Are QR Codes Safe? A Practical Inspection Checklist
Treat a QR as unverified data, inspect destinations and avoid confusing successful decoding with trust.
The symbol can carry any link
A QR reader’s ability to decode a pattern says nothing about who created it. A code can point to a legitimate page, a broken URL or a deceptive destination. Recognizable branding around the image is not proof of ownership.
Look at context and domain
Check whether a physical code appears to have been covered by a new sticker. Read the actual hostname, not just words elsewhere in the URL. An HTTPS connection protects transport but does not by itself prove that the destination is honest.
Pause before credentials or payment
If a destination asks for information or money unexpectedly, verify it through a known independent channel. Avoid entering account credentials from an unverified QR link. The scanner here presents the payload as text and leaves opening a web link to your explicit choice.
Share a safe report
When reporting a suspicious code, avoid spreading sensitive tokens or private contact details. Describe where it appeared and what action it requested. You can use the image decoder without automatically visiting the destination.
Try the related tool
Open QR Code Image Decoder and use a harmless example for your first test.