What a QR code can and cannot do to your phone

A QR code is inert text, at most 2,953 bytes. It cannot install software, read your data or execute anything. It can only propose an action — open a URL, join a WiFi network, draft a message — which your phone shows you and you must confirm. The risk is what happens after you accept.

What a QR code actually is

A container for text. Nothing else. The largest possible code — version 40 — holds 2,953 bytes, roughly half the size of this article, and the payload has no way to execute: your camera decodes the pattern into a string, your phone looks at how the string starts (https:, WIFI:, tel:, MAILTO:), and offers you the matching action. The code has no code in it. It is a note passed to your phone, and your phone reads notes very suspiciously.

What it cannot do — ever

Install an app or run software. There is no execution step anywhere in scanning.
Read anything off your phone. Decoding is one-way; the code learns nothing about you, and neither does its creator at the moment of scanning.
Change settings, dial, pay or message silently. Every action a payload proposes lands on a confirmation screen first.
Take money. A payment code initiates a payment from the scanner, behind your payment app's confirmation and PIN. "Scan to receive money" is always a scam.
Do anything at all if you do not tap. Between scan and action sits a preview banner, and you can simply put the phone down.

What it can do — with your confirmation

Each payload type maps to one proposed action and one confirmation:

Payload starts with	Your phone offers	What you must do first
`https://`	Open the page in a browser	Tap the preview banner
`WIFI:`	Join a WiFi network	Confirm the join prompt
`tel:`	Call a number	See the number, press call
`SMSTO:` / `mailto:`	A pre-filled draft message	Review it, press send
`BEGIN:VCARD`	Save a contact	Review the card, tap save
`upi://` and other payment schemes	A payment in your payment app	Confirm payee and amount, enter PIN
App deep link	Open an installed app at a location	Tap through

"Propose" is the load-bearing word. A WiFi code cannot silently join you to a network; a tel: code cannot place a call — each shows you exactly what it wants and waits.

Where the real risk chain starts

Since the decode is inert, actual harm needs one of two continuations:

Social engineering — common. The code opens a page that persuades you to act: a fake login harvesting credentials, a card form on a cloned parking page, a payment whose payee is not who the sign claims. This is overwhelmingly the real-world attack, and it runs on your taps, not on any capability of the code. The data-theft page breaks down each variant.

Browser exploitation — rare. In principle a URL can carry an exploit for an unpatched browser bug, making the "just opened a page" step itself dangerous. Such exploits are expensive, quickly patched, and essentially never spent on random public stickers — can a QR code install malware covers this chain honestly. Keeping your phone updated is the whole defence, and it is a strong one.

The practical conclusion: put your caution on the page, not the pattern. Read the preview banner, and when you want to see a payload with zero risk, decode it without opening it — our scanner displays the raw text entirely in your browser.

FAQ

Can a QR code hack my phone just by scanning it?

No. Scanning decodes a pattern into at most 2,953 bytes of text and shows you a preview. Nothing executes, nothing installs, and nothing is read from your device. Harm requires further steps that each ask for your confirmation.

Can a QR code connect me to WiFi without asking?

No. A WiFi payload fills in the network name and password, but your phone shows a join prompt you must accept. The genuine caution is about hostile networks you knowingly join, not silent connections.

Can a QR code send a text or call someone from my phone?

It can open your dialler or message composer pre-filled — nothing more. The call is not placed and the message is not sent until you press the button, with the number and content visible.

What is actually dangerous about QR codes then?

The destination. A code can lead to a convincing fake page that talks you into typing credentials or card details, or to a payment whose payee is substituted. The defence is reading the domain and never entering sensitive data on a scanned page.