Are QR codes safe?
Short answer: the technology is safe — the destination is the question. A QR code cannot execute code, install anything or "hack" a phone; it is printed data, an envelope with an address on it. Every real-world QR risk is the address.
The actual threat: quishing
QR phishing works because codes are opaque to humans: a fraudster prints a malicious code and stickers it over a legitimate one — parking meters, restaurant tables, charity posters — or embeds one in an email to route around link filters. The victim scans, lands on a convincing look-alike page, and types credentials or card details. Note what the attack needed: not a flaw in QR codes, but the victim opening a destination unseen.
The 3-second habit that defeats it
Modern phones show the decoded URL before opening it. Reading it is the entire defense:
- The organisation's real domain, spelled exactly, over HTTPS → proceed.
- A shortener or unknown domain where you expected a brand → stop; the legitimate party may have hidden their address behind a service, with all the reliability costs that carries — but you cannot verify it, so don't gamble.
- A sticker sitting on top of another code, misaligned or bubbled → physical tampering; report it.
- And never enter credentials or payment details on a page you reached by scan unless the URL passed the check above.
The creator's side: making codes people can trust
If you publish QR codes, safety is also a design duty — and it happens to align exactly with reliability:
- Encode your own HTTPS domain, directly. A direct, readable address is both the permanence architecture and the verifiable one — your customers *can* check you, so the careful ones will.
- Skip shorteners and rented redirects: they make your legitimate code indistinguishable from a fraudulent one at the moment of scan.
- Give the code context: your brand nearby, a label saying what it opens ("Scan for the menu"). Anonymous codes train customers to scan blindly — the exact habit quishing exploits.
- Run the pre-print verification so the code you ship is the code you meant.
Safety and permanence turn out to be the same engineering: no intermediary, your domain, verifiable by anyone. Build codes that survive skepticism, and the skeptics become your best scanners.
Frequently asked questions
Can a QR code contain a virus?
No. A QR code is inert data — it cannot execute anything. The risk is the destination it points to: a malicious page, a fake login, a fraudulent payment. The code is the envelope, not the letter.
What is quishing?
Phishing via QR code: a malicious code placed over a legitimate one (parking meters, menus, posters) sends victims to a look-alike site that harvests credentials or payments. The physical sticker-over-sticker check and the URL preview habit defeat most of it.
How do I check a QR code before trusting it?
Your phone shows the decoded URL before opening it — read it. Expect the organisation's real domain and HTTPS; be suspicious of shorteners, look-alike spellings, and codes on stickers that overlap another code.
Are QR codes safe to use for my business?
Yes, and more so if you make them verifiable: encode your own HTTPS domain directly (no third-party redirect), print with context (your brand around the code), and tell customers what the code does.
Create a QR code that answers to no server.
Static, permanent, yours. €5 once — no subscription, no expiry, print-ready files.
Create my permanent QR