Can a QR code install malware?

Not by itself. A QR code carries text, not code, and nothing executes when you scan it. Malware needs a further chain — sideloading an app, installing a configuration profile, or a browser exploit against an unpatched phone — and each requires your explicit confirmation or an out-of-date device. Keep your phone updated.

The direct answer

No. A QR code holds at most 2,953 bytes of text and contains nothing executable — scanning decodes a pattern and shows you the result, full stop. There is no mechanism by which the decode itself installs anything, on any phone, patched or not. The broader inventory of what a code can and cannot trigger is in what a QR code can and cannot do to your phone.

But "can a QR code lead to malware" is a fair question, and the honest answer is yes — through exactly three chains, each of which the code merely starts. Knowing what each chain requires from you is the practical defence.

Chain 1 — Android sideload

The code opens a page pushing an APK ("update your Chrome", "install our secure viewer", a fake banking or delivery app). To reach an infection, all of the following must happen:

You tap through the browser's download warning for an executable file.
You grant that specific browser the "install unknown apps" permission — Android blocks sideloading per-source by default and interrupts with a settings screen.
You confirm the installation itself, past Google Play Protect's scan and any warning it raises.

That is three deliberate decisions, each behind a warning. The chain is real — fake-app campaigns delivered by QR-linked pages exist — but it never happens to you; it happens with you. Rule of thumb: no app that arrives via a scanned code deserves installation. Real apps live in the store you can search yourself.

Chain 2 — iOS configuration profile

iPhones do not sideload apps in the Android sense, so the equivalent lure is a configuration profile — a settings bundle that can add VPNs, certificates or device management, pitched as "required to view this content" or fake IT enrolment. The chain:

You allow the website to download a profile (Safari asks).
You go to Settings → Profile Downloaded, tap Install.
You enter your device passcode and confirm again past a written warning.

A profile cannot install itself, and nothing legitimate that a public QR code links to needs one. If a scanned page ever mentions installing a profile, close it.

Chain 3 — browser exploit

The only chain with no confirmation step: a URL that attacks an unpatched vulnerability in the browser itself, so that merely rendering the page executes code. This is the scenario people imagine when they fear QR codes — and it is the rarest by far. Working no-interaction browser exploits are scarce, expensive, and burned the moment they are used at scale, so they are spent on targeted operations, not on stickers in car parks. Vendors patch them fast, which makes update discipline the entire defence: a phone that installs its updates promptly is simply not the target this chain works against.

What this means in practice

Scan freely; the decode is safe. Spend caution on the destination — read the preview banner first.
Never install anything a scanned page offers — no APK, no profile, no "codec".
Keep your phone's OS and browser updated. This closes the only no-click chain.
Inspect suspicious codes without opening them: our scanner decodes from a camera or screenshot entirely in your browser and shows the raw text.
Remember that the common QR attack is not malware at all — it is phishing for what you type, which needs no software on your phone.

FAQ

Can scanning a QR code give my phone a virus?

No. Scanning decodes text and executes nothing. Infection requires you to then install something — an APK on Android or a configuration profile on iOS — past multiple explicit warnings, or requires an unpatched browser vulnerability, which is rare and quickly fixed.

Can a QR code install an app on iPhone?

No. iOS has no path from a webpage to an installed app without the App Store. The nearest attack is a configuration profile, which requires a download consent, a manual trip to Settings, your passcode and a final confirmation.

What happens if I scanned a QR code that had malware?

The scan itself did nothing. If you only viewed the page and your phone is up to date, you are almost certainly fine. If you installed an app or profile from that page, delete it, run Play Protect on Android or remove the profile in iOS Settings, and change important passwords.

How do I check a QR code for malware before opening it?

Decode it without opening it — a client-side scanner shows the raw URL from a camera or screenshot without following it. Then read the domain, and treat any page that wants you to install something as hostile.