Safety and privacy
A QR code does not show its web address in plain text. Add a clear label and a visible domain or fallback URL so people can decide whether to scan it.
A static QR code can avoid an extra redirect and scan-tracking provider. The website it opens may still collect data under its own privacy policy, and the encoded destination must remain safe and current.
Anyone who scans a public QR code may be able to read its contents. Keep access tokens, private notes, internal IDs, and sensitive personal data out of it. For Wi-Fi, use a guest network rather than private or administrator credentials.
Before publishing, check the destination and scan the exported file or print proof. Inspect public stickers, posters, menus, counters, and payment stands for damage or replacement during the campaign.
Create a QR code without a redirect
Encode a direct destination, label the code clearly, and test the final file before publishing.
Key decisions
Label the destination
Tell scanners what will open before they scan: menu, Wi-Fi, contact card, review link, payment request, app store page, or support chat.
Avoid sensitive data
Keep private notes, access tokens, internal IDs, personal data, and non-guest passwords out of public QR codes.
Check printed codes for tampering
Check printed codes for tampering, replacement stickers, damage, glare, low contrast, stale URLs, or unexpected redirects.
Verify payment QR codes
Show the recipient, amount, currency, and purpose beside a payment QR code. Ask customers to check those details in their app before approving.
Safety tradeoffs
| Choice | Safer practice | Risk to avoid |
|---|---|---|
| Static code | No provider redirect required | Cannot change after printing |
| Dynamic redirect | Editable destination | Provider dependency and tracking concerns |
| Payment QR | Show recipient, amount, currency, and purpose near the code and in the payment app | Unlabeled payment requests or replaced counter stickers |
| Public signage | Visible action label, trusted domain, fallback URL, and inspection schedule | Anonymous stickers, unknown short links, damaged prints, or low-contrast art |
| Encoded data | Only publish information intended for anyone who scans | Access tokens, private notes, internal IDs, or sensitive personal data |
| Campaign tracking | Use UTM tags on URLs you control and explain analytics in your policy | Sending every scan through an opaque third-party redirect without a need |
Before publishing a QR code
Review the destination, payload, file, and placement before the QR code appears in public or goes to print.
Confirm the destination
Open the URL on a phone. Check for HTTPS and confirm that the domain and page match the label beside the code.
Minimize the payload
Keep static payloads short and intentional. For Wi-Fi, use a guest network. For vCards, include only public contact fields. For events, avoid internal notes.
Test the final asset
Scan the exported PNG, SVG, PDF, or EPS after it is placed in the final artwork, not only inside the generator preview.
Keep a fallback visible
Add a short URL, domain, or plain-language instruction near printed codes so people can judge the destination and still act if scanning fails.
Checks to make after launch
QR codes on physical materials need the same operational checks as signs, payment terminals, and public notices.
Inspect physical placements
Check for sticker overlays, swapped payment codes, torn posters, glare, poor lighting, and surfaces that bend or distort the code.
Keep control of the destination
Make sure the team responsible for the code can maintain its domain, redirects, hosted files, and campaign pages.
Document the source file
Store the QR payload, owner, creation date, print location, and replacement process so stale or suspicious codes can be retired quickly.
Review analytics choices
You do not need a QR redirect to measure visits to a website. Add UTM tags to URLs you control, and explain any analytics in your privacy policy.
QR safety checklist
- Scan every final print proof before public release.
- For website links, use HTTPS and show the destination domain beside the code.
- Avoid encoding confidential values directly in the QR payload.
- Inspect public stickers or posters for tampering during campaigns.
- Show a visible label, trusted domain, and fallback URL near public QR codes.
- Use guest Wi-Fi credentials for public network QR codes.
- Keep payment recipient, amount, currency, and purpose visible before approval.
- Store the source payload, owner, print location, and replacement process.
- Use UTM tracking on URLs you control when you need campaign analytics.
- Remove or replace printed QR codes when a destination changes ownership or becomes stale.
Publish safer QR codes in four steps
- 1
Choose the least sensitive payload
Prefer a short HTTPS URL, guest Wi-Fi network, public contact card, or visible payment request instead of embedding private data directly.
- 2
Label the code clearly
Add the action, trusted domain, and fallback URL near the QR code so people understand what they are about to open.
- 3
Test the exact final file
Scan the exported asset, final PDF, design-tool export, and printed proof across more than one phone before public release.
- 4
Inspect it after launch
Check public placements for replacement stickers, damage, low contrast, stale links, and unexpected redirects during the campaign.
Frequently asked questions
Are static QR codes private?
Not automatically. A static code avoids an intermediary QR redirect, but the destination website may collect data when someone visits. The code may also reveal the information encoded in it to anyone who scans.
How do I reduce QR phishing risk?
Show the destination domain beside the code. Before opening a scanned link, check that the domain matches the label and inspect the full URL for misspellings or unexpected redirects. Check public placements for replacement stickers.
What should I avoid putting in a public QR code?
Avoid access tokens, private notes, internal IDs, personal data, admin credentials, and non-guest Wi-Fi passwords. Public QR payloads should contain only information intended for scanners.
How do I make payment QR codes safer?
Show the recipient, amount, currency, and payment purpose near the code, then ask customers to confirm the same details inside their payment app before approving.
How often should public QR codes be inspected?
Inspect high-risk placements such as payment counters, event entrances, menus, posters, and public signs during the campaign and whenever a destination changes.
Can I track QR campaigns without a dynamic QR provider?
Yes. For website destinations, use UTM-tagged URLs that you control and measure visits in your analytics platform. Static QR files do not need provider scan tracking.