Security & privacy
Should you scan QR codes in public?
Yes, with judgement. Scanning itself is safe — it only decodes text — so the risk lives in the destination and what you type there. A menu is low risk, a payment code deserves a payee check, and anything promising free money or urgent action is worth walking away from.
Separate the scan from what follows
The question hides two different questions, and they have different answers.
Is the scan itself dangerous? No. Scanning decodes a pattern into text — at most 2,953 bytes of it — and shows you the result. Your phone cannot be compromised by the decode: nothing installs, nothing executes, nothing is read from your device. Both iOS and Android then wait for you to act on a preview banner.
Is what follows dangerous? It can be. The code proposes a destination; the risk is what that destination asks of you — credentials, card details, a payment approval, a network join. All real QR harm happens on the far side of a tap, which means all of it is avoidable at the moment the banner appears.
So the honest answer is yes, scan — and spend your caution where it pays: on the destination and on anything you are asked to type or approve.
A practical risk ranking
| Context | Risk | The proportionate response |
|---|---|---|
| Menu on a restaurant table (browse only) | Low | Scan freely; glance at the banner |
| Museum label, plant tag, poster for an event | Low | Scan freely |
| Marketing poster or flyer wanting a signup | Medium | Fine to visit; think before handing over an email address |
| WiFi join code in a venue | Medium | Fine from the venue's own signage; know that the network sees your traffic metadata |
| Order-and-pay at a table | Medium–high | Check the domain before entering a card — table-tent swaps target exactly this |
| Payment code on a meter, charger or standee | High | Feel for a sticker edge, check the payee name your app shows — see parking scams |
| Sticker on street furniture, flyer under a wiper, "scan to win / receive money" | Walk away | No legitimate deployment looks like this |
The gradient is not about the code — it is about what the destination will ask of you. A browse-only page can waste your time; only a page you type into can rob you.
The habits that make public scanning safe
- Read the preview banner before opening — the domain immediately before the first single slash. The full routine takes under ten seconds and covers look-alike domains and shorteners.
- Feel printed payment codes for the raised edge of an overlay sticker.
- Never enter credentials or card details on a page you reached by scanning. Navigate there yourself instead — this single rule removes almost the entire risk.
- Match the payee name in your payment app against the printed business name before confirming any payment.
- Decode without opening when something feels off: our scanner shows a code's raw text in your browser without following it.
The codes not worth scanning at all
Curiosity is the payload of last resort for an attacker who cannot fake trust. An anonymous sticker, an unexplained code with no stated owner, or anything promising money for scanning offers you no upside — the best case is an advert, the worst case is a phishing page. "Scan to receive money" in particular is always a lie: payment codes initiate payments from the scanner, never to them.
FAQ
Is it safe to scan random QR codes?
Scanning is harmless — the code is inert text and the decode cannot touch your phone. But a random, unowned code offers no benefit against a nonzero phishing risk, so anonymous stickers and "scan to win" codes are simply not worth it.
Can scanning a QR code in public hack my phone?
No. The scan decodes text and shows you a preview; nothing installs or executes. Compromise requires further steps — opening a page and entering data, approving a payment, or installing something — each of which needs your confirmation.
Which public QR codes are riskiest?
Anything that takes money: parking meters, EV chargers, payment standees and order-and-pay tables. These are the documented targets for sticker substitution, and they are where a mistake costs card details rather than a wasted click.
What should I check before opening a scanned link?
The domain on the preview banner — the part immediately before the first single slash. Distrust shorteners, look-alike spellings and urgency wording, and never enter credentials or payment details on a page you reached by scanning.
Try it — free, no signup
Related
- Are QR codes safe? — Scanning a QR code is safe in itself — it decodes text and nothing else. The risk is entirely in what you do next. A code cannot install software, dial,…
- What a QR code can and cannot do to your phone — A QR code is inert text — it cannot install, execute or read anything. What each payload type actually triggers, and where the real risk chain begins.
- How to check where a QR code goes before opening it — Use the preview banner both iOS and Android show before opening, and read the domain immediately before the first single slash. To inspect without any…
- Parking QR code scams — how they work and how to avoid them — Fake QR stickers on parking meters lead to card-harvesting payment pages. What the FTC and FBI have warned about, and the rules for drivers and operators.