Summary: A clear-eyed look at QR code security risks, phishing via malicious codes, safe scanning habits, and how browser-based generation protects your data.
Q: Can a QR code give my phone a virus?
A: A QR code is data — it cannot directly execute code or install software. The risk comes from the content it encodes. If the code opens a malicious website that exploits a browser vulnerability, that site could theoretically deliver malware. Keeping your phone’s operating system and browser updated reduces this risk significantly.
Q: How do I know if a QR code is safe before scanning?
A: Most modern phone cameras show a URL preview before you tap to open it. Inspect that URL carefully: look for the correct domain name, check for HTTPS, and be suspicious of URL shorteners that hide the final destination. If anything looks wrong, do not tap.
Q: Is QRVelto safe to use?
A: Yes. QRVelto generates QR codes entirely in your browser using the open-source qrcode library. Nothing you enter — URLs, Wi-Fi passwords, contact details — is transmitted to a server or stored anywhere. The code is produced locally and downloaded directly to your device.
Q: Can someone track me through a QR code I scan?
A: If the QR code links to a standard URL, the website owner can log your visit just as they would any other web session — including your approximate location derived from IP address. A URL-only QR code does not grant the code creator any special tracking access beyond normal web analytics.
Q: Are QR codes GDPR-compliant?
A: The QR code itself is just a format. GDPR compliance depends on what happens after the scan. If the destination page collects personal data (email, location, etc.), standard GDPR obligations apply to that data collection. Generating a static QR code that links to a URL does not, by itself, involve any personal data processing.
QR codes are as safe or as dangerous as the content they encode. The pattern itself is just a carrier — the equivalent of a hyperlink. But because you cannot read a QR code the way you can read printed text, the security calculus is different from ordinary links. This guide explains the real risks, the threat models worth taking seriously, and the habits that protect both the people who scan codes and the businesses that create them.
How security risks arise from QR codes
A QR code can encode any string of characters: a URL, a phone number, a Wi-Fi password, a payment instruction, or raw text. The scanning device interprets that string and offers to act on it — open the URL, dial the number, connect to the network. The security risk is entirely determined by what the code encodes, not by the code format itself.
The two categories of risk worth understanding are:
- Content-based risk: The code links to a malicious website, a phishing page, or a command that performs an unintended action (launching a payment, sending an email, connecting to a rogue Wi-Fi network).
- Tampered code risk: A legitimate QR code has been physically covered with a sticker containing a different code, or a digital code image has been replaced with a lookalike that points to a different destination.
Both risks are real, both are preventable, and neither requires any technical understanding of QR encoding to defend against.
QR code phishing (quishing)
Quishing is phishing that uses a QR code instead of a hyperlink to deliver the malicious URL. It appeared in volume around 2022–2023, primarily in email-based attacks, because QR codes in email body images bypass most URL-scanning security filters that would flag a plain hyperlink.
A quishing email typically presents an urgent scenario — “your account requires verification”, “a new document is ready to sign”, “your package could not be delivered” — and asks you to scan a QR code to resolve it. The code opens a convincing fake login page for Microsoft, Google, a bank, or another trusted service. Credentials entered on that page are sent directly to the attacker.
The same technique appears in physical environments: stickers placed over legitimate codes in parking metres, restaurant menus, and public signage. The attacker replaces a code that opens a benign page with one that opens a payment page or phishing site.
How to scan QR codes safely
Developing a few consistent habits before tapping makes QR code scanning substantially safer:
Preview the URL before opening it
Modern iPhone and Android cameras display a banner showing the URL or action the code encodes before you open it. Read that preview. Check that the domain name is what you expect — yourbank.com not yourbank-secure.net. Be especially cautious of URL shorteners (bit.ly, tinyurl, and similar services) that hide the actual destination.
Check the physical code
In public spaces, look at the label area around the code. If the code appears to be a sticker placed over a printed surface, treat that as a red flag. Legitimate QR codes in restaurants, parking metres, and government signage are printed directly onto the material or protected behind laminate — not applied as a separate label.
Avoid scanning codes from unknown senders
QR codes in unsolicited emails, text messages, and social media posts should be treated with the same scepticism as unsolicited links. The urgency framing that makes phishing emails effective works equally well with quishing emails.
Keep your phone updated
The worst-case scenario — a malicious website exploiting a browser vulnerability to deliver code — depends on a known, unpatched security flaw. Keeping your operating system and browser on their latest versions closes the vast majority of known exploit paths.
How to generate QR codes safely
If you are creating QR codes for others to scan, the security responsibilities shift to your side of the transaction. The key considerations are:
Use a generator that does not store your data
Some QR code generators — particularly paid services offering dynamic codes — require a user account, log the content you encode, and store it on their servers. If you are encoding sensitive content (a Wi-Fi password, private contact details, a document URL), using a service that logs that content creates a risk if that service is breached or ceases to operate.
A browser-based static code generator that processes everything locally — like QRVelto — never sends your input to a server in the first place, so there is nothing to log, breach, or expose. This is the safest architecture for encoding any non-public content.
Link to HTTPS destinations
Always link your QR codes to HTTPS URLs. An HTTP destination exposes the entire session to network eavesdropping, which is particularly relevant on public Wi-Fi. Most modern browsers also warn users when they land on HTTP pages, which can reduce trust in your code.
Protect physical codes from tampering
If your codes are in public-facing environments, protect them physically. Laminate printed codes or print them directly onto materials rather than applying them as removable stickers. Inspect high-value placements (payment codes, sign-in codes) periodically for evidence of tampering.
CTA: Generate a QR Code Privately in Your Browser
How QRVelto handles your data
QRVelto generates QR codes entirely client-side using the open-source qrcode JavaScript library running in your browser. When you type a URL, Wi-Fi password, contact details, or any other input into a QRVelto generator, that data is processed locally on your device to produce the PNG image. It is never transmitted to a QRVelto server, logged in a database, or shared with any third party.
The finished QR code image is downloaded directly from your browser’s local memory to your device. No account is required, no session is associated with your inputs, and no record of what you generated is retained after you close the browser tab.
QRVelto uses Google Analytics to measure aggregate site traffic and Google AdSense to show contextual advertisements. These services set cookies and may collect anonymised usage data according to their respective privacy policies. All analytics are subject to user cookie consent via the banner shown on first visit.
Security considerations for businesses
Businesses deploying QR codes at scale should add a few operational practices to their standard process:
- Verify codes before publish: Scan every code before printing, launching, or distributing to confirm it links to the correct destination. This catches URL typos and accidental wrong-file attachments.
- Monitor destination URLs: Set up Google Search Console or an uptime monitor on the pages your QR codes link to. A dead page is not a security issue, but it is a bad customer experience — and it is surprisingly common.
- Use HTTPS everywhere: Every page that a QR code links to should be HTTPS. If your website does not have SSL, fix that before distributing any codes.
- Educate staff about tampering: In physical retail and hospitality environments, brief staff on what legitimate codes look like and how to report suspicious stickers or replacements.
- Do not encode customer PII in QR codes: If you are generating codes for individual customers — booking confirmations, loyalty cards, personalised offers — encode an opaque token or reference number, not the customer’s name, email, or order details in plain text.
Leave a Reply