Can a QR code be hacked? The square of dots itself cannot. It is a printed pattern holding a short piece of text, and nobody can reach into a poster and rewrite it. What can go wrong is everything around the code: a sticker placed over it, a bad page behind it, a redirect that someone takes over, or a link that nobody owns any more. Here is what can and cannot happen, and what to look for in codes you print or scan.
Can a QR code itself be hacked?
No, and it helps to be precise about why. A QR code encodes text: a web address, a Wi-Fi name and password, a contact card, a payment request, a few words. It has no instructions and cannot run anything. Your phone reads the text, shows you what it found, and waits for you.
Once a code is printed it is fixed. If it holds a web address, that address is in the ink forever. The only way to change what a printed code "does" is to change what happens at that address, or to cover the code with another one.
So "QR code hacking" in practice means one of five things, none of which touch the dots.
Can scanning a QR code hack your phone?
Scanning cannot. Reading a code is like reading a sign. Your phone is only at risk after the scan, and only if you take one of these steps:
- Install something. A page asks you to download an app from outside the app store, or to install a "configuration profile" or "certificate". Say no. This is the only route to real malware, and it needs your tap.
- Join a network. A Wi-Fi code can offer a network with a convincing name. On an untrusted network, someone can watch traffic that is not encrypted. Join only networks a venue has told you about.
- Type something in. A fake sign-in or payment page does not hack your phone; it asks you for the information and you give it. This is by far the most common outcome, and our list of QR code scams covers the versions in circulation.
- Approve something. A code can open a text message, a call or a payment app with details filled in. Read what is on screen before you confirm.
The five real QR code attacks
1. The swap
Someone sticks their own code over yours. Parking meters, charging points, table cards, posters and even product packaging in stores have all been hit. Every scan from then on goes to the attacker until someone notices.
Defense: print codes into the material rather than as stickers, make them look unmistakably like your brand so a plain sticker stands out, and scan your own codes on a regular walk-round. The glossary entry on the QR code sticker scam shows what to look for.
2. The bad destination from day one
The code was made by an attacker and always pointed at a fake page: in a phishing email, on a flyer, on a fake fine. Nothing was hacked; the code was simply never honest.
Defense: as a scanner, read the domain in the preview, or run the code through the free QR code safety checker, which explains it without opening it. As a provider, check destinations before and after a code is made. AriaQR checks every short link's destination against Google Safe Browsing when it is created and re-checks it over time, and refuses links to other shorteners and to bare number addresses.
3. The redirect hijack
A dynamic code points at a short link, and the short link points at the real page. If someone gets into the account that owns the link, they can point every printed code somewhere else without touching a single poster. This is the attack unique to dynamic codes, and it is an account attack, not a code attack.
Defense: strong sign-in on the account, as few people with edit rights as possible, and alerts when a destination changes. On AriaQR, codes that carry a payment are locked by default and can only be changed by the signed-in owner, so a guest session or a shared link can never redirect money.
4. The abandoned link
A provider shuts down, a free plan expires, or a domain lapses. The short domain goes up for sale, someone buys it, and every code ever printed with that domain now lands wherever the new owner wants. Codes printed years ago on menus, signs and packaging become live doors into somebody else's site.
Defense: choose a provider you expect to be around, and prefer one that keeps links alive after a plan ends rather than reselling them. Keep a list of what you printed and where, so you can replace it if you ever have to.
5. Session hijacking (QRLjacking)
Some services let you sign in on a computer by scanning a code with your phone: messaging apps and some banking sites work this way. An attacker shows you a copy of that sign-in code on a fake page; you scan it, and you have signed the attacker in to your account on their computer.
Defense: only scan sign-in codes on the service's own site or app, opened by you, and check the list of active sessions in the app from time to time.
Are dynamic QR codes less secure than static ones?
They carry different risks. A static code bakes its payload into the print: nothing can be changed, which also means nothing can be fixed. A dynamic code points at a link you control: it can be fixed, tracked and stopped, which also means the account behind it has to be protected. Our comparison of dynamic and static QR codes covers the everyday trade-offs; this is the security view.
| Risk | Static code | Dynamic code |
|---|---|---|
| Sticker swap | Same for both | Same for both |
| Bad page discovered after printing | Cannot be fixed; reprint | Change the destination in seconds |
| Destination hijacked | Not possible | Possible if the account is weak |
| Provider disappears | Code keeps working (it never needed the provider) | Depends on what happens to the short domain |
| Knowing a code is being abused | No signal | Scan analytics show it, and link checks can flag it |
| Payment codes | Payload fixed forever | Should be locked to the owner, as on AriaQR |
For a code that will be printed once and never changed, such as a Wi-Fi card, static is simplest. For anything public that may need fixing, dynamic with a well-protected account is safer in practice, because the one thing that reliably goes wrong, a destination that stops being right, can be corrected.
How to choose codes that stay safe
Whether you are printing a hundred table cards or one billboard, ask the provider these questions:
- Who can change where my code goes? Only signed-in owners, with team access you control.
- Do you check destinations? Against a reputation service such as Google Safe Browsing, at creation and afterwards.
- Can anyone report a bad code? And do reported links warn people until someone reviews them?
- What happens to my links if I stop paying? You want a clear answer, not a resold domain.
- Will I know if something changes? Alerts for a broken destination and a view of scans over time, as described in editable destinations and alerts.
- Can I make the code look like mine? A code built from your own artwork is far harder to counterfeit with a plain sticker than a black-and-white square.
How AriaQR protects the account behind your codes
Attack three, the redirect hijack, is the one that worries people most about dynamic codes, so here is exactly what stands between an attacker and your printed codes on AriaQR. The full list is on our security page.
- No password to steal. You sign in with Google or a one-time code sent to your email, so there is no AriaQR password to phish or reuse. API keys are shown once and stored only as salted hashes, so a key can be revoked but never read back.
- Private links stay private. Manage and download links carry long random secrets, checked in constant time, so they cannot be guessed.
- Payment codes are locked. A code that carries a payment can only be changed by the signed-in owner; a guest session or a shared dashboard link cannot redirect money.
- Destinations are checked. Google Safe Browsing on creation and on every change, and daily re-checks for short links and free codes. A destination that turns bad stops redirecting, and the daily link check can email you or call a webhook when a destination stops answering, as described in editable destinations and alerts.
- Anyone can report a code. The report page needs no account, and reported links warn before they redirect.
- Your scanners are not tracked. No cookies, no stored network addresses; the privacy policy and data processing terms spell out what is kept and for how long.
- Researchers are welcome. If you find a weakness, the security page explains how to report it and what we promise in return.
To check any code you are about to print or scan, the free QR code safety checker explains what it does without opening it, and the QR code tester confirms a printed code still reads the way you expect.
Where to start
Stop worrying about the dots and look after the three things that matter: the surface the code is printed on, the page it opens, and the account that controls it. For your own codes, that means printing into the material, landing on your own domain, locking down who can edit, and keeping an eye on scans. You can make a code with those protections in place and verified before download, and see pricing when you are ready.