Security

Are QR Codes Safe?

A QR code is just a web address you cannot read. That makes it handy for menus and flyers, and handy for scammers too. Here is how to scan one without getting burned, and how to make your own that will not quietly stop working.

Last updated November 9, 2026 · By Harbor Privacy

What Makes QR Codes Risky

When you tap a link in an email, you can usually see where it goes. A QR code hides that step. Your phone opens the address before you have had a chance to judge it. Scammers use this in two ways: they print fake codes and stick them over real ones, and they send codes in emails or letters so that email filters cannot read the link. The result is the same as a phishing link, just harder to spot.

The code itself cannot hurt your phone. The danger is the page it sends you to, and what you do there.

How to Scan Safely

Preview the link before you open itPoint the phone camera at the code and read the web address that pops up. Do not tap it yet. If the address is a shortened link or a random string, treat it with suspicion.

Check the domain, not the start of the addressThe real site is the part right before the first single slash. pay.example.com/login belongs to example.com. example.com.pay-now.xyz does not.

Look at the physical codeA sticker stuck over another QR code on a parking meter, menu, poster or package is a classic trick. If it looks pasted on top, skip it.

Never enter a password or card on a page you reached by QR codeOpen the company's real app or type its address yourself. A QR code is a fine way to open a menu. It is a bad way to reach a login or payment screen.

Be wary of QR codes that ask you to act fastCodes in unexpected emails, texts or letters about a package, a fine or an account problem are the same scam as a phishing link, with the link hidden.

Use the Built-In Camera

The camera app on iPhone and Android reads QR codes and shows the address first. Standalone “QR scanner” apps are often ad-filled, and some collect more data than they need. You do not need one.

Making Your Own QR Code

If you run a business, a club or a fundraiser, you will want to put a QR code on something printed. There are two kinds, and picking the wrong one is how printed codes end up dead:

Static codes contain the address itself. They work forever and need no account. The catch is that you cannot change where they point once printed.
Dynamic codes point to a short link that you can redirect later. You can fix a typo or move a page without reprinting. The catch is that the redirect lives on the provider’s servers, so if the service shuts the code off, your printed code stops working.

Many dynamic QR services switch your codes off the day a subscription ends or a free trial runs out. Flyers, menus and packaging that are already printed then point at nothing, and sometimes at an upsell page.

A Safer Way: scnly

scnly is a QR code service made by Harbor Privacy, so we are not neutral here, but we built it because of the problems above.

The free generator needs no sign-up. Static codes for links, Wi-Fi, email, phone, SMS and plain text are made right in your browser, and what you type is never sent to us. They never expire and have no scan limit.
Dynamic codes are cheap: $3 a month or $20 a year for 25 codes, with a Pro plan for 250.
Printed codes keep working for 60 days after your paid period ends. You get notices first, and nothing breaks the day a card fails.
No tracking of the people who scan. scnly stores scan counts and whether a scan came from a phone or a desktop. It does not store IP addresses or cookies for scanners.
Destinations are screened against malware and phishing lists, so the service is not used to pass out the kind of codes this guide warns about.

If the code only needs to point at one address for good, use the free generator and make a static code. Pay only if you need to change the destination later.

Before You Print Anything

Scan it with two different phonesCheck that the code opens the right page on both iPhone and Android.

Use a link you own or controlIf the code points at a page on someone else's site, they can change or remove it.

Print it big enough and with contrastDark code on a light background, at least about 2 cm (0.8 in) square, with a quiet blank border around it.

Put the web address next to itPeople who see the plain address can trust it, and can type it if the code is damaged.

Common Questions

Can a QR code hack my phone just by scanning it?

Scanning only reads an address. Harm comes from the page it opens: a fake login, a payment request, or a download you approve. Keep your phone updated and do not enter credentials on pages you reached from a code.

What is quishing?

Quishing is phishing done with QR codes. A code in an email, letter or sticker sends you to a fake login or payment page. Treat it exactly like a suspicious link.

Do QR codes expire?

Static codes never expire because the address is inside the pattern. Dynamic codes depend on the provider's redirect, so they stop working if the provider turns them off.

Are free QR code generators safe?

A generator that runs in your browser and makes static codes is safe, because nothing is sent anywhere. Be careful with free dynamic codes: the provider controls the redirect and can disable it or add ads.

How do I check where a QR code goes?

Use your phone's camera and read the web address it shows before you tap it. Check the part right before the first slash. If it is shortened, do not trust it for anything sensitive.

NEED A QR CODE?

Make a free static code in your browser with no account, or get dynamic codes with a 60-day grace period. Open the scnly generator →