Why QR Codes Need Care
A QR code is just a machine-readable string — usually a URL, but also WiFi passwords, vCard contacts, or payment data. That makes it easy to abuse: a sticker placed over a real code can send you to a phishing clone of your bank, and most online generators log whatever you encode (WiFi passwords included) on their servers. This guide covers scanning and generating safely. (For the full breakdown of what QR codes hold and how generators track scans, see the Learn article on QR code privacy.)
Use QR Codes Safely in 4 Steps
- 1Before scanning any QR code from an unknown or untrusted source, use a QR scanning app that displays the full decoded URL or data before taking any action. Never use a QR scanner that automatically opens the link without showing you the destination first. Inspect the URL carefully for typos, suspicious domains, or redirect chains.
- 2For generating QR codes with sensitive content, use PrivaQR — which creates QR codes entirely in your browser using local JavaScript with zero network requests. The data you encode (WiFi passwords, contact details, private URLs) never leaves your device at any point during generation.
- 3For important recurring use cases — business cards, WiFi sharing, event check-in — use static QR codes that you generate, verify, and control directly. Avoid third-party dynamic QR services that route all scans through their servers, as these codes can be modified, deactivated, or used to inject tracking parameters at any time without your knowledge.
- 4After generating, test the code with two different scanner apps before you print or distribute it — and re-check long-running codes (on signage, business cards, menus) periodically to confirm they still point where you intend and haven't been tampered with.
QR Code Security Tips
Be especially skeptical of QR codes in public spaces that appear to have been stickered over an existing code, or placed on signage that looks recently modified — physically replacing legitimate QR codes with malicious ones is a documented social engineering attack used against restaurant menus, parking meters, and public transit displays. For WiFi QR codes (which encode your network password in plain text within the QR pattern), only share them with people you trust, and consider rotating your WiFi password afterward if the code was distributed widely. When encoding contact information in a QR code, consider including only non-sensitive fields — name and website, for example — rather than your full home address and personal phone number. Periodically verify that QR codes you have printed, distributed, or embedded in materials still point to the correct, intended destinations — especially for long-running use cases.