# Should you scan QR codes in public?

> Yes, with judgement. Scanning itself is safe — it only decodes text — so the risk lives in the destination and what you type there. A menu is low risk, a payment code deserves a payee check, and anything promising free money or urgent action is worth walking away from.

Source: https://useqr.app/docs/security/should-you-scan-qr-codes-in-public · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## Separate the scan from what follows

The question hides two different questions, and they have different answers.

**Is the scan itself dangerous?** No. Scanning decodes a pattern into text — at most
2,953 bytes of it — and shows you the result. Your phone
[cannot be compromised by the decode](/docs/security/what-a-qr-code-can-and-cannot-do-to-your-phone):
nothing installs, nothing executes, nothing is read from your device. Both iOS and
Android then wait for you to act on a preview banner.

**Is what follows dangerous?** It can be. The code proposes a destination; the risk is
what that destination asks of you — credentials, card details, a payment approval, a
network join. All real QR harm happens on the far side of a tap, which means all of it is
avoidable at the moment the banner appears.

So the honest answer is yes, scan — and spend your caution where it pays: on the
destination and on anything you are asked to type or approve.

## A practical risk ranking

| Context | Risk | The proportionate response |
|---|---|---|
| Menu on a restaurant table (browse only) | Low | Scan freely; glance at the banner |
| Museum label, plant tag, poster for an event | Low | Scan freely |
| Marketing poster or flyer wanting a signup | Medium | Fine to visit; think before handing over an email address |
| WiFi join code in a venue | Medium | Fine from the venue's own signage; know that the network sees your traffic metadata |
| Order-and-pay at a table | Medium–high | Check the domain before entering a card — [table-tent swaps](/docs/security/fake-menu-qr-scams) target exactly this |
| Payment code on a meter, charger or standee | High | Feel for a sticker edge, check the payee name your app shows — see [parking scams](/docs/security/parking-qr-code-scams) |
| Sticker on street furniture, flyer under a wiper, "scan to win / receive money" | Walk away | No legitimate deployment looks like this |

The gradient is not about the code — it is about what the destination will ask of you.
A browse-only page can waste your time; only a page you type into can rob you.

## The habits that make public scanning safe

- **Read the preview banner** before opening — the domain immediately before the first
  single slash. The [full routine](/docs/security/how-to-check-a-qr-code-before-opening)
  takes under ten seconds and covers look-alike domains and shorteners.
- **Feel printed payment codes** for the raised edge of an
  [overlay sticker](/docs/security/qr-code-stickers-placed-over-real-ones).
- **Never enter credentials or card details** on a page you reached by scanning. Navigate
  there yourself instead — this single rule removes almost the entire risk.
- **Match the payee name** in your payment app against the printed business name before
  confirming any payment.
- **Decode without opening** when something feels off: our [scanner](/scan) shows a
  code's raw text in your browser without following it.

## The codes not worth scanning at all

Curiosity is the payload of last resort for an attacker who cannot fake trust. An
anonymous sticker, an unexplained code with no stated owner, or anything promising money
for scanning offers you no upside — the best case is an advert, the worst case is a
phishing page. "Scan to receive money" in particular is always a lie: payment codes
initiate payments **from** the scanner, never to them.

## FAQ

### Is it safe to scan random QR codes?
Scanning is harmless — the code is inert text and the decode cannot touch your phone. But a random, unowned code offers no benefit against a nonzero phishing risk, so anonymous stickers and "scan to win" codes are simply not worth it.

### Can scanning a QR code in public hack my phone?
No. The scan decodes text and shows you a preview; nothing installs or executes. Compromise requires further steps — opening a page and entering data, approving a payment, or installing something — each of which needs your confirmation.

### Which public QR codes are riskiest?
Anything that takes money: parking meters, EV chargers, payment standees and order-and-pay tables. These are the documented targets for sticker substitution, and they are where a mistake costs card details rather than a wasted click.

### What should I check before opening a scanned link?
The domain on the preview banner — the part immediately before the first single slash. Distrust shorteners, look-alike spellings and urgency wording, and never enter credentials or payment details on a page you reached by scanning.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate