The short answer
A QR code cannot give your phone a virus. A QR code is just a printed string of text — the camera reads the text off the image and then the phone decides what to do with it. The code itself carries no executable program and cannot run anything on its own.
What can harm you is the destination, not the code. If a QR code encodes a URL, scanning it takes your phone to that web page — and that page can be a phishing site, a fake payment form, or a malware download, exactly as a malicious link in an email or text can. This QR-guided phishing has its own name: quishing.
The code is just data — the destination is the risk
Reading a QR code is no different from reading a barcode or a printed paragraph: the camera turns squares on paper into text, and that is the end of what the code does. The phone then interprets the text — opening a URL, joining WiFi, saving a contact — and any of those actions, not the scan itself, is where risk lives.
A code encoding WiFi, a vCard, a calendar event, or plain text never even touches the internet: the phone acts on the data locally and there is nothing for an attacker to redirect. The risk is concentrated in URL codes, where a printed sticker can send scanners to any web page the attacker chooses.
Read the URL preview banner before you tap
When you scan a QR code, modern phones show a preview of the URL or action before opening it — a banner at the top of the camera or a small notification. That banner is your single most important defense, because it lets you decide whether the destination is what you expected before anything loads.
Check the domain. A sticker on a parking meter should point at the city’s official parking domain, not a look-alike like park1ng-pay.com. Watch for the telltale signs of phishing URLs: misspelled brand names, extra subdomains (secure-login.cityname.attacker.com), URL shorteners hiding the real destination, and http:// instead of https://. If the banner shows an action you didn’t expect — join a network, save a contact, open an app — treat it with the same caution as an unexpected link.
Common QR scams to watch for
Attackers exploit the fact that a printed sticker is cheap and anonymous, and that people trust codes stuck on real-world surfaces. Here are the recurring scams and how to avoid each one.
| Scam | How it works | How to avoid it |
|---|---|---|
| Fake parking / payment QR | A sticker placed over the real meter’s QR sends you to a look-alike payment page that takes your card. | Prefer the meter’s printed short code or coin slot; check the domain against the city’s official site. |
| Fake restaurant menu QR | A sticker slapped over a cafe’s table tent opens a phishing or payment page instead of the menu. | Ask staff for the real menu URL if the code looks like an added sticker; check the domain. |
| Fake poster / flyer QR | A public poster’s code is swapped for one pointing at a credential-harvesting login page. | Don’t enter passwords after scanning a stranger’s code; navigate to the brand’s site yourself. |
| Fake package / delivery QR | A text or door-hanger QR claims to reschedule a delivery and leads to a payment or info form. | Track packages in the carrier’s own app, not via a QR from an unexpected message. |
| Crypto / gift-card QR | A social-media or kiosk QR promises a giveaway and drains a connected wallet or account. | Never send funds or enter seed phrases after scanning a code; legitimate giveaways don’t need one. |
How to stay safe when scanning
Treat a QR code from an untrusted surface the way you would treat an unexpected link in a text: read the destination before you tap. Preview the URL banner, check the domain, and if a code asks you to type a password, enter payment details, or install an app, navigate to the brand’s official site or app yourself instead of trusting the sticker.
On the device side, keep your phone’s OS and camera app updated so you get the latest URL-preview and link-safety features. On iPhone, the native camera shows a banner you must tap; many Android devices add a Google Safe Browsing check. None of this protects you from a domain that looks correct but is a homoglyph — so when in doubt, type the address you already know rather than following the code.
Why QRForge’s static codes are safe by construction
A static QR code encodes its payload directly into the image — there is no redirect, no lookup, and no server that could be quietly repointed. When you generate a static URL code here, the destination is baked into the pattern and cannot be changed after printing, so scanners always land on exactly the URL you chose. That is safe-by-construction: the only thing to vet is the destination you yourself control.
The future paid dynamic tier is different by design: a dynamic code stores a short redirect link on a server, so the destination can be edited later. That editability is the whole point of dynamic codes — and it is also why a dynamic redirect is an abuse surface that must be hardened (validate destinations, block open-redirect and SSRF abuse, rate-limit create and redirect). See our qr code redirect and qr code tracking guides for how that mechanic works and what it has to defend against. Static stays the safe, free, private default; dynamic is opt-in and guarded.
Frequently asked questions
Can a QR code give you a virus?
No. A QR code is just printed text the camera reads; it carries no executable program and cannot run anything on its own. The risk is the destination URL, not the code — a code can send you to a malicious page the way a phishing link can.
Is scanning a QR code dangerous?
Scanning is safe. The danger, when there is one, is tapping through to a destination you didn’t expect. Read the URL preview banner, check the domain, and don’t enter passwords or payment details after scanning a code from an untrusted surface.
What is quishing?
Quishing is QR-guided phishing — a malicious QR code (often a sticker placed over a real one) that sends scanners to a fake login or payment page. The defense is the same as for any phishing link: verify the destination before you enter anything.
Are QRForge’s codes safe?
Static codes generated here encode the destination directly into the image with no redirect and no server, so the destination you choose is exactly where scanners land — nothing can be quietly repointed. The planned dynamic tier uses a redirect and is hardened against open-redirect and SSRF abuse.