Are QR Codes Safe? A Guide for Scanners and Businesses

A QR code is just information printed as a pattern of squares. Usually that’s a web address, but it can also be a WiFi login, a contact card or a short message. The code itself can’t do anything. The risk is always where it leads, and a few simple habits cover most of it, whether you’re scanning codes or printing them.

A QR code is just data

When you point your camera at a QR code, your phone reads the text inside it and shows you what it found. For a web link, most phones show the address and wait for you to tap it. For WiFi, they ask before joining the network.

That means the same rules apply as with any link in an email or text message. A code can lead to a helpful menu, or to a page that pretends to be something it isn’t. You can’t tell which by looking at the squares, so look at the preview instead.

Watch out for fake codes

The most common trick is a fake sticker placed over a real code. It shows up in places where people expect to scan and pay, such as parking meters, payment signs, public posters and shared tables. The fake code leads to a page that looks official and asks for card details or a login. This is sometimes called quishing, short for QR phishing.

Signs that a code may have been tampered with:

• it’s a sticker on top of a printed sign, or its edges are peeling
• it looks newer, brighter or a different size than the rest of the sign
• there’s a second code nearby, or the code sits in an odd spot
• the preview shows a web address that doesn’t match the business

How to scan safely

A few habits make a big difference:

• Read the preview before you tap. Check the address matches who you expect. Watch for misspellings and extra words in the domain.
• Don’t enter payment details on an unexpected page. If a parking meter code asks for your card number, you can often pay through the official app or at the machine itself instead.
• Be wary of urgency. Pages that warn of fines or say “pay now” are a common pressure tactic.
• Don’t install apps from a scanned link. Get apps from your phone’s official app store.
• When in doubt, type the address yourself. If you know the business’s website, go there directly.

Keeping your business’s codes safe

If you print QR codes for customers, a little upkeep protects them and your reputation:

• Check your printed codes now and then. Walk past your signs, table tents and window displays and look for stickers placed over them. Scan one to confirm it still goes where it should.
• Print codes directly on your materials where you can, rather than using stickers. A sticker on top then stands out.
• Use your own domain. Link to your own website address so customers recognize it in the preview. A frame with call-to-action text, like “Scan for our menu”, also tells people what to expect.
• Share guest WiFi, not your main network. A WiFi code contains the password in readable form, so anyone who scans it or photographs it can see it. Our WiFi QR code guide explains how to set this up.
• Don’t put secrets in text codes. Door codes, alarm codes, account numbers and passwords shouldn’t go into a code that anyone passing by can scan.

Privacy when you make a code

It’s also worth thinking about what happens to the information you type into a QR code generator. With KeptLink, the code is generated in your browser. What you type, including links, WiFi passwords and contact details, is never sent to KeptLink’s servers.

Codes made on KeptLink are also static. The content is inside the code and doesn’t pass through KeptLink when someone scans it. You can read more in our privacy policy, or learn how static codes differ from dynamic ones in our static vs dynamic guide.