Are QR codes safe to scan

A QR code is a string, not an identity check. Are QR codes safe to scan depends on the destination, a sticker covering the real print, and whether the payload is a Wi-Fi password. The camera does not open photos, mail, or contacts by itself.

Are QR codes safe to scan

The modules encode bytes. iOS Camera and Android Camera or Lens read those bytes from the viewfinder on current versions, with no extra QR app required for a well-formed symbol. After decode, the phone shows a URL, a Wi-Fi join sheet, or a payload the OS already knows how to handle. Nothing in ISO/IEC 18004 authenticates the poster. A hospital flyer and a fake flyer can print equally valid finder patterns.

Judge the destination, not the nested squares. Prefer an HTTPS host you recognise. A short-link host is a common phishing pattern because the preview hides the final domain until after a hop. That observation does not come with a percentage; invented crime rates do not belong here.

A sticker-over attack is physical, not cryptographic. Someone prints a smaller malicious symbol and pastes it on top of a legitimate one. Your camera returns one code, typically the top one, not an average of both. Run a fingernail over the print. A raised corner is a reason to stop.

Hosted SmartQRCode types (website, menu, landing pages) encode a SmartQRCode URL and redirect with HTTP 302, which keeps later destination edits live. Analytics on those types record totals, device type, and country-level headers. They cannot see a scanner name, email, or GPS pin. A static Wi-Fi code never hits that server; the phone reads the password from the modules.

If you are the one printing, a Canva one-off or another free static generator is the right tool for a throwaway poster that will never move and will never be counted. Use a hosted type when you need to change the URL after ink or to count scans.

Does a QR symbol prove who printed it

No. The symbol is not a badge, a signature, or a certificate. Anyone with a generator can encode any URL they can type. Brand colours, a logo in the centre, and a glossy laminate do not change that. Error correction can even hide a logo in the middle while the destination stays hostile.

The honest check is the URL preview the OS shows before you tap through. Read the host. If it is a random string, a lookalike of a bank, or a short-link host you do not recognise, put the phone down. For a restaurant, the menu generator should land on a page the staff can name. For a shop window, a website code should match the fascia.

If you control a hosted code and you discover a sticker on your own print, you can point the destination at a warning page without reprinting. A static file under the sticker cannot do that. That is the only operational difference that helps after a physical swap.

Can a pasted sticker hide a real code

Yes, and it is the most common physical trick worth teaching staff. The overlay does not need to be perfect. It needs to sit inside the camera frame. Two tent cards in one viewfinder can also make the phone pick the wrong symbol; keep one code per frame when you test.

Wi-Fi password placement belongs in the same physical brief. A Wi-Fi code hands the network secret to whoever scans. Tape it in a staff corridor, not on the street window. Changing the password means printing a new static symbol; there is no edit-after-print on Wi-Fi.

Confirm a suspect print with a second phone and a second angle. Low light and motion blur fail more often than a "wrong app," so stand still. If the preview URL does not match what the owner claims, treat the paper as untrusted even if the finder patterns look crisp.

What scan data can the owner see

If the code is hosted on SmartQRCode, the owner sees scan totals over time, a coarse device type, and a country derived from request headers. That is the whole identity story. Country-level headers are not a GPS trace and not a named person.

If the code is a static Wi-Fi payload, the owner sees nothing from the scan. The phone joins or it does not. There is no dashboard row. That is why Wi-Fi is the wrong type when you wanted a count of how many guests connected.

A scanner who wants zero owner-side log should prefer a static URL printed with Canva, Google Chart, or the iOS/Android camera-adjacent generators, or should type the address from a paper menu. That is the F90 case: we are the wrong product when you do not want a host in the path.

For a restaurant walkthrough of the same physical checks, see safe to scan a menu QR code. For the inspection steps before you tap, see QR code phishing how to spot.