# Can a QR code steal your data?

> No: scanning reads nothing from your phone. Data theft happens at the destination, through a phishing form you fill in, an OAuth consent screen you approve, or a hostile WiFi network you join. The code is the lure, not the theft. Check the domain and never enter credentials on a scanned page.

Source: https://useqr.app/docs/security/can-a-qr-code-steal-your-data · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## The code reads nothing

Decoding is strictly one-way. Your camera turns a pattern into at most 2,953 bytes of
text; the pattern learns nothing back. A QR code has no access to your photos, contacts,
messages, location or anything else,
[it cannot execute or read at all](/docs/security/what-a-qr-code-can-and-cannot-do-to-your-phone).
At the moment of scanning, whoever made the code does not even know it was scanned.

So the direct answer is no. But QR codes are used to steal data every day, as the
delivery mechanism for pages that do the stealing. Naming those mechanisms precisely is
what makes them avoidable, because every one of them needs something from you.

## Mechanism 1: the phishing form

The overwhelming majority of QR-linked data theft is a fake page and your own thumbs: a
pixel-faithful bank or Microsoft 365 login, a card form on a
[cloned parking page](/docs/security/parking-qr-code-scams), a "verify your details"
survey. Nothing is taken; everything is *typed*. Modern kits run as reverse proxies that
pass your real password through to the real site and keep the session token, which
captures accounts even when a one-time code is used. You type the OTP into the proxy
too. One habit defeats the entire category: **never enter credentials or payment details
on a page you reached by scanning.** Navigate there yourself.

## Mechanism 2: OAuth consent abuse

Subtler, because no password is typed. The scanned link opens a genuine "Sign in with
Google/Microsoft" consent screen (real domain, real padlock) requesting scopes for a
malicious app: read your mail, access your files, sign in as you. Approve it, and the
attacker holds a token that survives password changes and sidesteps MFA. The tell is the
**scope list**: a menu or prize page has no business reading your email. Read what the
consent screen actually says before tapping Accept, and review your account's authorised
apps if you approved something in haste.

## Mechanism 3: links that carry authority

Some URLs are themselves credentials: password-reset links, magic sign-in links, session
identifiers. A phishing flow can ask you to "confirm your identity" by requesting a reset
on the real site and having you relay what arrives. Treat any page that asks you to paste
or forward a link or code sent to you as an active theft in progress.

## Mechanism 4: the WiFi nuance

A [WiFi code](/wifi-qr-code) can invite you onto a network the attacker controls. Your
phone still asks before joining, but once on a hostile network the operator can observe
your traffic **metadata** (which sites you contact, when, and roughly how much), and can
attempt to redirect you to fake pages. Honesty requires the other half: HTTPS, now the
default nearly everywhere, means the *content* of what you send is encrypted and a
hostile network cannot simply read your passwords. The realistic risks are metadata
exposure and phishing pages served on the network's captive portal. Join networks from
the venue's own signage, and doubt any "log in with your email password" portal.

A separate, quieter path is the code's *creation*: server-side generators receive
whatever you encode (WiFi passwords included), which is why
[client-side generation](/docs/security/client-side-vs-server-side-qr-generation)
matters, and why [scan logging](/docs/security/qr-codes-and-tracking-what-is-logged)
deserves its own page.

## The habits that make you safe

- Read the domain on the preview banner,
  [the ten-second check](/docs/security/how-to-check-a-qr-code-before-opening).
- Never type credentials or card details on a scanned page.
- Read OAuth consent scopes before approving; revoke unfamiliar apps.
- Decode suspicious codes without opening them: our [scanner](/scan) shows the raw text
  entirely in your browser.

## FAQ

### Can a QR code steal my personal information just by scanning it?
No. Decoding is one-way: the code cannot read contacts, photos, messages or anything else, and its creator does not even learn the scan happened. Theft requires a destination page and your participation there.

### Can a QR code steal my passwords?
Only by persuading you to type them into a fake login page, or to approve an OAuth consent screen granting a malicious app access. Never enter credentials on a page you reached by scanning, and read consent scopes before accepting.

### Can a QR code steal my banking details?
Not directly. The documented pattern is a fake payment page (parking, delivery fees, table ordering), where victims type card numbers themselves. Check the domain first, and treat any card form reached by scanning as unverified.

### Is joining WiFi from a QR code dangerous?
Your phone asks before joining, and HTTPS protects the content of your traffic even on a hostile network. The residual risks are traffic metadata and fake portal pages, so join from the venue's own signage and never enter account passwords into a WiFi portal.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate
- https://useqr.app/wifi