Short answer: scanning one is about as risky as reading a link somebody handed you on paper. The code itself is inert. What matters is where it points, who put it there, and — if it is your code — whether you actually own it.
The tool QR Code Generator Links, Wi-Fi, email and more. The code points straight at your data, with no redirect.What a QR code really is
It is text, written as black and white squares so a camera can read it. That is the whole of it. There is no program inside, nothing that executes, nothing that can reach your phone by itself.
The text is usually a web address, but it does not have to be. It can be a phone number, a message, a set of Wi-Fi credentials, a contact card, or just a few words. Your phone reads the text and offers to do the obvious thing with it — open the address, dial the number, join the network.
Which means the risk is not in the code. It is in what the text says, and in the fact that you cannot read it with your eyes first.
The attack that actually happens
It has a silly name — quishing — and a very simple method: put a code where somebody expects to find one, and point it somewhere else.
A sticker over the code on a parking meter. A fresh code on a restaurant table. A poster in a station. A code in an email, used because a picture of a link gets past filters that would have inspected a real one. The page it leads to looks like the one you expected and asks for a card number.
None of that is a flaw in QR codes. It is the oldest trick there is, wearing a square black pattern.
What to look at instead
- Read the address before you open it. Both iPhone and Android show you the destination and wait. That pause is the entire defence, and almost nobody uses it.
- Look at the domain, not the words. The part immediately before the first single slash is the only part that means anything. Everything else can be made to say whatever the sender likes.
- Be suspicious of a sticker. A code printed as part of a sign is hard to fake. A sticker on top of one is the easiest thing in the world.
- Never enter card details on a page you reached by scanning something in the street. If a parking meter wants payment, use the app or the number printed on the machine.
- A code that arrives in an email deserves the same suspicion as a link in one. It is a link. It is just wearing a disguise that filters cannot read.
Can a QR code contain a virus?
No. There is nothing in a QR code that can run on your phone. It is a few thousand characters of text at most, and reading text is not dangerous.
What it can do is take you to a page that tries something — a fake login, a download, a payment form. That is a risk of the destination, identical to clicking a link, and handled the same way.
The part nobody explains: static or dynamic
If you are making codes rather than scanning them, this is the section that matters, and it is the one QR services tend not to lead with.
| Static | Dynamic | |
|---|---|---|
| What is inside | Your address, directly | A short link owned by the generator |
| Can the destination change? | No | Yes — that is the point of it |
| Who sees the scans | Nobody | The generator, and you |
| Needs an account | No | Almost always |
| Stops working if… | Your page goes away | The subscription lapses or the company closes |
A dynamic code is genuinely useful when you need it — a menu whose link changes each season, a campaign you want to measure. The price is that the code no longer points at you. It points at a company, which points at you, for as long as the arrangement holds.
That last row is the one that costs money. Codes printed on menus, packaging, business cards, vehicle livery and signage are expensive to reprint and impossible to recall. A code that stops resolving because a card on file expired is a permanent, physical, public failure.
How to tell which one you have
Scan it and read the address. If it is yours, the code is static and nothing can take it away. If it is a short domain you have never heard of, it is dynamic and it depends on that domain continuing to exist.
The tell when creating one: a generator that asks you to register, or offers to “edit the destination later” and “track scans”, is producing a dynamic code. That is not dishonest — it is how the business works — but it should be a decision rather than a surprise.
The generator here only makes static codes. There is no server to redirect through, so there is nothing to expire, nothing to subscribe to, and no record of who scanned what. The trade-off is real and worth stating: you cannot change where it points afterwards. Print it when you are sure.
Why some codes have a logo in the middle
Because QR codes carry redundancy. Every code stores its data more than once, at one of four levels:
| Level | Can be damaged | Use it for |
|---|---|---|
| L — Low | 7% | Screens, clean printing, long content |
| M — Medium | 15% | The sensible default for almost everything |
| Q — High | 25% | Small print, labels, anything handled a lot |
| H — Highest | 30% | A logo in the middle, or a surface that will get dirty |
A logo covering the centre works because the reader can rebuild what is underneath it. Push past the level you chose and the code stops reading — which is why a logo added in a design program after the fact so often fails, while one placed at level H does not.
The cost of redundancy is density: the same text at level H makes a busier code than at level L, and a busier code needs to be printed larger.
Printing one so it actually scans
- Leave the white border. Four squares’ worth all the way round — the quiet zone. Readers use it to find the edges, and a design that crops it tight is the most common reason a code fails.
- Dark on light, not the reverse. Plenty of readers cope with an inverted code and plenty do not, and you will not know which one your customer has.
- Keep the content short. A long URL makes a dense code that needs to be bigger. Shorter address, simpler code, easier scan.
- Test on more than one phone. Different cameras, different lighting, one older device. Before five thousand copies, not after.
One thing about Wi-Fi codes
A Wi-Fi QR code is the most useful of the lot and the one worth thinking about for ten seconds first.
It contains your network password as plain text. Anyone who photographs the card on the counter has it, and keeps it after they leave. For a café guest network that is precisely the intention. For your home network, printed and stuck to the fridge in front of visitors and tradespeople, it is worth a moment’s thought — or a guest network, which is the answer either way.
So: are they safe?
Scanning one is safe. Acting on what it says is where judgement comes in, and it is the same judgement a link in an email needs: read the address, look at the domain, and be sceptical about anything asking for money.
Making one is safe too, as long as you know whether the code belongs to you or to somebody who will invoice you for it later.