovery | Typical use |
|---|---|---|
| L | ~7% of codewords | Clean digital use |
| M | ~15% | The common default for print |
| Q | ~25% | Codes that get handled |
| H | ~30% | Harsh use, or a centre logo |
Those figures are stated against total codewords rather than surface area, so treat them as a guide, not a damage allowance. A centre logo spends that budget before anything goes wrong in the real world, and raising the level to compensate adds modules, making each one smaller. Level H, a big logo and a small print size is a code that will fail.
Static QR codes, generated entirely in your browser — nothing is uploaded and nothing is tracked.
Open QR Generator →Frequently asked questions
Not directly. A QR code stores text and has no way to execute code or install software. What it can do is open a web page, and that page carries the same risks any web page does — it can host an exploit against an unpatched browser, or more commonly ask you to download something or enter a password. The realistic threat is phishing, not infection.
No, and in one respect they are worse. A QR code and a link do exactly the same thing, but you can hover over a link to see where it goes, whereas a QR code shows you nothing until you have already scanned it. The UK NCSC notes this is part of why criminals put them in phishing emails: many security tools scan text and links but do not read the image the code is sitting in.
Scan it with your phone's built-in camera and read the banner it shows you, without tapping. Both iOS and Android present the link and wait for a tap rather than opening it automatically. Check the domain immediately before the first single slash, since that is what determines the destination. If the code encodes a short link or a dynamic redirect, the banner will only show the redirect service, not the final page.
Most often the four-module quiet zone around the symbol has been cropped away to fit a layout, or the code has been printed too small for the number of modules it contains. Low contrast between the modules and the background is the next most common cause, followed by damage or an overlaid logo that exceeds the error correction level the code was generated with.