QR Code Security and Privacy: What You Should Know
Published January 23, 2026 · QR Toolkit Editorial Team
A QR code itself is just a pattern that encodes text or a link — it can't run code, install anything, or take action on its own. The real risk comes from where the encoded content leads, not the code's format.
What a QR code can and can't do
- Can: open a link, pre-fill a message or email, join a WiFi network, or display text.
- Can't: install software, run scripts, or access your device automatically just by being scanned.
How to scan safely
- Check the preview link your phone shows before tapping through — avoid shortened or unfamiliar domains you don't recognize.
- Be cautious of QR codes that look like stickers placed over an original code (a sign of tampering).
- Don't scan codes from untrusted sources asking for logins or payment details.
WiFi and contact QR codes specifically
A WiFi QR code contains your network password in a readable form — treat a printed one like a written password. A vCard (contact) QR code only contains the fields you choose to include, and nothing is transmitted anywhere when it's generated or scanned.
How this site handles your data
Every tool here generates QR codes directly in your browser. WiFi passwords, contact details, and other sensitive input are never uploaded to a server — see our privacy policy for details.
Frequently asked questions
What is "quishing"?
Quishing (QR phishing) is when a scammer places a fake or replacement QR code — for example, a sticker over a legitimate one — that leads to a malicious site designed to steal information.
Can a QR code install malware just by scanning it?
No — scanning a QR code only reveals the encoded link or text. Modern phones show a preview before opening anything, and no code, malicious or not, can execute automatically from a scan alone.