Can a QR code steal your data?

No — scanning reads nothing from your phone. Data theft happens at the destination, through a phishing form you fill in, an OAuth consent screen you approve, or a hostile WiFi network you join. The code is the lure, not the theft. Check the domain and never enter credentials on a scanned page.

The code reads nothing

Decoding is strictly one-way. Your camera turns a pattern into at most 2,953 bytes of text; the pattern learns nothing back. A QR code has no access to your photos, contacts, messages, location or anything else — it cannot execute or read at all. At the moment of scanning, whoever made the code does not even know it was scanned.

So the direct answer is no. But QR codes are used to steal data every day — as the delivery mechanism for pages that do the stealing. Naming those mechanisms precisely is what makes them avoidable, because every one of them needs something from you.

Mechanism 1 — the phishing form

The overwhelming majority of QR-linked data theft is a fake page and your own thumbs: a pixel-faithful bank or Microsoft 365 login, a card form on a cloned parking page, a "verify your details" survey. Nothing is taken; everything is typed. Modern kits run as reverse proxies that pass your real password through to the real site and keep the session token, which captures accounts even when a one-time code is used — you type the OTP into the proxy too. One habit defeats the entire category: never enter credentials or payment details on a page you reached by scanning. Navigate there yourself.

Subtler, because no password is typed. The scanned link opens a genuine "Sign in with Google/Microsoft" consent screen — real domain, real padlock — requesting scopes for a malicious app: read your mail, access your files, sign in as you. Approve it, and the attacker holds a token that survives password changes and sidesteps MFA. The tell is the scope list: a menu or prize page has no business reading your email. Read what the consent screen actually says before tapping Accept, and review your account's authorised apps if you approved something in haste.

Mechanism 3 — links that carry authority

Some URLs are themselves credentials: password-reset links, magic sign-in links, session identifiers. A phishing flow can ask you to "confirm your identity" by requesting a reset on the real site and having you relay what arrives. Treat any page that asks you to paste or forward a link or code sent to you as an active theft in progress.

Mechanism 4 — the WiFi nuance

A WiFi code can invite you onto a network the attacker controls. Your phone still asks before joining, but once on a hostile network the operator can observe your traffic metadata — which sites you contact, when, and roughly how much — and can attempt to redirect you to fake pages. Honesty requires the other half: HTTPS, now the default nearly everywhere, means the content of what you send is encrypted and a hostile network cannot simply read your passwords. The realistic risks are metadata exposure and phishing pages served on the network's captive portal. Join networks from the venue's own signage, and doubt any "log in with your email password" portal.

A separate, quieter path is the code's creation: server-side generators receive whatever you encode — WiFi passwords included — which is why client-side generation matters, and why scan logging deserves its own page.

The habits that make you safe

Read the domain on the preview banner — the ten-second check.
Never type credentials or card details on a scanned page.
Read OAuth consent scopes before approving; revoke unfamiliar apps.
Decode suspicious codes without opening them — our scanner shows the raw text entirely in your browser.

FAQ

Can a QR code steal my personal information just by scanning it?

No. Decoding is one-way — the code cannot read contacts, photos, messages or anything else, and its creator does not even learn the scan happened. Theft requires a destination page and your participation there.

Can a QR code steal my passwords?

Only by persuading you to type them into a fake login page, or to approve an OAuth consent screen granting a malicious app access. Never enter credentials on a page you reached by scanning, and read consent scopes before accepting.

Can a QR code steal my banking details?

Not directly. The documented pattern is a fake payment page — parking, delivery fees, table ordering — where victims type card numbers themselves. Check the domain first, and treat any card form reached by scanning as unverified.

Is joining WiFi from a QR code dangerous?

Your phone asks before joining, and HTTPS protects the content of your traffic even on a hostile network. The residual risks are traffic metadata and fake portal pages, so join from the venue's own signage and never enter account passwords into a WiFi portal.