How to Make and Scan QR Codes Safely in 2026

How QR codes work

A QR code encodes text—usually a URL—that cameras and scanner apps decode. Error correction lets codes remain readable with minor damage or partial obstruction. The square patterns are not inherently dangerous; the destination URL is what matters.

Dynamic QR services redirect through a short link you can change later. Static codes embed the final URL directly. Dynamic is flexible for marketing campaigns; static is simpler and does not depend on a third-party redirect service staying online.

Codes can also encode Wi-Fi credentials, vCard contact data, or plain text. Recipients should know what type they expect before scanning.

Creating QR codes responsibly

Use HTTPS URLs you control. Link to official menu pages, event registration, or portfolio sites—not URL shorteners you do not recognize. If you must shorten, use a reputable provider and monitor the redirect.

Test on multiple phones and apps before printing posters. Verify the preview URL matches the printed context—typos in manually built codes are permanent on thousands of flyers.

Add a human-readable URL or short domain near the code so users can type instead of scan when skeptical.

Safe scanning habits

Preview the link when your scanner app offers it. On iOS Camera and many Android scanners, a banner shows the domain before opening Safari or Chrome. If the domain looks wrong, stop.

Avoid scanning codes on unsolicited mail claiming urgent payment, mystery prizes, or account suspension. Go directly to the service website or app instead.

Keep your phone updated. Browser and OS patches close vulnerabilities that malicious sites might exploit after a bad scan.

Common QR scams to recognize

Parking meter stickers with overlay codes redirect to phishing payment pages. Compare the code to official city branding; pay inside the official app when available.

Physical mail with QR codes promising refunds or tax fixes is a growing phishing vector. Government agencies rarely demand payment via random QR mailers.

Event venues and restaurants are generally legitimate, but tampered stickers on table tents happen. Staff can confirm the correct ordering URL.

QR codes for business, menus, and events

Restaurants use QR for menus to update prices without reprinting. Museums link to audio tours. Creators link to link-in-bio pages. Each use should disclose what the user will see—menu PDF, signup form, or video.

Track campaign performance with UTM parameters in the URL encoded in the QR. Analytics stay honest when each placement uses a distinct tag.

Print at adequate size and contrast. Dark codes on light backgrounds with quiet zone margin scan fastest. Low contrast gold-on-cream designs fail in dim light.

Accessibility and fallbacks

Not everyone can scan easily—offer the same destination as typed text or NFC where appropriate. Screen reader users benefit from descriptive link text on the landing page, not generic click here.

High-contrast codes help low-vision scanners and older camera modules. Avoid decorative inversion that breaks standards.

For public signage, periodic audits ensure redirects still work and SSL certificates remain valid. Broken campaign links erode trust.

Frequently asked questions