QR code security risks and how to check one

A QR code is a link you cannot read. That is the entire attack surface.

QR codes Published October 20, 2026 2 min read

The four real risks

Risk	How it works	What to check
Phishing (quishing)	Code points to a lookalike login page	Read the domain character by character
Overlay stickers	A fake sticker placed over a real code	Look for a raised edge or a mismatched print
Payment redirection	Code swapped at a payment point	Compare against the merchant's own display
Malware delivery	Code leads to an APK or profile download	Never install from a QR code

Punycode and lookalike domains

Some characters from non-Latin alphabets look identical to Latin letters. A domain registered with those characters renders as the familiar word but resolves elsewhere. Browsers display such domains in their Punycode form — the one starting with `xn--` — precisely so they stand out.

If a URL's host begins with `xn--`, treat it as suspicious until proven otherwise. There is no legitimate common reason for a consumer-facing link to look like that.

Habits that actually help

Look at the domain, not the page design. A perfect copy of a login page is cheap.
Never enter a password on a page you reached by scanning a code in a public place.
Prefer payment apps you opened yourself over a code that promises a discount.
For restaurant menus, a code that asks for card details is not a menu.

Frequently asked questions

Can scanning a QR code install malware by itself?

No. A QR code only carries text. The risk is what the text does when you act on it — opening a malicious page or installing a downloaded file requires your confirmation.

What is a punycode domain?

A domain written with non-ASCII characters, displayed by browsers as `xn--` plus an encoded string. It can be used to imitate a familiar brand name.

Is it safe to scan a QR code on a poster?

Scanning is safe. Before entering anything, confirm the domain matches the organisation you expect, and be suspicious of any code that asks for payment or credentials.

Tools that go with this guide

QR Code Scanner Scan with your camera, or drop in a screenshot. Images never leave your device. QR Code Decoder When you need to see exactly what the code contains, not just a tidy summary. Scan QR Code From Image Point it at a file instead of a camera: PNG, JPG, WebP, GIF. WiFi QR Code Scanner Reads WIFI: codes properly and shows the password as its own field.

More guides

Passwords How long does it take to crack a password? The answer depends almost entirely on two things: how the password is stored, and how long it is. Passwords What actually makes a password strong Four properties matter. Most of the advice people repeat is about the least important one. Passwords Password generator vs password manager: which do you need? They solve different halves of the same problem, and using one without the other barely helps. QR codes Why won't my QR code scan? Almost every failed scan comes down to one of eight causes. Here is how to tell which.