# What a QR code can and cannot do to your phone

> A QR code is inert text, at most 2,953 bytes. It cannot install software, read your data or execute anything. It can only propose an action — open a URL, join a WiFi network, draft a message — which your phone shows you and you must confirm. The risk is what happens after you accept.

Source: https://useqr.app/docs/security/what-a-qr-code-can-and-cannot-do-to-your-phone · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## What a QR code actually is

A container for text. Nothing else. The largest possible code — version 40 — holds
**2,953 bytes**, roughly half the size of this article, and the
[payload](/glossary/payload) has no way to execute: your camera decodes the pattern into a
string, your phone looks at how the string starts (`https:`, `WIFI:`, `tel:`, `MAILTO:`),
and offers you the matching action. The code has no code in it. It is a note passed to
your phone, and your phone reads notes very suspiciously.

## What it cannot do — ever

- **Install an app or run software.** There is no execution step anywhere in scanning.
- **Read anything off your phone.** Decoding is one-way; the code learns nothing about
  you, and neither does its creator at the moment of scanning.
- **Change settings, dial, pay or message silently.** Every action a payload proposes
  lands on a confirmation screen first.
- **Take money.** A payment code initiates a payment *from* the scanner, behind your
  payment app's confirmation and PIN. "Scan to receive money" is always a scam.
- **Do anything at all if you do not tap.** Between scan and action sits a preview
  banner, and you can simply put the phone down.

## What it can do — with your confirmation

Each payload type maps to one proposed action and one confirmation:

| Payload starts with | Your phone offers | What you must do first |
|---|---|---|
| `https://` | Open the page in a browser | Tap the preview banner |
| `WIFI:` | Join a WiFi network | Confirm the join prompt |
| `tel:` | Call a number | See the number, press call |
| `SMSTO:` / `mailto:` | A pre-filled draft message | Review it, press send |
| `BEGIN:VCARD` | Save a contact | Review the card, tap save |
| `upi://` and other payment schemes | A payment in your payment app | Confirm payee and amount, enter PIN |
| App deep link | Open an installed app at a location | Tap through |

"Propose" is the load-bearing word. A [WiFi code](/wifi-qr-code) cannot silently join you
to a network; a `tel:` code cannot place a call — each shows you exactly what it wants
and waits.

## Where the real risk chain starts

Since the decode is inert, actual harm needs one of two continuations:

**Social engineering — common.** The code opens a page that persuades *you* to act:
a fake login harvesting credentials, a card form on a
[cloned parking page](/docs/security/parking-qr-code-scams), a payment whose payee is not
who the sign claims. This is overwhelmingly the real-world attack, and it runs on your
taps, not on any capability of the code. The
[data-theft page](/docs/security/can-a-qr-code-steal-your-data) breaks down each variant.

**Browser exploitation — rare.** In principle a URL can carry an exploit for an unpatched
browser bug, making the "just opened a page" step itself dangerous. Such exploits are
expensive, quickly patched, and essentially never spent on random public stickers —
[can a QR code install malware](/docs/security/can-a-qr-code-install-malware) covers this
chain honestly. Keeping your phone updated is the whole defence, and it is a strong one.

The practical conclusion: put your caution on the page, not the pattern. Read the
[preview banner](/docs/security/how-to-check-a-qr-code-before-opening), and when you want
to see a payload with zero risk, decode it without opening it — our [scanner](/scan)
displays the raw text entirely in your browser.

## FAQ

### Can a QR code hack my phone just by scanning it?
No. Scanning decodes a pattern into at most 2,953 bytes of text and shows you a preview. Nothing executes, nothing installs, and nothing is read from your device. Harm requires further steps that each ask for your confirmation.

### Can a QR code connect me to WiFi without asking?
No. A WiFi payload fills in the network name and password, but your phone shows a join prompt you must accept. The genuine caution is about hostile networks you knowingly join, not silent connections.

### Can a QR code send a text or call someone from my phone?
It can open your dialler or message composer pre-filled — nothing more. The call is not placed and the message is not sent until you press the button, with the number and content visible.

### What is actually dangerous about QR codes then?
The destination. A code can lead to a convincing fake page that talks you into typing credentials or card details, or to a payment whose payee is substituted. The defence is reading the domain and never entering sensitive data on a scanned page.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate
- https://useqr.app/wifi