QR-Buddy

QR codes, safety, and scams — your questions answered

Straight answers about QR codes, QR scams, and staying safe — written in plain English, with no jargon and no scaremongering. New here? Start with the first question, then try the checker on any code you're unsure about.

Can a QR code give you a virus?

Not by itself. A QR code is just a picture of text — usually a web address — and scanning it doesn't run anything on your phone. The risk comes from where that text sends you: a malicious website can pressure you into installing a fake app, entering passwords or card details, or granting permissions you shouldn't.

So the safe habit isn't “never scan” — it's “look before you tap”. If the destination looks wrong, don't open it.

How do QR code scams work?

Scammers stick a fake QR code over a real one — on a parking meter, a restaurant menu, an event poster, even inside an email. You scan expecting one place and land somewhere else entirely: a look-alike payment page, a “sign in to your account” form that isn't real, or a site that quietly harvests whatever you type.

It works because a QR code hides its destination. You can't read a link by looking at it — which is exactly the gap QR-Buddy is built to close.

What should I check before scanning a QR code?

Start with the code itself: is it a sticker slapped on top of something else, or printed as part of the sign? Tampered-looking stickers deserve far more suspicion.

Then check where it actually goes before opening it. Watch for shortened links, http instead of https, bare IP addresses instead of proper domains, and brand names with odd spellings. QR-Buddy runs all of those checks for you — you can run any code through the checker in a few seconds, entirely on your device.

Why are QR codes in public places riskier than ones on a website?

On a website you can usually read the link before clicking. On a lamppost you can't — the code is the only thing you see, and anyone with a sticker printer can put a new one over the old. Public codes are easy to replace and hard to police, which is why “quishing” (QR phishing) reports keep climbing.

Public doesn't mean safe. It just means nobody has checked it for you — so do a quick check yourself.

I scanned something and now I'm worried. What should I do?

First: scanning alone is rarely enough to cause harm. The danger starts when you open the link, install something, or enter details. If you haven't done any of those, you're almost certainly fine.

If you did tap through: don't enter any more information, close the page, and if you gave away a password, change it now — anywhere you reused it too. If you installed an app or entered card details, uninstall the app, contact your bank, and be wary of follow-up “verification” messages. QR-Buddy never opens links for you, so checking a code can't put you on a bad page.

Are shortened links inside QR codes dangerous?

They're a warning sign, not proof of a scam. Legitimate services shorten links too — but a shortener hides the real destination even after you've read the code, which is exactly what scammers rely on. bit.ly, tinyurl, t.co, rebrand.ly and cutt.ly turn up in both harmless and hostile codes.

QR-Buddy flags shorteners as “be careful” rather than “dodgy” for that reason. Following a short link to its true final destination needs a server, so that deeper redirect check is on the roadmap as “coming soon”.

What do the green, amber and red verdicts actually mean?

🟢 Looks fine — nothing suspicious in what the code contains. 🟠 Be careful — something worth a second look, like a shortener or an http link. 🔴 Likely dodgy — strong signals such as a look-alike brand name, a punycode impostor domain, or a bare IP address.

The verdict is guidance, not a guarantee. QR-Buddy checks what's inside the code, on your device; it can't see what a link does after you open it. When it says be careful, be careful.

Does QR-Buddy upload my QR codes or camera images?

No. Both tools run entirely in your browser: the checker decodes images and camera frames on your device, and the generator builds codes on your device. Nothing is uploaded, stored, or sent anywhere — there's no account and no server in the loop.

You can even disconnect from the internet and both tools keep working.

Can I make a QR code that's safe to share?

Yes — and the same rules apply in reverse. Point it at a real https address you control, avoid shorteners (people can't tell where those go), and test it with QR-Buddy before printing. You can create one with the generator — links, Wi-Fi, contacts, messages — and download it as PNG or SVG.

One habit worth copying: tell people what your code leads to. “Scan for the menu” beats a mystery sticker every time.

Check a QR · Create a QR · About · FAQ · Privacy · Terms