Yes, scanning a QR code is safe in almost every situation, because your phone decodes the data and shows you a preview before it opens anything. The real risk is not the scan itself, it is tapping through on a preview URL you did not check, especially on a sticker placed in a public spot.
QR codes are just a storage format for text, defined by the ISO/IEC 18004 standard. A code can hold a plain URL, a block of contact info, WiFi network details, or plain text. Nothing about the code itself can install anything or run code on your phone. What happens next depends entirely on what app you use to scan it and what you do after the preview shows up.
What actually happens when you scan
Your phone's camera reads the pattern of black and white squares, converts it back into the original text string, and figures out what type of data it is. For a URL, the built in camera app on iOS and Android shows a banner with the domain name before it opens Safari or Chrome. You have to tap that banner for anything to happen. For a WiFi network or a contact card, the phone shows a prompt asking if you want to join the network or save the contact. Nothing loads or downloads automatically just from pointing your camera at the code.
This preview step is the main safety net, and it works the same way across recent versions of both major mobile platforms. It exists specifically so a scan cannot silently take you somewhere or run something without your input. Some third party scanning apps skip this preview and open links right away, which removes the one safeguard that makes scanning low risk to begin with, so the built in camera app is generally the safer default. The catch with any scanner, built in or not, is that most people do not read the preview closely, they just tap it the way they tap any notification.
The real risk: a swapped or malicious code
The actual danger is a code that encodes a phishing link or a page that pushes a malware download, disguised to look like it belongs where you found it. This is most common in public places: parking meters, restaurant table tents, flyers, event posters, and delivery lockers. A scammer prints a sticker with their own QR code and places it directly over the legitimate one. Since the sticker looks identical to a normal printed code, there is no visual way to tell it apart just by looking at the pattern itself.
The link itself usually leads to one of a few outcomes: a fake payment or login page built to steal credentials or card details, a page that prompts you to install an app or profile, or a redirect chain that lands on ads or a scareware page. None of this happens from the scan. It happens only if you follow through on the link and then enter information or approve an install. This is the same trust decision you make with any link, a QR code just removes the step of typing or seeing the full address before you commit to opening it.
Checks to run before you tap through
A few seconds of checking before you tap the preview covers most of the risk. Use the table below as a quick reference for what to look at and why it matters.
| Check | What to look for | What it tells you |
|---|---|---|
| Preview domain | Does the URL match the business or context you expect, spelled correctly | Mismatched or misspelled domains are the biggest red flag |
| Physical condition of the code | Is it a separate sticker sitting on top of a menu, poster, or sign rather than printed as part of the original | A raised sticker edge or a different paper stock usually means it was added later |
| Where you found it | Public, unattended locations such as parking areas or lampposts carry more risk than a code handed to you directly or printed on your own receipt | Unattended public codes are the easiest to tamper with |
| What it is asking for | A payment page, login form, or app install prompt right after scanning | Legitimate menus and info pages rarely ask for credentials immediately |
| Source of the code | Did you generate it yourself or receive it from a source you trust | Any code you did not create yourself is worth a second look before opening |
If the preview URL passes these checks, opening it is no riskier than clicking a normal link from that same source. If something feels off, close the camera and look up the business or event directly instead of following the code.
Checking a code before you open it
If you want to see exactly what a code contains without letting your phone act on it, run it through a dedicated safe QR code scanner. It decodes the data and shows you the raw content, including the full destination URL, so you can read it before deciding whether to visit it. This is worth doing for any code you did not generate yourself, especially ones found in public or sent by someone you were not expecting to hear from.
For everyday scanning where you just need a quick read on a code, a general QR code scanner works fine and gives you the same preview step your camera app does. If a code will not scan at all rather than raising a safety concern, that is usually a print quality or contrast issue rather than anything malicious, and our guide on QR code not scanning fixes covers the common causes, from a scratched sticker to a code printed too small.
If you already tapped through
If you opened a link and it looked wrong, close the page without entering anything and you have not lost anything. If you already entered a password or card number on a page that turned out to be fake, change that password right away and contact your card issuer to watch for or dispute unusual charges. If the page prompted you to install an app or a configuration profile and you approved it, remove that install from your phone's settings as soon as you notice it. Acting quickly matters more than anything else at that point.
Codes you generate yourself
None of this applies to codes you create for your own use, like a WiFi code for guests or a link to your own page. The safety question only comes up with codes made by someone else. If you are curious how the tools on this site handle generation and testing so the codes you make are reliable and scan cleanly, see how we build and test for details on the process.
The short version holds up under scrutiny: scanning is safe, the preview step protects you, and the only real exposure is tapping through on a link you have not looked at. Check the domain, check for a sticker, and you have covered nearly every case that goes wrong. Browse more tools and guides in the QR tools category.