How to Scan QR Codes Safely (What Most Scanner Apps Do With Your Data)
Last summer I watched a friend scan a QR code taped to a parking meter. It opened a payment page that looked almost right — almost. The URL had one extra letter. He caught it in time, but that moment stuck with me: we point our cameras at these pixel squares dozens of times a month and trust whatever comes out.
QR codes are just text in disguise, and text can lie. This guide shows you how to scan them safely: preview before you tap, recognize the red flags, and — the part nobody talks about — stop letting scanner apps upload every code you scan to their servers.
What a malicious QR code can actually do
A QR code can encode a URL, Wi-Fi credentials, a payment address, or plain text. The dangerous ones use URLs: they can lead to phishing pages that harvest your login, trigger automatic downloads, or open payment apps with the attacker's address pre-filled. The FBI has warned about 'quishing' stickers placed over legitimate codes on parking meters and restaurant tables. I keep a separate checklist of the red flags that give a malicious QR code away — worth a read if you scan codes in public often.
- Always preview the full URL before opening it — never tap blind.
- Check for lookalike domains (paypaI.com with a capital i, or extra subdomains).
- Be suspicious of QR codes asking for payment, especially stickers placed over originals.
- A QR code can't install an app by itself, but it can take you to a page that tries.
Your scanner app might be the bigger problem
Here's what surprised me when I looked into this: many free QR scanner apps upload every code you scan to their servers 'for analytics.' Think about what you scan — event tickets with your name, Wi-Fi passwords, payment links, boarding passes. That's a tidy little diary of your life sitting in someone's database.
A scanner that decodes the image on your device has no reason to phone home. That's why I built our QR Code Scanner to use the browser's built-in BarcodeDetector: the image is decoded locally, the result appears instantly, and nothing is transmitted. If a scanner needs the internet to read a QR code, it's doing something extra with your data. The same logic applies when I make codes myself: I use our QR Code Generator, which builds the code locally too, so the link or Wi-Fi password I'm encoding never touches a server either.
The 10-second habit that keeps you safe
- Scan the code but don't tap the result yet.
- Read the full URL carefully — domain, spelling, and whether it's http or https.
- If it's a payment or login, navigate to the official site yourself instead of following the link.
- When in doubt, ask: does this QR code belong here? A sticker over a printed code is a red flag.
Ten seconds of skepticism beats hours of cleaning up a compromised account. Make previewing the URL a reflex, the same way you glance both ways before crossing a street.
If you already tapped a bad QR code
Do not panic, but do act fast. First, close the tab and do not enter any credentials, payment details, or codes on the page it opened — a phishing page only works if you hand it something. If you did enter a password, change it immediately from the official site (type the address yourself, do not follow another link), and change the same password anywhere else you reused it.
Second, check what the page may have triggered: look for unexpected login alerts, new devices on your accounts, and recent payments. Turn on two-factor authentication where it is missing, and review the permissions of any app the page asked you to install. If a payment was made, contact your bank or payment provider straight away — the sooner you report it, the better your chance of reversing it.
Third, report the code: tell the venue or the owner of the surface it was stuck to, so the sticker can be removed before someone else scans it. And for next time, decode codes before you tap anything — our QR Code Scanner shows you the destination locally, without uploading the image, and I keep a separate checklist of the red flags that give a malicious QR code away for the cases where the preview alone is not enough to judge.