What Can QR Codes Actually Contain?
A QR code is simply a machine-readable two-dimensional barcode that encodes any text string. Common encoded content types include URLs (the vast majority of QR codes), plain text, contact cards in vCard format, WiFi network credentials (SSID and password), calendar events, and payment information. The privacy risks are concrete and documented. Malicious QR codes can redirect you to phishing websites that are visually identical to legitimate services — your bank, a delivery company, a government site. QR codes placed in physical spaces can embed tracking parameters that identify exactly when, where, and how often a specific code is scanned. Many dynamic QR services intercept every scan through their redirect servers, collecting detailed analytics about user behavior. On the generation side, virtually every popular online QR generator creates codes server-side and logs the data you encoded — including WiFi passwords, personal contact details, and private URLs that pass through their infrastructure.
Using QR Codes Safely
- 1Before scanning any QR code from an unknown or untrusted source, use a QR scanning app that displays the full decoded URL or data before taking any action. Never use a QR scanner that automatically opens the link without showing you the destination first. Inspect the URL carefully for typos, suspicious domains, or redirect chains.
- 2For generating QR codes with sensitive content, use PrivaQR — which creates QR codes entirely in your browser using local JavaScript with zero network requests. The data you encode (WiFi passwords, contact details, private URLs) never leaves your device at any point during generation.
- 3For important recurring use cases — business cards, WiFi sharing, event check-in — use static QR codes that you generate, verify, and control directly. Avoid third-party dynamic QR services that route all scans through their servers, as these codes can be modified, deactivated, or used to inject tracking parameters at any time without your knowledge.
QR Code Security Tips
Be especially skeptical of QR codes in public spaces that appear to have been stickered over an existing code, or placed on signage that looks recently modified — physically replacing legitimate QR codes with malicious ones is a documented social engineering attack used against restaurant menus, parking meters, and public transit displays. For WiFi QR codes (which encode your network password in plain text within the QR pattern), only share them with people you trust, and consider rotating your WiFi password afterward if the code was distributed widely. When encoding contact information in a QR code, consider including only non-sensitive fields — name and website, for example — rather than your full home address and personal phone number. Periodically verify that QR codes you have printed, distributed, or embedded in materials still point to the correct, intended destinations — especially for long-running use cases.