Are QR codes safe?

Yes — the code itself cannot harm your phone. A QR code is simply a way to carry information, most often a web link. Scanning one does not install anything or run code on its own; your phone just reads the data and offers you an action, like opening a page. The real question is never “is this code dangerous” but “where does this code send me?” — the same caution you would apply to any link someone hands you.

Quishing is phishing that uses a QR code instead of a clickable link. An attacker prints or emails a code that leads to a fake login page or a malicious download, hoping you will scan it without checking. It works because a QR code hides its destination — you cannot read a pattern with your eyes the way you can skim a URL. Common tricks include sticking a fake code over a real one on a parking meter or poster, or slipping a code into an official-looking email.

Two things make a legitimate code more trustworthy. First, the destination should use HTTPS — the padlock in the browser — so the connection is encrypted and the address is harder to spoof. Second, sensitive content can sit behind password protection, so even someone how codes are used the code cannot see what is behind it without the passphrase. That is useful for internal documents, private events, or anything not meant for the public.

Before scanning a code in public, take a second look. A genuine code is usually printed as part of the material around it; a fraudulent one is often a sticker with slightly different paper, a raised edge, or a mismatched finish. If a code is peeling, layered over another, or placed somewhere odd, treat it with suspicion — and when in doubt, type the address in by hand instead.

Rules of thumb are a starting point. Phones, printers, finishes, curves, lighting and viewing distance change the result. Test the final artwork on the final material and keep a record of the approved version.